Inherits org.sleuthkit.autopsy.ingest.DataSourceIngestModule.

Public Member Functions
ProcessResult	process (Content dataSource, DataSourceIngestModuleProgress statusHelper)

void	startUp (IngestJobContext context) throws IngestModuleException

Private Member Functions
void	addILeappReportToReports (Path iLeappOutputDir, Case currentCase)

ProcessBuilder	buildiLeappCommand (Path moduleOutputPath, String sourceFilePath, String iLeappFileSystemType)

ProcessBuilder	buildiLeappListCommand (Path moduleOutputPath)

void	extractFilesFromImage (Content dataSource, List< String > iLeappPathsToProcess, Path moduleOutputPath)

void	extractFileToOutput (Content dataSource, AbstractFile iLeappFile, File fileParentPath, Path parentPath)

List< AbstractFile >	findiLeappFilesToProcess (Content dataSource)

List< String >	loadIleappPathFile (Path moduleOutputPath) throws FileNotFoundException, IOException

void	processILeappFile (Content dataSource, Case currentCase, DataSourceIngestModuleProgress statusHelper, int filesProcessedCount, AbstractFile iLeappFile)

void	processILeappFs (Content dataSource, Case currentCase, DataSourceIngestModuleProgress statusHelper, String directoryToProcess)

void	writeiLeappFile (Content dataSource, AbstractFile iLeappFile, String parentPath)

Static Private Member Functions
static ProcessBuilder	buildProcessWithRunAsInvoker (String...commandLine)

static File	locateExecutable (String executableName) throws FileNotFoundException

Private Attributes
IngestJobContext	context

File	iLeappExecutable

LeappFileProcessor	iLeappFileProcessor

Static Private Attributes
static final String	ILEAPP = "iLeapp"

static final String	ILEAPP_EXECUTABLE = "ileapp.exe"

static final String	ILEAPP_FS = "fs_"

static final String	ILEAPP_PATHS_FILE = "iLeapp_paths.txt"

static final Logger	logger = Logger.getLogger(ILeappAnalyzerIngestModule.class.getName())

static final String	MODULE_NAME = ILeappAnalyzerModuleFactory.getModuleName()

static final String	XMLFILE = "ileap-artifact-attribute-reference.xml"

Detailed Description

Data source ingest module that runs iLeapp against logical iOS files.

Definition at line 64 of file ILeappAnalyzerIngestModule.java.

Member Function Documentation

void org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.addILeappReportToReports	(	Path	iLeappOutputDir,
		Case	currentCase
	)

private

Find the index.html file in the iLeapp output directory so it can be added to reports

Definition at line 366 of file ILeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.casemodule.Case.addReport(), and org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.MODULE_NAME.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.processILeappFile(), and org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.processILeappFs().

ProcessBuilder org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.buildiLeappCommand	(	Path	moduleOutputPath,
		String	sourceFilePath,
		String	iLeappFileSystemType
	)

private

Build the command to run xLeapp

Parameters

moduleOutputPath	output path for xLeapp
sourceFilePath	path where the xLeapp file is
iLeappFileSystemType	type of file to process tar/zip/fs

Returns: process to run

Definition at line 313 of file ILeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.buildProcessWithRunAsInvoker().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.processILeappFile(), and org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.processILeappFs().

ProcessBuilder org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.buildiLeappListCommand ( Path moduleOutputPath )

private

Command to run xLeapp using the path option

Parameters

moduleOutputPath path where the file paths output will reside

Returns: process to run

Definition at line 331 of file ILeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.buildProcessWithRunAsInvoker().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.process().

static ProcessBuilder org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.buildProcessWithRunAsInvoker ( String... commandLine )

staticprivate

Definition at line 342 of file ILeappAnalyzerIngestModule.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.buildiLeappCommand(), and org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.buildiLeappListCommand().

void org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.extractFilesFromImage	(	Content	dataSource,
		List< String >	iLeappPathsToProcess,
		Path	moduleOutputPath
	)

private

Extract files from a disk image to process with xLeapp

Parameters

dataSource	Datasource of the image
iLeappPathsToProcess	List of paths to extract content from
moduleOutputPath	path to write content to

Definition at line 421 of file ILeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.ingest.IngestJobContext.dataSourceIngestIsCancelled(), org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.extractFileToOutput(), and org.sleuthkit.autopsy.casemodule.services.FileManager.findFiles().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.process().

void org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.extractFileToOutput	(	Content	dataSource,
		AbstractFile	iLeappFile,
		File	fileParentPath,
		Path	parentPath
	)

private

Create path and file from datasource in temp

Parameters

dataSource	datasource of the image
iLeappFile	abstract file to write out
fileParentPath	parent file path
parentPath	parent file

Definition at line 464 of file ILeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.writeiLeappFile().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.extractFilesFromImage().

List<AbstractFile> org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.findiLeappFilesToProcess ( Content dataSource )

private

Find the files that will be processed by the iLeapp program

Parameters

dataSource

Returns: List of abstract files to process.

Definition at line 278 of file ILeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.casemodule.services.FileManager.findFiles().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.process().

List<String> org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.loadIleappPathFile ( Path moduleOutputPath ) throws FileNotFoundException, IOException

private

Definition at line 395 of file ILeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.ILEAPP_PATHS_FILE.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.process().

static File org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.locateExecutable ( String executableName ) throws FileNotFoundException

staticprivate

Definition at line 352 of file ILeappAnalyzerIngestModule.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.startUp().

ProcessResult org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.process	(	Content	dataSource,
		DataSourceIngestModuleProgress	progressBar
	)

Processes a data source. Called once between calls to startUp() and shutDown().

Parameters

dataSource	The data source to process.
progressBar	A progress bar to be used to report progress.

Returns: A result code indicating success or failure of the processing.

Implements org.sleuthkit.autopsy.ingest.DataSourceIngestModule.

Definition at line 124 of file ILeappAnalyzerIngestModule.java.

void org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.processILeappFile	(	Content	dataSource,
		Case	currentCase,
		DataSourceIngestModuleProgress	statusHelper,
		int	filesProcessedCount,
		AbstractFile	iLeappFile
	)

private

Process each tar/zip file that is found in a logical image that contains xLeapp data

Parameters

dataSource	Datasource where the file has been found
currentCase	current case
statusHelper	Progress bar for messages to show user
filesProcessedCount	count that is incremented for progress bar
iLeappFile	abstract file that will be processed

Definition at line 186 of file ILeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.addILeappReportToReports(), org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.buildiLeappCommand(), org.sleuthkit.autopsy.ingest.IngestJobContext.dataSourceIngestIsCancelled(), org.sleuthkit.autopsy.ingest.IngestModule.ProcessResult.ERROR, org.sleuthkit.autopsy.coreutils.ExecUtil.execute(), org.sleuthkit.autopsy.casemodule.Case.getModuleDirectory(), org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.ILEAPP, org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFiles(), and org.sleuthkit.autopsy.ingest.DataSourceIngestModuleProgress.progress().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.process().

void org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.processILeappFs	(	Content	dataSource,
		Case	currentCase,
		DataSourceIngestModuleProgress	statusHelper,
		String	directoryToProcess
	)

private

Process extracted files from a disk image using xLeapp

Parameters

dataSource	Datasource where the file has been found
currentCase	current case
statusHelper	Progress bar for messages to show user
directoryToProcess

Definition at line 232 of file ILeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.addILeappReportToReports(), org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.buildiLeappCommand(), org.sleuthkit.autopsy.ingest.IngestJobContext.dataSourceIngestIsCancelled(), org.sleuthkit.autopsy.ingest.IngestModule.ProcessResult.ERROR, org.sleuthkit.autopsy.coreutils.ExecUtil.execute(), org.sleuthkit.autopsy.casemodule.Case.getModuleDirectory(), org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.ILEAPP, org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFileSystem(), and org.sleuthkit.autopsy.ingest.DataSourceIngestModuleProgress.progress().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.process().

void org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.startUp ( IngestJobContext context ) throws IngestModuleException

Invoked by Autopsy to allow an ingest module instance to set up any internal data structures and acquire any private resources it will need during an ingest job. If the module depends on loading any resources, it should do so in this method so that it can throw an exception in the case of an error and alert the user. Exceptions that are thrown from process() and shutDown() are logged, but do not stop processing of the data source.

Parameters

context Provides data and services specific to the ingest job and the ingest pipeline of which the module is a part.

Exceptions

org.sleuthkit.autopsy.ingest.IngestModule.IngestModuleException

Implements org.sleuthkit.autopsy.ingest.IngestModule.

Definition at line 92 of file ILeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.context, org.sleuthkit.autopsy.coreutils.PlatformUtil.isWindowsOS(), and org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.locateExecutable().

void org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.writeiLeappFile	(	Content	dataSource,
		AbstractFile	iLeappFile,
		String	parentPath
	)

private

Write out file to output

Parameters

dataSource	datasource of disk image
iLeappFile	acstract file to write out
parentPath	path to write file to

Definition at line 499 of file ILeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.datamodel.ContentUtils.writeToFile().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.extractFileToOutput().

Member Data Documentation

IngestJobContext org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.context

private

Definition at line 79 of file ILeappAnalyzerIngestModule.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.startUp().

final String org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.ILEAPP = "iLeapp"

staticprivate

Definition at line 69 of file ILeappAnalyzerIngestModule.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.process(), org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.processILeappFile(), and org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.processILeappFs().

final String org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.ILEAPP_EXECUTABLE = "ileapp.exe"

staticprivate

Definition at line 71 of file ILeappAnalyzerIngestModule.java.

final String org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.ILEAPP_FS = "fs_"

staticprivate

Definition at line 70 of file ILeappAnalyzerIngestModule.java.

final String org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.ILEAPP_PATHS_FILE = "iLeapp_paths.txt"

staticprivate

Definition at line 72 of file ILeappAnalyzerIngestModule.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.loadIleappPathFile().

File org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.iLeappExecutable

private

Definition at line 77 of file ILeappAnalyzerIngestModule.java.

LeappFileProcessor org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.iLeappFileProcessor

private

Definition at line 81 of file ILeappAnalyzerIngestModule.java.

final Logger org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.logger = Logger.getLogger(ILeappAnalyzerIngestModule.class.getName())

staticprivate

Definition at line 66 of file ILeappAnalyzerIngestModule.java.

final String org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.MODULE_NAME = ILeappAnalyzerModuleFactory.getModuleName()

staticprivate

Definition at line 67 of file ILeappAnalyzerIngestModule.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.addILeappReportToReports().

final String org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.XMLFILE = "ileap-artifact-attribute-reference.xml"

staticprivate

Definition at line 74 of file ILeappAnalyzerIngestModule.java.

The documentation for this class was generated from the following file: