Autopsy  4.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
RAImageIngestModule.java
Go to the documentation of this file.
1  /*
2  *
3  * Autopsy Forensic Browser
4  *
5  * Copyright 2012-2014 Basis Technology Corp.
6  *
7  * Copyright 2012 42six Solutions.
8  * Contact: aebadirad <at> 42six <dot> com
9  * Project Contact/Architect: carrier <at> sleuthkit <dot> org
10  *
11  * Licensed under the Apache License, Version 2.0 (the "License");
12  * you may not use this file except in compliance with the License.
13  * You may obtain a copy of the License at
14  *
15  * http://www.apache.org/licenses/LICENSE-2.0
16  *
17  * Unless required by applicable law or agreed to in writing, software
18  * distributed under the License is distributed on an "AS IS" BASIS,
19  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
20  * See the License for the specific language governing permissions and
21  * limitations under the License.
22  */
23 package org.sleuthkit.autopsy.recentactivity;
24 
25 import java.io.File;
26 import java.util.ArrayList;
27 import java.util.List;
28 import java.util.logging.Level;
29 import org.openide.util.NbBundle;
37 import org.sleuthkit.datamodel.Content;
40 
44 public final class RAImageIngestModule implements DataSourceIngestModule {
45 
46  private static final Logger logger = Logger.getLogger(RAImageIngestModule.class.getName());
47  private final List<Extract> extracters = new ArrayList<>();
48  private final List<Extract> browserExtracters = new ArrayList<>();
51  private StringBuilder subCompleted = new StringBuilder();
52 
54  }
55 
56  @Override
57  public void startUp(IngestJobContext context) throws IngestModuleException {
58  this.context = context;
59 
60  Extract registry = new ExtractRegistry();
61  Extract iexplore = new ExtractIE();
62  Extract recentDocuments = new RecentDocumentsByLnk();
63  Extract chrome = new Chrome();
64  Extract firefox = new Firefox();
65  Extract SEUQA = new SearchEngineURLQueryAnalyzer();
66 
67  extracters.add(chrome);
68  extracters.add(firefox);
69  extracters.add(iexplore);
70  extracters.add(recentDocuments);
71  extracters.add(SEUQA); // this needs to run after the web browser modules
72  extracters.add(registry); // this runs last because it is slowest
73 
74  browserExtracters.add(chrome);
75  browserExtracters.add(firefox);
76  browserExtracters.add(iexplore);
77 
78  for (Extract extracter : extracters) {
79  extracter.init();
80  }
81  }
82 
83  @Override
84  public ProcessResult process(Content dataSource, DataSourceIngestModuleProgress progressBar) {
86  NbBundle.getMessage(this.getClass(),
87  "RAImageIngestModule.process.started",
88  dataSource.getName())));
89 
90  progressBar.switchToDeterminate(extracters.size());
91 
92  ArrayList<String> errors = new ArrayList<>();
93 
94  for (int i = 0; i < extracters.size(); i++) {
95  Extract extracter = extracters.get(i);
96  if (context.dataSourceIngestIsCancelled()) {
97  logger.log(Level.INFO, "Recent Activity has been canceled, quitting before {0}", extracter.getName()); //NON-NLS
98  break;
99  }
100 
101  progressBar.progress(extracter.getName(), i);
102 
103  try {
104  extracter.process(dataSource, context);
105  } catch (Exception ex) {
106  logger.log(Level.SEVERE, "Exception occurred in " + extracter.getName(), ex); //NON-NLS
107  subCompleted.append(NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.errModFailed",
108  extracter.getName()));
109  errors.add(
110  NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.errModErrs", RecentActivityExtracterModuleFactory.getModuleName()));
111  }
112  progressBar.progress(i + 1);
113  errors.addAll(extracter.getErrorMessages());
114  }
115 
116  // create the final message for inbox
117  StringBuilder errorMessage = new StringBuilder();
118  String errorMsgSubject;
119  MessageType msgLevel = MessageType.INFO;
120  if (errors.isEmpty() == false) {
121  msgLevel = MessageType.ERROR;
122  errorMessage.append(
123  NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.errMsg.errsEncountered"));
124  for (String msg : errors) {
125  errorMessage.append("<li>").append(msg).append("</li>\n"); //NON-NLS
126  }
127  errorMessage.append("</ul>\n"); //NON-NLS
128 
129  if (errors.size() == 1) {
130  errorMsgSubject = NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.errMsgSub.oneErr");
131  } else {
132  errorMsgSubject = NbBundle.getMessage(this.getClass(),
133  "RAImageIngestModule.process.errMsgSub.nErrs", errors.size());
134  }
135  } else {
136  errorMessage.append(NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.errMsg.noErrs"));
137  errorMsgSubject = NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.errMsgSub.noErrs");
138  }
140  NbBundle.getMessage(this.getClass(),
141  "RAImageIngestModule.process.ingestMsg.finished",
142  dataSource.getName(), errorMsgSubject),
143  errorMessage.toString());
144  services.postMessage(msg);
145 
146  StringBuilder historyMsg = new StringBuilder();
147  historyMsg.append(
148  NbBundle.getMessage(this.getClass(), "RAImageIngestModule.process.histMsg.title", dataSource.getName()));
149  for (Extract module : browserExtracters) {
150  historyMsg.append("<li>").append(module.getName()); //NON-NLS
151  historyMsg.append(": ").append((module.foundData()) ? NbBundle
152  .getMessage(this.getClass(), "RAImageIngestModule.process.histMsg.found") : NbBundle
153  .getMessage(this.getClass(), "RAImageIngestModule.process.histMsg.notFnd"));
154  historyMsg.append("</li>"); //NON-NLS
155  }
156  historyMsg.append("</ul>"); //NON-NLS
158  NbBundle.getMessage(this.getClass(),
159  "RAImageIngestModule.process.ingestMsg.results",
160  dataSource.getName()),
161  historyMsg.toString());
162  services.postMessage(inboxMsg);
163 
164  if (context.dataSourceIngestIsCancelled()) {
165  return ProcessResult.OK;
166  }
167 
168  for (int i = 0; i < extracters.size(); i++) {
169  Extract extracter = extracters.get(i);
170  try {
171  extracter.complete();
172  } catch (Exception ex) {
173  logger.log(Level.SEVERE, "Exception occurred when completing " + extracter.getName(), ex); //NON-NLS
174  subCompleted.append(NbBundle.getMessage(this.getClass(), "RAImageIngestModule.complete.errMsg.failed",
175  extracter.getName()));
176  }
177  }
178 
179  return ProcessResult.OK;
180  }
181 
192  protected static String getRATempPath(Case a_case, String mod) {
193  String tmpDir = a_case.getTempDirectory() + File.separator + "RecentActivity" + File.separator + mod; //NON-NLS
194  File dir = new File(tmpDir);
195  if (dir.exists() == false) {
196  dir.mkdirs();
197  }
198  return tmpDir;
199  }
200 
211  protected static String getRAOutputPath(Case a_case, String mod) {
212  String tmpDir = a_case.getModuleDirectory() + File.separator + "RecentActivity" + File.separator + mod; //NON-NLS
213  File dir = new File(tmpDir);
214  if (dir.exists() == false) {
215  dir.mkdirs();
216  }
217  return tmpDir;
218  }
219 }
static IngestMessage createMessage(MessageType messageType, String source, String subject, String detailsHtml)
ProcessResult process(Content dataSource, DataSourceIngestModuleProgress progressBar)
void postMessage(final IngestMessage message)
synchronized static Logger getLogger(String name)
Definition: Logger.java:161
static synchronized IngestServices getInstance()

Copyright © 2012-2016 Basis Technology. Generated on: Tue Oct 25 2016
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.