Inherits org.sleuthkit.autopsy.ingest.DataSourceIngestModule.

Public Member Functions
ProcessResult	process (Content dataSource, DataSourceIngestModuleProgress statusHelper)

default void	shutDown ()

void	startUp (IngestJobContext context) throws IngestModuleException

Private Member Functions
void	addILeappReportToReports (Path iLeappOutputDir, Case currentCase)

ProcessBuilder	buildiLeappCommand (Path moduleOutputPath, String sourceFilePath, String iLeappFileSystemType)

ProcessBuilder	buildiLeappListCommand (Path moduleOutputPath)

void	extractFilesFromImage (Content dataSource, List< String > iLeappPathsToProcess, Path moduleOutputPath)

void	extractFileToOutput (Content dataSource, AbstractFile iLeappFile, File fileParentPath, Path parentPath)

List< String >	loadIleappPathFile (Path moduleOutputPath) throws FileNotFoundException, IOException

void	processILeappFile (Content dataSource, Case currentCase, DataSourceIngestModuleProgress statusHelper, int filesProcessedCount, AbstractFile iLeappFile)

void	processILeappFs (Content dataSource, Case currentCase, DataSourceIngestModuleProgress statusHelper, String directoryToProcess)

void	writeiLeappFile (Content dataSource, AbstractFile iLeappFile, String parentPath)

Static Private Member Functions
static ProcessBuilder	buildProcessWithRunAsInvoker (String...commandLine)

static File	locateExecutable (String executableName) throws FileNotFoundException

Private Attributes
IngestJobContext	context

File	iLeappExecutable

LeappFileProcessor	iLeappFileProcessor

Static Private Attributes
static final String	ILEAPP = "iLeapp"

static final String	ILEAPP_EXECUTABLE = "ileapp.exe"

static final String	ILEAPP_FS = "fs_"

static final String	ILEAPP_PATHS_FILE = "iLeapp_paths.txt"

static final Logger	logger = Logger.getLogger(ILeappAnalyzerIngestModule.class.getName())

static final String	MODULE_NAME = ILeappAnalyzerModuleFactory.getModuleName()

static final String	XMLFILE = "ileap-artifact-attribute-reference.xml"

Detailed Description

Data source ingest module that runs iLeapp against logical iOS files.

Definition at line 64 of file ILeappAnalyzerIngestModule.java.

Member Function Documentation

void org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.addILeappReportToReports	(	Path	iLeappOutputDir,
		Case	currentCase
	)

private

Find the index.html file in the iLeapp output directory so it can be added to reports

Definition at line 335 of file ILeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.casemodule.Case.addReport(), and org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.MODULE_NAME.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.processILeappFile(), and org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.processILeappFs().

ProcessBuilder org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.buildiLeappCommand	(	Path	moduleOutputPath,
		String	sourceFilePath,
		String	iLeappFileSystemType
	)

private

Build the command to run xLeapp

Parameters

moduleOutputPath	output path for xLeapp
sourceFilePath	path where the xLeapp file is
iLeappFileSystemType	type of file to process tar/zip/fs

Returns: process to run

Definition at line 282 of file ILeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.buildProcessWithRunAsInvoker().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.processILeappFile(), and org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.processILeappFs().

ProcessBuilder org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.buildiLeappListCommand ( Path moduleOutputPath )

private

Command to run xLeapp using the path option

Parameters

moduleOutputPath path where the file paths output will reside

Returns: process to run

Definition at line 300 of file ILeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.buildProcessWithRunAsInvoker().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.process().

static ProcessBuilder org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.buildProcessWithRunAsInvoker ( String... commandLine )

staticprivate

Definition at line 311 of file ILeappAnalyzerIngestModule.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.buildiLeappCommand(), and org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.buildiLeappListCommand().

void org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.extractFilesFromImage	(	Content	dataSource,
		List< String >	iLeappPathsToProcess,
		Path	moduleOutputPath
	)

private

Extract files from a disk image to process with xLeapp

Parameters

dataSource	Datasource of the image
iLeappPathsToProcess	List of paths to extract content from
moduleOutputPath	path to write content to

Definition at line 390 of file ILeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.ingest.IngestJobContext.dataSourceIngestIsCancelled(), org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.extractFileToOutput(), and org.sleuthkit.autopsy.casemodule.services.FileManager.findFiles().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.process().

void org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.extractFileToOutput	(	Content	dataSource,
		AbstractFile	iLeappFile,
		File	fileParentPath,
		Path	parentPath
	)

private

Create path and file from datasource in temp

Parameters

dataSource	datasource of the image
iLeappFile	abstract file to write out
fileParentPath	parent file path
parentPath	parent file

Definition at line 433 of file ILeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.writeiLeappFile().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.extractFilesFromImage().

