Inherits org.sleuthkit.autopsy.ingest.DataSourceIngestModule.

Public Member Functions
ProcessResult	process (Content dataSource, DataSourceIngestModuleProgress statusHelper)

void	startUp (IngestJobContext context) throws IngestModuleException

Private Member Functions
void	addILeappReportToReports (Path aLeappOutputDir, Case currentCase)

ProcessBuilder	buildaLeappCommand (Path moduleOutputPath, String sourceFilePath, String aLeappFileSystemType)

ProcessBuilder	buildaLeappListCommand (Path moduleOutputPath)

void	extractFilesFromImage (Content dataSource, List< String > aLeappPathsToProcess, Path moduleOutputPath)

void	extractFileToOutput (Content dataSource, AbstractFile aLeappFile, File fileParentPath, Path parentPath)

List< AbstractFile >	findaLeappFilesToProcess (Content dataSource)

List< String >	loadIleappPathFile (Path moduleOutputPath) throws FileNotFoundException, IOException

void	processALeappFile (Content dataSource, Case currentCase, DataSourceIngestModuleProgress statusHelper, int filesProcessedCount, AbstractFile aLeappFile)

void	processALeappFs (Content dataSource, Case currentCase, DataSourceIngestModuleProgress statusHelper, String directoryToProcess)

void	writeaLeappFile (Content dataSource, AbstractFile aLeappFile, String parentPath)

Static Private Member Functions
static ProcessBuilder	buildProcessWithRunAsInvoker (String...commandLine)

static File	locateExecutable (String executableName) throws FileNotFoundException

Private Attributes
File	aLeappExecutable

LeappFileProcessor	aLeappFileProcessor

IngestJobContext	context

Static Private Attributes
static final String	ALEAPP = "aLeapp"

static final String	ALEAPP_EXECUTABLE = "aleapp.exe"

static final String	ALEAPP_FS = "fs_"

static final String	ALEAPP_PATHS_FILE = "aLeapp_paths.txt"

static final Logger	logger = Logger.getLogger(ALeappAnalyzerIngestModule.class.getName())

static final String	MODULE_NAME = ALeappAnalyzerModuleFactory.getModuleName()

static final String	XMLFILE = "aleap-artifact-attribute-reference.xml"

Detailed Description

Data source ingest module that runs aLeapp against logical iOS files.

Definition at line 64 of file ALeappAnalyzerIngestModule.java.

Member Function Documentation

void org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.addILeappReportToReports	(	Path	aLeappOutputDir,
		Case	currentCase
	)

private

Find the index.html file in the aLeapp output directory so it can be added to reports

Definition at line 364 of file ALeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.casemodule.Case.addReport(), and org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.MODULE_NAME.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.processALeappFile(), and org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.processALeappFs().

ProcessBuilder org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.buildaLeappCommand	(	Path	moduleOutputPath,
		String	sourceFilePath,
		String	aLeappFileSystemType
	)

private

Build the aLeapp command to run

Parameters

moduleOutputPath	output path for the aLeapp program.
sourceFilePath	where the source files to process reside.
aLeappFileSystemType	the filesystem type to process

Returns: the command to execute

Definition at line 315 of file ALeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.buildProcessWithRunAsInvoker().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.processALeappFile(), and org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.processALeappFs().

ProcessBuilder org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.buildaLeappListCommand ( Path moduleOutputPath )

private

Definition at line 329 of file ALeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.buildProcessWithRunAsInvoker().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.process().

static ProcessBuilder org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.buildProcessWithRunAsInvoker ( String... commandLine )

staticprivate

Definition at line 340 of file ALeappAnalyzerIngestModule.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.buildaLeappCommand(), and org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.buildaLeappListCommand().

void org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.extractFilesFromImage	(	Content	dataSource,
		List< String >	aLeappPathsToProcess,
		Path	moduleOutputPath
	)

private

Definition at line 412 of file ALeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.ingest.IngestJobContext.dataSourceIngestIsCancelled(), org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.extractFileToOutput(), and org.sleuthkit.autopsy.casemodule.services.FileManager.findFiles().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.process().

void org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.extractFileToOutput	(	Content	dataSource,
		AbstractFile	aLeappFile,
		File	fileParentPath,
		Path	parentPath
	)

private

Definition at line 448 of file ALeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.writeaLeappFile().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.extractFilesFromImage().

List<AbstractFile> org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.findaLeappFilesToProcess ( Content dataSource )

private

Find the files that will be processed by the aLeapp program

Parameters

dataSource

Returns: List of abstract files to process.

Definition at line 278 of file ALeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.casemodule.services.FileManager.findFiles().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.process().

List<String> org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.loadIleappPathFile ( Path moduleOutputPath ) throws FileNotFoundException, IOException

private

Definition at line 392 of file ALeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.ALEAPP_PATHS_FILE.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.process().

static File org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.locateExecutable ( String executableName ) throws FileNotFoundException

staticprivate

Definition at line 350 of file ALeappAnalyzerIngestModule.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.startUp().

ProcessResult org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.process	(	Content	dataSource,
		DataSourceIngestModuleProgress	progressBar
	)

Processes a data source. Called once between calls to startUp() and shutDown().

Parameters

dataSource	The data source to process.
progressBar	A progress bar to be used to report progress.

Returns: A result code indicating success or failure of the processing.

Implements org.sleuthkit.autopsy.ingest.DataSourceIngestModule.

Definition at line 124 of file ALeappAnalyzerIngestModule.java.

void org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.processALeappFile	(	Content	dataSource,
		Case	currentCase,
		DataSourceIngestModuleProgress	statusHelper,
		int	filesProcessedCount,
		AbstractFile	aLeappFile
	)

private

Process a file from a logical image using the aLeapp program

Parameters

dataSource	datasource to process
currentCase	current case that is being worked on
statusHelper	show progress and update what is being processed
filesProcessedCount	number of files that have been processed
aLeappFile	the abstract file to process

Definition at line 186 of file ALeappAnalyzerIngestModule.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.process().

void org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.processALeappFs	(	Content	dataSource,
		Case	currentCase,
		DataSourceIngestModuleProgress	statusHelper,
		String	directoryToProcess
	)

private

Process a image/directory using the aLeapp program

Parameters

dataSource	datasource to process
currentCase	current case being procesed
statusHelper	show progress and update what is being processed
directoryToProcess	directory to run aLeapp against

Definition at line 232 of file ALeappAnalyzerIngestModule.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.process().

void org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.startUp ( IngestJobContext context ) throws IngestModuleException

Invoked by Autopsy to allow an ingest module instance to set up any internal data structures and acquire any private resources it will need during an ingest job. If the module depends on loading any resources, it should do so in this method so that it can throw an exception in the case of an error and alert the user. Exceptions that are thrown from process() and shutDown() are logged, but do not stop processing of the data source.

Parameters

context Provides data and services specific to the ingest job and the ingest pipeline of which the module is a part.

Exceptions

org.sleuthkit.autopsy.ingest.IngestModule.IngestModuleException

Implements org.sleuthkit.autopsy.ingest.IngestModule.

Definition at line 92 of file ALeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.context, org.sleuthkit.autopsy.coreutils.PlatformUtil.isWindowsOS(), and org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.locateExecutable().

void org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.writeaLeappFile	(	Content	dataSource,
		AbstractFile	aLeappFile,
		String	parentPath
	)

private

Definition at line 477 of file ALeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.datamodel.ContentUtils.writeToFile().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.extractFileToOutput().

Member Data Documentation

final String org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.ALEAPP = "aLeapp"

staticprivate

Definition at line 69 of file ALeappAnalyzerIngestModule.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.process(), org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.processALeappFile(), and org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.processALeappFs().

final String org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.ALEAPP_EXECUTABLE = "aleapp.exe"

staticprivate

Definition at line 71 of file ALeappAnalyzerIngestModule.java.

final String org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.ALEAPP_FS = "fs_"

staticprivate

Definition at line 70 of file ALeappAnalyzerIngestModule.java.

final String org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.ALEAPP_PATHS_FILE = "aLeapp_paths.txt"

staticprivate

Definition at line 72 of file ALeappAnalyzerIngestModule.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.loadIleappPathFile().

File org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.aLeappExecutable

private

Definition at line 77 of file ALeappAnalyzerIngestModule.java.

LeappFileProcessor org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.aLeappFileProcessor

private

Definition at line 81 of file ALeappAnalyzerIngestModule.java.

IngestJobContext org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.context

private

Definition at line 79 of file ALeappAnalyzerIngestModule.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.startUp().

final Logger org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.logger = Logger.getLogger(ALeappAnalyzerIngestModule.class.getName())

staticprivate

Definition at line 66 of file ALeappAnalyzerIngestModule.java.

final String org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.MODULE_NAME = ALeappAnalyzerModuleFactory.getModuleName()

staticprivate

Definition at line 67 of file ALeappAnalyzerIngestModule.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.addILeappReportToReports().

final String org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.XMLFILE = "aleap-artifact-attribute-reference.xml"

staticprivate

Definition at line 74 of file ALeappAnalyzerIngestModule.java.

The documentation for this class was generated from the following file: