Autopsy  4.17.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
Public Member Functions | Static Public Member Functions | Private Member Functions | Static Private Member Functions | Private Attributes | Static Private Attributes | List of all members
org.sleuthkit.autopsy.casemodule.ImageDSProcessor Class Reference

Inherits org.sleuthkit.autopsy.corecomponentinterfaces.DataSourceProcessor, and org.sleuthkit.autopsy.datasourceprocessors.AutoIngestDataSourceProcessor.

Public Member Functions

 ImageDSProcessor ()
 
void cancel ()
 
int canProcess (Path dataSourcePath) throws AutoIngestDataSourceProcessorException
 
String getDataSourceType ()
 
JPanel getPanel ()
 
boolean isPanelValid ()
 
void process (String deviceId, Path dataSourcePath, DataSourceProcessorProgressMonitor progressMonitor, DataSourceProcessorCallback callBack)
 
IngestStream processWithIngestStream (String deviceId, Path dataSourcePath, IngestJobSettings settings, DataSourceProcessorProgressMonitor progressMonitor, DataSourceProcessorCallback callBack)
 
void reset ()
 
void run (DataSourceProcessorProgressMonitor progressMonitor, DataSourceProcessorCallback callback)
 
void run (String deviceId, String imagePath, String timeZone, boolean ignoreFatOrphanFiles, DataSourceProcessorProgressMonitor progressMonitor, DataSourceProcessorCallback callback)
 
void runWithIngestStream (IngestJobSettings settings, DataSourceProcessorProgressMonitor progress, DataSourceProcessorCallback callBack)
 
void setDataSourceOptions (String imagePath, String timeZone, boolean ignoreFatOrphanFiles)
 
boolean supportsIngestStream ()
 

Static Public Member Functions

static String getType ()
 

Private Member Functions

void doAddImageProcess (String deviceId, String imagePath, int sectorSize, String timeZone, boolean ignoreFatOrphanFiles, String md5, String sha1, String sha256, DataSourceProcessorProgressMonitor progressMonitor, DataSourceProcessorCallback callback)
 
void readConfigSettings ()
 

Static Private Member Functions

static boolean isAcceptedByFiler (File file, List< FileFilter > filters)
 

Private Attributes

AddImageTask addImageTask
 
final ImageFilePanel configPanel
 
String deviceId
 
boolean ignoreFatOrphanFiles
 
Image image = null
 
String imagePath
 
IngestStream ingestStream = null
 
final Logger logger = Logger.getLogger(ImageDSProcessor.class.getName())
 
String md5
 
int sectorSize
 
boolean setDataSourceOptionsCalled
 
String sha1
 
String sha256
 
String timeZone
 

Static Private Attributes

static final String ALL_DESC = NbBundle.getMessage(ImageDSProcessor.class, "ImageDSProcessor.allDesc.text")
 
static final List< String > allExt = new ArrayList<>()
 
static final GeneralFilter allFilter = new GeneralFilter(allExt, ALL_DESC)
 
static final String DATA_SOURCE_TYPE = NbBundle.getMessage(ImageDSProcessor.class, "ImageDSProcessor.dsType.text")
 
static final GeneralFilter encaseFilter = new GeneralFilter(GeneralFilter.ENCASE_IMAGE_EXTS, GeneralFilter.ENCASE_IMAGE_DESC)
 
static final List< FileFilter > filtersList = new ArrayList<>()
 
static final GeneralFilter rawFilter = new GeneralFilter(GeneralFilter.RAW_IMAGE_EXTS, GeneralFilter.RAW_IMAGE_DESC)
 
static final GeneralFilter virtualMachineFilter = new GeneralFilter(GeneralFilter.VIRTUAL_MACHINE_EXTS, GeneralFilter.VIRTUAL_MACHINE_DESC)
 

Detailed Description

A image file data source processor that implements the DataSourceProcessor service provider interface to allow integration with the add data source wizard. It also provides a run method overload to allow it to be used independently of the wizard.

Definition at line 57 of file ImageDSProcessor.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.casemodule.ImageDSProcessor.ImageDSProcessor ( )

Constructs an image file data source processor that implements the DataSourceProcessor service provider interface to allow integration with the add data source wizard. It also provides a run method overload to allow it to be used independently of the wizard.

Definition at line 104 of file ImageDSProcessor.java.

References org.sleuthkit.autopsy.casemodule.ImageFilePanel.createInstance().

Member Function Documentation

void org.sleuthkit.autopsy.casemodule.ImageDSProcessor.cancel ( )

Requests cancellation of the background task that adds a data source to the case database, after the task is started using the run method. This is a "best effort" cancellation, with no guarantees that the case database will be unchanged. If cancellation succeeded, the list of new data sources returned by the background task will be empty.

Implements org.sleuthkit.autopsy.corecomponentinterfaces.DataSourceProcessor.

Definition at line 389 of file ImageDSProcessor.java.

References org.sleuthkit.autopsy.ingest.IngestStream.stop().

int org.sleuthkit.autopsy.casemodule.ImageDSProcessor.canProcess ( Path  dataSourcePath) throws AutoIngestDataSourceProcessorException

Indicates whether the DataSourceProcessor is capable of processing the data source. Returns a confidence value. Method can throw an exception for a system level problem. The exception should not be thrown for an issue related to bad input data.

Parameters
dataSourcePathPath to the data source.
Returns
Confidence value. Values between 0 and 100 are recommended. Zero or less means the data source is not supported by the DataSourceProcessor. Value of 100 indicates high certainty in being able to process the data source.
Exceptions
org.sleuthkit.autopsy.datasourceprocessors.AutoIngestDataSourceProcessor.AutoIngestDataSourceProcessorException

Implements org.sleuthkit.autopsy.datasourceprocessors.AutoIngestDataSourceProcessor.

Definition at line 422 of file ImageDSProcessor.java.

References org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), and org.sleuthkit.autopsy.coreutils.DataSourceUtils.imageHasFileSystem().

void org.sleuthkit.autopsy.casemodule.ImageDSProcessor.doAddImageProcess ( String  deviceId,
String  imagePath,
int  sectorSize,
String  timeZone,
boolean  ignoreFatOrphanFiles,
String  md5,
String  sha1,
String  sha256,
DataSourceProcessorProgressMonitor  progressMonitor,
DataSourceProcessorCallback  callback 
)
private

Adds a data source to the case database using a background task in a separate thread and the given settings instead of those provided by the selection and configuration panel. Returns as soon as the background task is started and uses the callback object to signal task completion and return results.

The image should be loaded in the database and stored in "image" before calling this method. Additionally, an ingest stream should be initialized and stored in "ingestStream".

Parameters
deviceIdAn ASCII-printable identifier for the device associated with the data source that is intended to be unique across multiple cases (e.g., a UUID).
imagePathPath to the image file.
sectorSizeThe sector size (use '0' for autodetect).
timeZoneThe time zone to use when processing dates and times for the image, obtained from java.util.TimeZone.getID.
ignoreFatOrphanFilesWhether to parse orphans if the image has a FAT filesystem.
md5The MD5 hash of the image, may be null.
sha1The SHA-1 hash of the image, may be null.
sha256The SHA-256 hash of the image, may be null.
progressMonitorProgress monitor for reporting progress during processing.
callbackCallback to call when processing is done.

Definition at line 353 of file ImageDSProcessor.java.

References org.sleuthkit.autopsy.corecomponentinterfaces.DataSourceProcessorCallback.DataSourceProcessorResult.CRITICAL_ERRORS, and org.sleuthkit.autopsy.corecomponentinterfaces.DataSourceProcessorCallback.done().

String org.sleuthkit.autopsy.casemodule.ImageDSProcessor.getDataSourceType ( )

Gets a string that describes the type of data sources this processor is able to add to the case database. The string is suitable for display in a type selection UI component (e.g., a combo box).

Returns
A data source type display string for this data source processor.

Implements org.sleuthkit.autopsy.corecomponentinterfaces.DataSourceProcessor.

Definition at line 136 of file ImageDSProcessor.java.

JPanel org.sleuthkit.autopsy.casemodule.ImageDSProcessor.getPanel ( )

Gets the panel that allows a user to select a data source and do any configuration required by the data source. The panel is less than 544 pixels wide and less than 173 pixels high.

Returns
A selection and configuration panel for this data source processor.

Implements org.sleuthkit.autopsy.corecomponentinterfaces.DataSourceProcessor.

Definition at line 149 of file ImageDSProcessor.java.

References org.sleuthkit.autopsy.casemodule.ImageFilePanel.readSettings(), org.sleuthkit.autopsy.casemodule.ImageFilePanel.reset(), and org.sleuthkit.autopsy.casemodule.ImageFilePanel.select().

static String org.sleuthkit.autopsy.casemodule.ImageDSProcessor.getType ( )
static

Gets a string that describes the type of data sources this processor is able to add to the case database. The string is suitable for display in a type selection UI component (e.g., a combo box).

Returns
A data source type display string for this data source processor.

Definition at line 124 of file ImageDSProcessor.java.

static boolean org.sleuthkit.autopsy.casemodule.ImageDSProcessor.isAcceptedByFiler ( File  file,
List< FileFilter >  filters 
)
staticprivate

Definition at line 412 of file ImageDSProcessor.java.

boolean org.sleuthkit.autopsy.casemodule.ImageDSProcessor.isPanelValid ( )

Indicates whether the settings in the selection and configuration panel are valid and complete.

Returns
True if the settings are valid and complete and the processor is ready to have its run method called, false otherwise.

Implements org.sleuthkit.autopsy.corecomponentinterfaces.DataSourceProcessor.

Definition at line 164 of file ImageDSProcessor.java.

References org.sleuthkit.autopsy.casemodule.ImageFilePanel.validatePanel().

void org.sleuthkit.autopsy.casemodule.ImageDSProcessor.process ( String  deviceId,
Path  dataSourcePath,
DataSourceProcessorProgressMonitor  progressMonitor,
DataSourceProcessorCallback  callBack 
)

Adds a data source to the case database using a background task in a separate thread by calling DataSourceProcessor.run() method. Returns as soon as the background task is started. The background task uses a callback object to signal task completion and return results. Method can throw an exception for a system level problem. The exception should not be thrown for an issue related to bad input data.

Parameters
deviceIdAn ASCII-printable identifier for the device associated with the data source that is intended to be unique across multiple cases (e.g., a UUID).
dataSourcePathPath to the data source.
progressMonitorProgress monitor that will be used by the background task to report progress.
callBackCallback that will be used by the background task to return results.

Implements org.sleuthkit.autopsy.datasourceprocessors.AutoIngestDataSourceProcessor.

Definition at line 445 of file ImageDSProcessor.java.

References org.sleuthkit.autopsy.corecomponentinterfaces.DataSourceProcessorCallback.DataSourceProcessorResult.CRITICAL_ERRORS, org.sleuthkit.autopsy.corecomponentinterfaces.DataSourceProcessorCallback.done(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCase(), and org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().

IngestStream org.sleuthkit.autopsy.casemodule.ImageDSProcessor.processWithIngestStream ( String  deviceId,
Path  dataSourcePath,
IngestJobSettings  settings,
DataSourceProcessorProgressMonitor  progressMonitor,
DataSourceProcessorCallback  callBack 
)

Adds a data source to the case database using a background task in a separate thread by calling DataSourceProcessor.run() method. Returns as soon as the background task is started. The background task uses a callback object to signal task completion and return results. Method can throw an exception for a system level problem. The exception should not be thrown for an issue related to bad input data.

Parameters
deviceIdAn ASCII-printable identifier for the device associated with the data source that is intended to be unique across multiple cases (e.g., a UUID).
dataSourcePathPath to the data source.
settingsThe ingest job settings.
progressMonitorProgress monitor that will be used by the background task to report progress.
callBackCallback that will be used by the background task to return results.
Returns
The new ingest stream or null if an error occurred. Errors will be handled by the callback.

Implements org.sleuthkit.autopsy.datasourceprocessors.AutoIngestDataSourceProcessor.

Definition at line 469 of file ImageDSProcessor.java.

References org.sleuthkit.autopsy.corecomponentinterfaces.DataSourceProcessorCallback.DataSourceProcessorResult.CRITICAL_ERRORS, org.sleuthkit.autopsy.corecomponentinterfaces.DataSourceProcessorCallback.done(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCase(), org.sleuthkit.autopsy.ingest.IngestManager.getInstance(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), and org.sleuthkit.autopsy.ingest.IngestManager.openIngestStream().

void org.sleuthkit.autopsy.casemodule.ImageDSProcessor.readConfigSettings ( )
private
void org.sleuthkit.autopsy.casemodule.ImageDSProcessor.reset ( )

Resets the selection and configuration panel for this data source processor.

Implements org.sleuthkit.autopsy.corecomponentinterfaces.DataSourceProcessor.

Definition at line 403 of file ImageDSProcessor.java.

References org.sleuthkit.autopsy.casemodule.ImageFilePanel.reset().

void org.sleuthkit.autopsy.casemodule.ImageDSProcessor.run ( DataSourceProcessorProgressMonitor  progressMonitor,
DataSourceProcessorCallback  callback 
)

Adds a data source to the case database using a background task in a separate thread and the settings provided by the selection and configuration panel. Returns as soon as the background task is started. The background task uses a callback object to signal task completion and return results.

This method should not be called unless isPanelValid returns true.

Parameters
progressMonitorProgress monitor that will be used by the background task to report progress.
callbackCallback that will be used by the background task to return results.

Implements org.sleuthkit.autopsy.corecomponentinterfaces.DataSourceProcessor.

Definition at line 183 of file ImageDSProcessor.java.

References org.sleuthkit.autopsy.corecomponentinterfaces.DataSourceProcessorCallback.DataSourceProcessorResult.CRITICAL_ERRORS, org.sleuthkit.autopsy.corecomponentinterfaces.DataSourceProcessorCallback.done(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCase(), and org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().

void org.sleuthkit.autopsy.casemodule.ImageDSProcessor.run ( String  deviceId,
String  imagePath,
String  timeZone,
boolean  ignoreFatOrphanFiles,
DataSourceProcessorProgressMonitor  progressMonitor,
DataSourceProcessorCallback  callback 
)

Adds a data source to the case database using a background task in a separate thread and the given settings instead of those provided by the selection and configuration panel. Returns as soon as the background task is started and uses the callback object to signal task completion and return results.

Parameters
deviceIdAn ASCII-printable identifier for the device associated with the data source that is intended to be unique across multiple cases (e.g., a UUID).
imagePathPath to the image file.
timeZoneThe time zone to use when processing dates and times for the image, obtained from java.util.TimeZone.getID.
ignoreFatOrphanFilesWhether to parse orphans if the image has a FAT filesystem.
progressMonitorProgress monitor for reporting progress during processing.
callbackCallback to call when processing is done.

Definition at line 308 of file ImageDSProcessor.java.

References org.sleuthkit.autopsy.corecomponentinterfaces.DataSourceProcessorCallback.DataSourceProcessorResult.CRITICAL_ERRORS, org.sleuthkit.autopsy.corecomponentinterfaces.DataSourceProcessorCallback.done(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCase(), and org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().

void org.sleuthkit.autopsy.casemodule.ImageDSProcessor.runWithIngestStream ( IngestJobSettings  settings,
DataSourceProcessorProgressMonitor  progress,
DataSourceProcessorCallback  callBack 
)

Adds a data source to the case database using a background task in a separate thread and the settings provided by the selection and configuration panel. Files found during ingest will be sent directly to the IngestStream provided. Returns as soon as the background task is started. The background task uses a callback object to signal task completion and return results.

This method should not be called unless isPanelValid returns true, and should only be called for DSPs that support ingest streams.

Parameters
settingsThe ingest job settings.
progressProgress monitor that will be used by the background task to report progress.
callBackCallback that will be used by the background task to return results.

Implements org.sleuthkit.autopsy.corecomponentinterfaces.DataSourceProcessor.

Definition at line 218 of file ImageDSProcessor.java.

References org.sleuthkit.autopsy.corecomponentinterfaces.DataSourceProcessorCallback.DataSourceProcessorResult.CRITICAL_ERRORS, org.sleuthkit.autopsy.corecomponentinterfaces.DataSourceProcessorCallback.done(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCase(), org.sleuthkit.autopsy.ingest.IngestManager.getInstance(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), and org.sleuthkit.autopsy.ingest.IngestManager.openIngestStream().

void org.sleuthkit.autopsy.casemodule.ImageDSProcessor.setDataSourceOptions ( String  imagePath,
String  timeZone,
boolean  ignoreFatOrphanFiles 
)

Sets the configuration of the data source processor without using the selection and configuration panel.

Parameters
imagePathPath to the image file.
timeZoneThe time zone to use when processing dates and times for the image, obtained from java.util.TimeZone.getID.
ignoreFatOrphanFilesWhether to parse orphans if the image has a FAT filesystem.
Deprecated:
Use the provided overload of the run method instead.

Definition at line 518 of file ImageDSProcessor.java.

boolean org.sleuthkit.autopsy.casemodule.ImageDSProcessor.supportsIngestStream ( )

Check if this DSP supports ingest streams.

Returns
True if this DSP supports an ingest stream, false otherwise.

Implements org.sleuthkit.autopsy.corecomponentinterfaces.DataSourceProcessor.

Definition at line 283 of file ImageDSProcessor.java.

Member Data Documentation

AddImageTask org.sleuthkit.autopsy.casemodule.ImageDSProcessor.addImageTask
private

Definition at line 69 of file ImageDSProcessor.java.

final String org.sleuthkit.autopsy.casemodule.ImageDSProcessor.ALL_DESC = NbBundle.getMessage(ImageDSProcessor.class, "ImageDSProcessor.allDesc.text")
staticprivate

Definition at line 65 of file ImageDSProcessor.java.

final List<String> org.sleuthkit.autopsy.casemodule.ImageDSProcessor.allExt = new ArrayList<>()
staticprivate

Definition at line 61 of file ImageDSProcessor.java.

final GeneralFilter org.sleuthkit.autopsy.casemodule.ImageDSProcessor.allFilter = new GeneralFilter(allExt, ALL_DESC)
staticprivate

Definition at line 66 of file ImageDSProcessor.java.

final ImageFilePanel org.sleuthkit.autopsy.casemodule.ImageDSProcessor.configPanel
private

Definition at line 68 of file ImageDSProcessor.java.

final String org.sleuthkit.autopsy.casemodule.ImageDSProcessor.DATA_SOURCE_TYPE = NbBundle.getMessage(ImageDSProcessor.class, "ImageDSProcessor.dsType.text")
staticprivate

Definition at line 59 of file ImageDSProcessor.java.

String org.sleuthkit.autopsy.casemodule.ImageDSProcessor.deviceId
private

Definition at line 76 of file ImageDSProcessor.java.

final GeneralFilter org.sleuthkit.autopsy.casemodule.ImageDSProcessor.encaseFilter = new GeneralFilter(GeneralFilter.ENCASE_IMAGE_EXTS, GeneralFilter.ENCASE_IMAGE_DESC)
staticprivate

Definition at line 63 of file ImageDSProcessor.java.

final List<FileFilter> org.sleuthkit.autopsy.casemodule.ImageDSProcessor.filtersList = new ArrayList<>()
staticprivate

Definition at line 67 of file ImageDSProcessor.java.

boolean org.sleuthkit.autopsy.casemodule.ImageDSProcessor.ignoreFatOrphanFiles
private

Definition at line 80 of file ImageDSProcessor.java.

Image org.sleuthkit.autopsy.casemodule.ImageDSProcessor.image = null
private

Definition at line 71 of file ImageDSProcessor.java.

String org.sleuthkit.autopsy.casemodule.ImageDSProcessor.imagePath
private

Definition at line 77 of file ImageDSProcessor.java.

IngestStream org.sleuthkit.autopsy.casemodule.ImageDSProcessor.ingestStream = null
private

Definition at line 70 of file ImageDSProcessor.java.

final Logger org.sleuthkit.autopsy.casemodule.ImageDSProcessor.logger = Logger.getLogger(ImageDSProcessor.class.getName())
private

Definition at line 60 of file ImageDSProcessor.java.

String org.sleuthkit.autopsy.casemodule.ImageDSProcessor.md5
private

Definition at line 81 of file ImageDSProcessor.java.

final GeneralFilter org.sleuthkit.autopsy.casemodule.ImageDSProcessor.rawFilter = new GeneralFilter(GeneralFilter.RAW_IMAGE_EXTS, GeneralFilter.RAW_IMAGE_DESC)
staticprivate

Definition at line 62 of file ImageDSProcessor.java.

int org.sleuthkit.autopsy.casemodule.ImageDSProcessor.sectorSize
private

Definition at line 78 of file ImageDSProcessor.java.

boolean org.sleuthkit.autopsy.casemodule.ImageDSProcessor.setDataSourceOptionsCalled
private

Definition at line 84 of file ImageDSProcessor.java.

String org.sleuthkit.autopsy.casemodule.ImageDSProcessor.sha1
private

Definition at line 82 of file ImageDSProcessor.java.

String org.sleuthkit.autopsy.casemodule.ImageDSProcessor.sha256
private

Definition at line 83 of file ImageDSProcessor.java.

String org.sleuthkit.autopsy.casemodule.ImageDSProcessor.timeZone
private

Definition at line 79 of file ImageDSProcessor.java.

final GeneralFilter org.sleuthkit.autopsy.casemodule.ImageDSProcessor.virtualMachineFilter = new GeneralFilter(GeneralFilter.VIRTUAL_MACHINE_EXTS, GeneralFilter.VIRTUAL_MACHINE_DESC)
staticprivate

Definition at line 64 of file ImageDSProcessor.java.


The documentation for this class was generated from the following file:

Copyright © 2012-2021 Basis Technology. Generated on: Tue Jan 19 2021
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.