List<String> org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.loadIleappPathFile ( Path moduleOutputPath ) throws FileNotFoundException, IOException

private

Definition at line 364 of file ILeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.ILEAPP_PATHS_FILE.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.process().

static File org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.locateExecutable ( String executableName ) throws FileNotFoundException

staticprivate

Definition at line 321 of file ILeappAnalyzerIngestModule.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.startUp().

ProcessResult org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.process	(	Content	dataSource,
		DataSourceIngestModuleProgress	progressBar
	)

Processes a data source. Called once between calls to startUp() and shutDown().

IMPORTANT: In addition to returning ProcessResult.OK or ProcessResult.ERROR, modules should log all errors using methods provided by the org.sleuthkit.autopsy.coreutils.Logger class. Log messages should include the name and object ID of the data being processed. If an exception has been caught by the module, the exception should be sent to the Logger along with the log message so that a stack trace will appear in the application log.

Parameters

dataSource	The data source to process.
progressBar	A progress bar to be used to report progress.

Returns: A result code indicating success or failure of the processing.

Implements org.sleuthkit.autopsy.ingest.DataSourceIngestModule.

Definition at line 128 of file ILeappAnalyzerIngestModule.java.

void org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.processILeappFile	(	Content	dataSource,
		Case	currentCase,
		DataSourceIngestModuleProgress	statusHelper,
		int	filesProcessedCount,
		AbstractFile	iLeappFile
	)

private

Process each tar/zip file that is found in a logical image that contains xLeapp data

Parameters

dataSource	Datasource where the file has been found
currentCase	current case
statusHelper	Progress bar for messages to show user
filesProcessedCount	count that is incremented for progress bar
iLeappFile	abstract file that will be processed

Definition at line 190 of file ILeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.addILeappReportToReports(), org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.buildiLeappCommand(), org.sleuthkit.autopsy.ingest.IngestJobContext.dataSourceIngestIsCancelled(), org.sleuthkit.autopsy.ingest.IngestModule.ProcessResult.ERROR, org.sleuthkit.autopsy.coreutils.ExecUtil.execute(), org.sleuthkit.autopsy.casemodule.Case.getModuleDirectory(), org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.ILEAPP, org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFiles(), and org.sleuthkit.autopsy.ingest.DataSourceIngestModuleProgress.progress().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.process().

void org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.processILeappFs	(	Content	dataSource,
		Case	currentCase,
		DataSourceIngestModuleProgress	statusHelper,
		String	directoryToProcess
	)

private

Process extracted files from a disk image using xLeapp

Parameters

dataSource	Datasource where the file has been found
currentCase	current case
statusHelper	Progress bar for messages to show user
directoryToProcess

Definition at line 236 of file ILeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.addILeappReportToReports(), org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.buildiLeappCommand(), org.sleuthkit.autopsy.ingest.IngestJobContext.dataSourceIngestIsCancelled(), org.sleuthkit.autopsy.ingest.IngestModule.ProcessResult.ERROR, org.sleuthkit.autopsy.coreutils.ExecUtil.execute(), org.sleuthkit.autopsy.casemodule.Case.getModuleDirectory(), org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.ILEAPP, org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFileSystem(), and org.sleuthkit.autopsy.ingest.DataSourceIngestModuleProgress.progress().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.process().

default void org.sleuthkit.autopsy.ingest.IngestModule.shutDown ( )

inherited

Invoked by Autopsy when an ingest job is completed (either because the data has been analyzed or because the job was cancelled), before the ingest module instance is discarded. The module should respond by doing things like releasing private resources, submitting final results, and posting a final ingest message.

IMPORTANT: If the module instances must share resources, the modules are responsible for synchronizing access to the shared resources and doing reference counting as required to release those resources correctly. Also, more than one ingest job may be in progress at any given time. This must also be taken into consideration when sharing resources between module instances. See IngestModuleReferenceCounter.

Implemented in org.sleuthkit.autopsy.thunderbirdparser.ThunderbirdMboxFileIngestModule, org.sleuthkit.autopsy.modules.hashdatabase.HashDbIngestModule, org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule, org.sleuthkit.autopsy.modules.filetypeid.FileTypeIdIngestModule, org.sleuthkit.autopsy.modules.fileextmismatch.FileExtMismatchIngestModule, org.sleuthkit.autopsy.modules.embeddedfileextractor.EmbeddedFileExtractorIngestModule, org.sleuthkit.autopsy.modules.yara.YaraIngestModule, and org.sleuthkit.autopsy.centralrepository.ingestmodule.CentralRepoDataArtifactIngestModule.

Definition at line 86 of file IngestModule.java.

void org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.startUp ( IngestJobContext context ) throws IngestModuleException

Invoked by Autopsy to allow an ingest module instance to set up any internal data structures and acquire any private resources it will need during an ingest job. If the module depends on loading any resources, it should do so in this method so that it can throw an exception in the case of an error and alert the user. Exceptions that are thrown from startUp() are logged and stop processing of the data source.

IMPORTANT: If the module instances must share resources, the modules are responsible for synchronizing access to the shared resources and doing reference counting as required to release those resources correctly. Also, more than one ingest job may be in progress at any given time. This must also be taken into consideration when sharing resources between module instances. See IngestModuleReferenceCounter.

Parameters

context Provides data and services specific to the ingest job and the ingest pipeline of which the module is a part.

Exceptions

org.sleuthkit.autopsy.ingest.IngestModule.IngestModuleException

Implements org.sleuthkit.autopsy.ingest.IngestModule.

Definition at line 92 of file ILeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.context, org.sleuthkit.autopsy.coreutils.PlatformUtil.is64BitOS(), org.sleuthkit.autopsy.coreutils.PlatformUtil.isWindowsOS(), and org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.locateExecutable().

void org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.writeiLeappFile	(	Content	dataSource,
		AbstractFile	iLeappFile,
		String	parentPath
	)

private

Write out file to output

Parameters

dataSource	datasource of disk image
iLeappFile	acstract file to write out
parentPath	path to write file to

Definition at line 468 of file ILeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.datamodel.ContentUtils.writeToFile().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.extractFileToOutput().

Member Data Documentation

IngestJobContext org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.context

private

Definition at line 79 of file ILeappAnalyzerIngestModule.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.startUp().

final String org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.ILEAPP = "iLeapp"

staticprivate

Definition at line 69 of file ILeappAnalyzerIngestModule.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.process(), org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.processILeappFile(), and org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.processILeappFs().

final String org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.ILEAPP_EXECUTABLE = "ileapp.exe"

staticprivate

Definition at line 71 of file ILeappAnalyzerIngestModule.java.

final String org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.ILEAPP_FS = "fs_"

staticprivate

Definition at line 70 of file ILeappAnalyzerIngestModule.java.

final String org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.ILEAPP_PATHS_FILE = "iLeapp_paths.txt"

staticprivate

Definition at line 72 of file ILeappAnalyzerIngestModule.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.loadIleappPathFile().

File org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.iLeappExecutable

private

Definition at line 77 of file ILeappAnalyzerIngestModule.java.

LeappFileProcessor org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.iLeappFileProcessor

private

Definition at line 81 of file ILeappAnalyzerIngestModule.java.

final Logger org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.logger = Logger.getLogger(ILeappAnalyzerIngestModule.class.getName())

staticprivate

Definition at line 66 of file ILeappAnalyzerIngestModule.java.

final String org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.MODULE_NAME = ILeappAnalyzerModuleFactory.getModuleName()

staticprivate

Definition at line 67 of file ILeappAnalyzerIngestModule.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.addILeappReportToReports().

final String org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.XMLFILE = "ileap-artifact-attribute-reference.xml"

staticprivate

Definition at line 74 of file ILeappAnalyzerIngestModule.java.

The documentation for this class was generated from the following file: