org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor Class Reference

Classes
class	TsvColumn

Public Member Functions
	LeappFileProcessor (String xmlFile) throws IOException, IngestModuleException, NoCurrentCaseException
ProcessResult	processFiles (Content dataSource, Path moduleOutputPath, AbstractFile LeappFile)
ProcessResult	processFileSystem (Content dataSource, Path moduleOutputPath)

Private Member Functions
void	checkAttributeType (Collection< BlackboardAttribute > bbattributes, String attrType, String[] columnValues, int columnNumber, BlackboardAttribute.Type attributeType, String fileName)
void	configExtractor () throws IOException
BlackboardArtifact	createArtifactWithAttributes (int type, AbstractFile abstractFile, Collection< BlackboardAttribute > bbattributes)
BlackboardArtifact	createArtifactWithAttributes (int type, Content dataSource, Collection< BlackboardAttribute > bbattributes)
Map< Integer, String >	findColumnsToProcess (String fileName, String line, List< TsvColumn > attrList)
List< String >	findTsvFiles (Path LeappOutputDir) throws IngestModuleException
void	getArtifactNode (Document xmlinput)
void	getAttributeNodes (Document xmlinput)
void	getFileNode (Document xmlinput)
String	getXmlAttrIdentifier (String fileName, String attributeName)
String	getXmlFileIdentifier (String fileName)
void	loadConfigFile () throws IngestModuleException
void	processFile (File LeappFile, List< TsvColumn > attrList, String fileName, BlackboardArtifact.Type artifactType, List< BlackboardArtifact > bbartifacts, Content dataSource) throws FileNotFoundException, IOException, IngestModuleException, TskCoreException
void	processLeappFiles (List< String > LeappFilesToProcess, AbstractFile LeappImageFile) throws FileNotFoundException, IOException, IngestModuleException
void	processLeappFiles (List< String > LeappFilesToProcess, Content dataSource) throws IngestModuleException
Collection< BlackboardAttribute >	processReadLine (String line, Map< Integer, String > columnNumberToProcess, String fileName) throws IngestModuleException

Private Attributes
final Map< String, String >	tsvFileArtifactComments
final Map< String, String >	tsvFileArtifacts
final Map< String, List< TsvColumn > >	tsvFileAttributes
final Map< String, String >	tsvFiles
final String	xmlFile

Static Private Attributes
static final Logger	logger = Logger.getLogger(LeappFileProcessor.class.getName())
static final String	MODULE_NAME = ILeappAnalyzerModuleFactory.getModuleName()

Detailed Description

Find and process output from Leapp program and bring into Autopsy

Definition at line 72 of file LeappFileProcessor.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.LeappFileProcessor

(

String

xmlFile

)

throws IOException, IngestModuleException, NoCurrentCaseException

Definition at line 132 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.configExtractor(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.loadConfigFile(), and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.xmlFile.

Member Function Documentation

void org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.checkAttributeType ( Collection< BlackboardAttribute >  bbattributes, String  attrType, String[]  columnValues, int  columnNumber, BlackboardAttribute.Type  attributeType, String  fileName  )

private

Definition at line 378 of file LeappFileProcessor.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processReadLine().

void org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.configExtractor ( ) throws IOException

private

Extract the Leapp config xml file to the user directory to process

Exceptions

org.sleuthkit.autopsy.ingest.IngestModule.IngestModuleException

Definition at line 696 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.coreutils.PlatformUtil.extractResourceToUserConfigDir().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.LeappFileProcessor().

BlackboardArtifact org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.createArtifactWithAttributes ( int  type, AbstractFile  abstractFile, Collection< BlackboardAttribute >  bbattributes  )

private

Generic method for creating a blackboard artifact with attributes

Parameters

type	is a blackboard.artifact_type enum to determine which type the artifact should be
abstractFile	is the AbstractFile object that needs to have the artifact added for it
bbattributes	is the collection of blackboard attributes that need to be added to the artifact after the artifact has been created

Returns

The newly-created artifact, or null on error

Definition at line 639 of file LeappFileProcessor.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFile().

BlackboardArtifact org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.createArtifactWithAttributes ( int  type, Content  dataSource, Collection< BlackboardAttribute >  bbattributes  )

private

Generic method for creating a blackboard artifact with attributes

Parameters

type	is a blackboard.artifact_type enum to determine which type the artifact should be
dataSource	is the Content object that needs to have the artifact added for it
bbattributes	is the collection of blackboard attributes that need to be added to the artifact after the artifact has been created

Returns

The newly-created artifact, or null on error

Definition at line 662 of file LeappFileProcessor.java.

Map<Integer, String> org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.findColumnsToProcess ( String  fileName, String  line, List< TsvColumn >  attrList  )

private

Process the first line of the tsv file which has the headings. Match the headings to the columns in the XML mapping file so we know which columns to process.

Parameters

fileName	The name of the file in which these column headers exist.
line	a tsv heading line of the columns in the file
attrList	the list of headings we want to process

Returns

the numbered column(s) and attribute(s) we want to use for the column(s)

Definition at line 451 of file LeappFileProcessor.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFile().

List<String> org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.findTsvFiles ( Path  LeappOutputDir ) throws IngestModuleException

private

Find the tsv files in the Leapp output directory and match them to files we know we want to process and return the list to process those files.

Definition at line 184 of file LeappFileProcessor.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFiles(), and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFileSystem().

void org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getArtifactNode ( Document  xmlinput )

private

Definition at line 530 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.casemodule.Case.getCurrentCase(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getXmlFileIdentifier().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.loadConfigFile().

void org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getAttributeNodes ( Document  xmlinput )

private

Definition at line 572 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.casemodule.Case.getCurrentCase(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getXmlAttrIdentifier().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.loadConfigFile().

void org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getFileNode ( Document  xmlinput )

private

Definition at line 518 of file LeappFileProcessor.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.loadConfigFile().

String org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getXmlAttrIdentifier ( String  fileName, String  attributeName  )

private

Definition at line 566 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getXmlFileIdentifier().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getAttributeNodes().

String org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getXmlFileIdentifier ( String  fileName )

private

Definition at line 560 of file LeappFileProcessor.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getArtifactNode(), and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getXmlAttrIdentifier().

void org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.loadConfigFile ( ) throws IngestModuleException

private

Read the XML config file and load the mappings into maps

Definition at line 495 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getArtifactNode(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getAttributeNodes(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getFileNode(), org.sleuthkit.autopsy.coreutils.PlatformUtil.getUserConfigDirectory(), and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.xmlFile.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.LeappFileProcessor().

void org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFile ( File  LeappFile, List< TsvColumn >  attrList, String  fileName, BlackboardArtifact.Type  artifactType, List< BlackboardArtifact >  bbartifacts, Content  dataSource  ) throws FileNotFoundException, IOException, IngestModuleException, TskCoreException

private

Definition at line 285 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.createArtifactWithAttributes(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.findColumnsToProcess(), and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processReadLine().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processLeappFiles().

ProcessResult org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFiles	(	Content	dataSource,
		Path	moduleOutputPath,
		AbstractFile	LeappFile
	)

Definition at line 155 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.ingest.IngestModule.ProcessResult.ERROR, org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.findTsvFiles(), org.sleuthkit.autopsy.ingest.IngestModule.ProcessResult.OK, and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processLeappFiles().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.processALeappFile(), and org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.processILeappFile().

ProcessResult org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFileSystem	(	Content	dataSource,
		Path	moduleOutputPath
	)

Definition at line 167 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.ingest.IngestModule.ProcessResult.ERROR, org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.findTsvFiles(), org.sleuthkit.autopsy.ingest.IngestModule.ProcessResult.OK, and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processLeappFiles().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.processALeappFs(), and org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.processILeappFs().

void org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processLeappFiles ( List< String >  LeappFilesToProcess, AbstractFile  LeappImageFile  ) throws FileNotFoundException, IOException, IngestModuleException

private

Process the Leapp files that were found that match the xml mapping file

Parameters

LeappFilesToProcess	List of files to process
LeappImageFile	Abstract file to create artifact for

Exceptions

FileNotFoundException
IOException

Definition at line 216 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.casemodule.Case.getCurrentCase(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFile().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFiles(), and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFileSystem().

void org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processLeappFiles ( List< String >  LeappFilesToProcess, Content  dataSource  ) throws IngestModuleException

private

Process the Leapp files that were found that match the xml mapping file

Parameters

LeappFilesToProcess	List of files to process
dataSource	The data source.

Exceptions

FileNotFoundException
IOException

Definition at line 251 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.casemodule.Case.getCurrentCase(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFile().

Collection<BlackboardAttribute> org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processReadLine ( String  line, Map< Integer, String >  columnNumberToProcess, String  fileName  ) throws IngestModuleException

private

Process the line read and create the necessary attributes for it

Parameters

line	a tsv line to process that was read
columnNumberToProcess	Which columns to process in the tsv line
fileName	name of file begin processed

Returns

Definition at line 329 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.checkAttributeType(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCase(), and org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFile().

Member Data Documentation

final Logger org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.logger = Logger.getLogger(LeappFileProcessor.class.getName())

staticprivate

Definition at line 120 of file LeappFileProcessor.java.

final String org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.MODULE_NAME = ILeappAnalyzerModuleFactory.getModuleName()

staticprivate

Definition at line 121 of file LeappFileProcessor.java.

final Map<String, String> org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.tsvFileArtifactComments

private

Definition at line 127 of file LeappFileProcessor.java.

final Map<String, String> org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.tsvFileArtifacts

private

Definition at line 126 of file LeappFileProcessor.java.

final Map<String, List<TsvColumn> > org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.tsvFileAttributes

private

Definition at line 128 of file LeappFileProcessor.java.

final Map<String, String> org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.tsvFiles

private

Definition at line 125 of file LeappFileProcessor.java.

final String org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.xmlFile

private

Definition at line 123 of file LeappFileProcessor.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.LeappFileProcessor(), and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.loadConfigFile().

---

The documentation for this class was generated from the following file:

• /home/carriersleuth/repos/autopsy/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/LeappFileProcessor.java