Autopsy  4.18.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
RAImageIngestModule.java
Go to the documentation of this file.
1 /*
2  *
3  * Autopsy Forensic Browser
4  *
5  * Copyright 2012-2019 Basis Technology Corp.
6  *
7  * Copyright 2012 42six Solutions.
8  * Contact: aebadirad <at> 42six <dot> com
9  * Project Contact/Architect: carrier <at> sleuthkit <dot> org
10  *
11  * Licensed under the Apache License, Version 2.0 (the "License");
12  * you may not use this file except in compliance with the License.
13  * You may obtain a copy of the License at
14  *
15  * http://www.apache.org/licenses/LICENSE-2.0
16  *
17  * Unless required by applicable law or agreed to in writing, software
18  * distributed under the License is distributed on an "AS IS" BASIS,
19  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
20  * See the License for the specific language governing permissions and
21  * limitations under the License.
22  */
23 package org.sleuthkit.autopsy.recentactivity;
24 
25 import java.io.File;
26 import java.nio.file.Path;
27 import java.nio.file.Paths;
28 import java.util.ArrayList;
29 import java.util.List;
30 import java.util.logging.Level;
31 import org.openide.util.NbBundle;
41 import org.sleuthkit.datamodel.Content;
44 import org.sleuthkit.datamodel.DataSource;
45 import org.sleuthkit.datamodel.SleuthkitCase;
46 
50 public final class RAImageIngestModule implements DataSourceIngestModule {
51 
52  private static final String RECENT_ACTIVITY_FOLDER = "RecentActivity";
53  private static final Logger logger = Logger.getLogger(RAImageIngestModule.class.getName());
54  private final List<Extract> extractors = new ArrayList<>();
55  private final List<Extract> browserExtractors = new ArrayList<>();
58  private final StringBuilder subCompleted = new StringBuilder();
59  protected SleuthkitCase tskCase;
60  private RAOsAccountCache accountCache = new RAOsAccountCache();
61 
63  }
64 
65  @Override
66  public void startUp(IngestJobContext context) throws IngestModuleException {
67  this.context = context;
68 
69  tskCase = Case.getCurrentCase().getSleuthkitCase();
70 
71  Extract iexplore = new ExtractIE();
72  Extract edge = new ExtractEdge();
73  Extract registry = new ExtractRegistry();
74  Extract recentDocuments = new RecentDocumentsByLnk();
75  Extract chrome = new Chromium();
76  Extract firefox = new Firefox();
77  Extract SEUQA = new SearchEngineURLQueryAnalyzer();
78  Extract osExtract = new ExtractOs();
79  Extract dataSourceAnalyzer = new DataSourceUsageAnalyzer();
80  Extract safari = new ExtractSafari();
81  Extract zoneInfo = new ExtractZoneIdentifier();
82  Extract recycleBin = new ExtractRecycleBin();
83  Extract sru = new ExtractSru();
84  Extract prefetch = new ExtractPrefetch();
85  Extract webAccountType = new ExtractWebAccountType();
86  Extract messageDomainType = new DomainCategoryRunner();
87 
88  extractors.add(recentDocuments);
89  extractors.add(registry); // needs to run before the DataSourceUsageAnalyzer
90  extractors.add(osExtract); // this needs to run before the DataSourceUsageAnalyzer
91  extractors.add(dataSourceAnalyzer); //this needs to run after ExtractRegistry and ExtractOs
92  extractors.add(chrome);
93  extractors.add(firefox);
94  extractors.add(iexplore);
95  extractors.add(edge);
96  extractors.add(safari);
97  extractors.add(SEUQA); // this needs to run after the web browser modules
98  extractors.add(webAccountType); // this needs to run after the web browser modules
99  extractors.add(zoneInfo); // this needs to run after the web browser modules
100  extractors.add(recycleBin); // this needs to run after ExtractRegistry and ExtractOS
101  extractors.add(sru);
102  extractors.add(prefetch);
103  extractors.add(messageDomainType);
104 
105  browserExtractors.add(chrome);
106  browserExtractors.add(firefox);
107  browserExtractors.add(iexplore);
108  browserExtractors.add(edge);
109  browserExtractors.add(safari);
110 
111  for (Extract extractor : extractors) {
112  extractor.init();
113  }
114  }
115 
116  @Override
117  public ProcessResult process(Content dataSource, DataSourceIngestModuleProgress progressBar) {
119  NbBundle.getMessage(this.getClass(),
120  "RAImageIngestModule.process.started",
121  dataSource.getName())));
122 
123  progressBar.switchToDeterminate(extractors.size());
124 
125  ArrayList<String> errors = new ArrayList<>();
126 
127  for (int i = 0; i < extractors.size(); i++) {
128  Extract extracter = extractors.get(i);
129  if (context.dataSourceIngestIsCancelled()) {
130  logger.log(Level.INFO, "Recent Activity has been canceled, quitting before {0}", extracter.getName()); //NON-NLS
131  break;
132  }
133 
134  progressBar.progress(extracter.getName(), i);
135 
136  try {
137  extracter.process(dataSource, context, progressBar, accountCache);
138  if (extracter instanceof ExtractRegistry) {
139  accountCache.initialize(tskCase, ((DataSource) dataSource).getHost());
140  }
141  } catch (Exception ex) {
142  logger.log(Level.SEVERE, "Exception occurred in " + extracter.getName(), ex); //NON-NLS
143  subCompleted.append(NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.errModFailed",
144  extracter.getName()));
145  errors.add(
146  NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.errModErrs", RecentActivityExtracterModuleFactory.getModuleName()));
147  }
148  progressBar.progress(i + 1);
149  errors.addAll(extracter.getErrorMessages());
150  }
151 
152  // create the final message for inbox
153  StringBuilder errorMessage = new StringBuilder();
154  String errorMsgSubject;
155  MessageType msgLevel = MessageType.INFO;
156  if (errors.isEmpty() == false) {
157  msgLevel = MessageType.ERROR;
158  errorMessage.append(
159  NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.errMsg.errsEncountered"));
160  for (String msg : errors) {
161  errorMessage.append("<li>").append(msg).append("</li>\n"); //NON-NLS
162  }
163  errorMessage.append("</ul>\n"); //NON-NLS
164 
165  if (errors.size() == 1) {
166  errorMsgSubject = NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.errMsgSub.oneErr");
167  } else {
168  errorMsgSubject = NbBundle.getMessage(this.getClass(),
169  "RAImageIngestModule.process.errMsgSub.nErrs", errors.size());
170  }
171  } else {
172  errorMessage.append(NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.errMsg.noErrs"));
173  errorMsgSubject = NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.errMsgSub.noErrs");
174  }
176  NbBundle.getMessage(this.getClass(),
177  "RAImageIngestModule.process.ingestMsg.finished",
178  dataSource.getName(), errorMsgSubject),
179  errorMessage.toString());
180  services.postMessage(msg);
181 
182  StringBuilder historyMsg = new StringBuilder();
183  historyMsg.append(
184  NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.histMsg.title", dataSource.getName()));
185  for (Extract module : browserExtractors) {
186  historyMsg.append("<li>").append(module.getName()); //NON-NLS
187  historyMsg.append(": ").append((module.foundData()) ? NbBundle
188  .getMessage(this.getClass(), "RAImageIngestModule.process.histMsg.found") : NbBundle
189  .getMessage(this.getClass(), "RAImageIngestModule.process.histMsg.notFnd"));
190  historyMsg.append("</li>"); //NON-NLS
191  }
192  historyMsg.append("</ul>"); //NON-NLS
194  NbBundle.getMessage(this.getClass(),
195  "RAImageIngestModule.process.ingestMsg.results",
196  dataSource.getName()),
197  historyMsg.toString());
198  services.postMessage(inboxMsg);
199 
200  if (context.dataSourceIngestIsCancelled()) {
201  return ProcessResult.OK;
202  }
203 
204  for (int i = 0; i < extractors.size(); i++) {
205  Extract extracter = extractors.get(i);
206  try {
207  extracter.complete();
208  } catch (Exception ex) {
209  logger.log(Level.SEVERE, "Exception occurred when completing " + extracter.getName(), ex); //NON-NLS
210  subCompleted.append(NbBundle.getMessage(this.getClass(), "RAImageIngestModule.complete.errMsg.failed",
211  extracter.getName()));
212  }
213  }
214 
215  return ProcessResult.OK;
216  }
217 
229  private static String getAndMakeRAPath(String basePath, String module, long ingestJobId) {
230  String moduleFolder = String.format("%s_%d", module, ingestJobId);
231  Path tmpPath = Paths.get(basePath, RECENT_ACTIVITY_FOLDER, moduleFolder);
232  File dir = tmpPath.toFile();
233  if (dir.exists() == false) {
234  dir.mkdirs();
235  }
236  return tmpPath.toString();
237  }
238 
249  static String getRATempPath(Case a_case, String mod, long ingestJobId) {
250  return getAndMakeRAPath(a_case.getTempDirectory(), mod, ingestJobId);
251  }
252 
263  static String getRAOutputPath(Case a_case, String mod, long ingestJobId) {
264  return getAndMakeRAPath(a_case.getModuleDirectory(), mod, ingestJobId);
265  }
266 
273  static String getRelModuleOutputPath(Case autCase, String mod, long ingestJobId) {
274  return Paths.get(getAndMakeRAPath(autCase.getModuleOutputDirectoryRelativePath(), mod, ingestJobId))
275  .normalize()
276  .toString();
277  }
278 }
static IngestMessage createMessage(MessageType messageType, String source, String subject, String detailsHtml)
ProcessResult process(Content dataSource, DataSourceIngestModuleProgress progressBar)
void postMessage(final IngestMessage message)
synchronized static Logger getLogger(String name)
Definition: Logger.java:124
static String getAndMakeRAPath(String basePath, String module, long ingestJobId)
static synchronized IngestServices getInstance()

Copyright © 2012-2021 Basis Technology. Generated on: Thu Jul 8 2021
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.