Autopsy
4.10.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
|
Inherits org.sleuthkit.autopsy.report.GeneralReportModule.
Classes | |
class | StoreMaxIdCallback |
Public Member Functions | |
CreatePortableCaseModule () | |
void | generateReport (String reportPath, ReportProgressPanel progressPanel) |
JPanel | getConfigurationPanel () |
String | getDescription () |
String | getName () |
String | getRelativeFilePath () |
Private Member Functions | |
void | addArtifactsToPortableCase (TagName oldTagName, ReportProgressPanel progressPanel) throws TskCoreException |
void | addFilesToPortableCase (TagName oldTagName, ReportProgressPanel progressPanel) throws TskCoreException |
void | cleanup () |
BlackboardArtifact | copyArtifact (long newContentId, BlackboardArtifact artifactToCopy) throws TskCoreException |
long | copyContent (Content content, CaseDbTransaction trans) throws TskCoreException |
long | copyContentToPortableCase (Content content, ReportProgressPanel progressPanel) throws TskCoreException |
void | createCase (File outputDir, ReportProgressPanel progressPanel) |
String | getExportSubfolder (AbstractFile abstractFile) |
int | getNewArtifactTypeId (BlackboardArtifact oldArtifact) throws TskCoreException |
BlackboardAttribute.Type | getNewAttributeType (BlackboardAttribute oldAttribute) throws TskCoreException |
void | handleError (String logWarning, String dialogWarning, Exception ex, ReportProgressPanel progressPanel) |
void | saveHighestIds () throws TskCoreException |
Private Attributes | |
File | caseFolder = null |
CreatePortableCasePanel | configPanel |
File | copiedFilesFolder = null |
Case | currentCase = null |
final Map< Long, Content > | newIdToContent = new HashMap<>() |
final Map< Long, BlackboardArtifact > | oldArtifactIdToNewArtifact = new HashMap<>() |
final Map< Integer, Integer > | oldArtTypeIdToNewArtTypeId = new HashMap<>() |
final Map< Integer, BlackboardAttribute.Type > | oldAttrTypeIdToNewAttrType = new HashMap<>() |
final Map< Long, Content > | oldIdToNewContent = new HashMap<>() |
final Map< TagName, TagName > | oldTagNameToNewTagName = new HashMap<>() |
SleuthkitCase | portableSkCase = null |
Static Private Attributes | |
static final String | FILE_FOLDER_NAME = "PortableCaseFiles" |
static final List< FileTypeCategory > | FILE_TYPE_CATEGORIES |
static final Logger | logger = Logger.getLogger(CreatePortableCaseModule.class.getName()) |
static final String | MAX_ID_TABLE_NAME = "portable_case_max_ids" |
static final String | UNKNOWN_FILE_TYPE_FOLDER = "Other" |
Creates a portable case from tagged files
Definition at line 65 of file CreatePortableCaseModule.java.
org.sleuthkit.autopsy.report.CreatePortableCaseModule.CreatePortableCaseModule | ( | ) |
Definition at line 99 of file CreatePortableCaseModule.java.
|
private |
Add all artifacts with a given tag to the portable case.
oldTagName | The TagName object from the current case |
progressPanel | The progress panel |
TskCoreException |
Definition at line 417 of file CreatePortableCaseModule.java.
References org.sleuthkit.autopsy.report.ReportProgressPanel.ReportStatus.CANCELED, org.sleuthkit.autopsy.casemodule.services.TagsManager.getBlackboardArtifactTagsByTagName(), org.sleuthkit.autopsy.casemodule.Case.getServices(), org.sleuthkit.autopsy.report.ReportProgressPanel.getStatus(), and org.sleuthkit.autopsy.casemodule.services.Services.getTagsManager().
|
private |
Add all files with a given tag to the portable case.
oldTagName | The TagName object from the current case |
progressPanel | The progress panel |
TskCoreException |
Definition at line 383 of file CreatePortableCaseModule.java.
References org.sleuthkit.autopsy.report.ReportProgressPanel.ReportStatus.CANCELED, org.sleuthkit.autopsy.casemodule.services.TagsManager.getContentTagsByTagName(), org.sleuthkit.autopsy.casemodule.Case.getServices(), org.sleuthkit.autopsy.report.ReportProgressPanel.getStatus(), and org.sleuthkit.autopsy.casemodule.services.Services.getTagsManager().
|
private |
Clear out the maps and other fields and close the database connections.
Definition at line 707 of file CreatePortableCaseModule.java.
References org.sleuthkit.autopsy.casemodule.Case.close().
|
private |
Copy an artifact into the new case. Will also copy any associated artifacts
newContentId | The content ID (in the portable case) of the source content |
artifactToCopy | The artifact to copy |
TskCoreException |
Definition at line 454 of file CreatePortableCaseModule.java.
References org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().
|
private |
Returns the object ID for the given content object in the portable case.
content | The content object to copy into the portable case |
trans | The current transaction |
TskCoreException |
Definition at line 603 of file CreatePortableCaseModule.java.
References org.sleuthkit.autopsy.coreutils.FileUtil.escapeFileName(), and org.sleuthkit.autopsy.datamodel.ContentUtils.writeToFile().
|
private |
Top level method to copy a content object to the portable case.
content | The content object to copy |
progressPanel | The progress panel |
TskCoreException |
Definition at line 578 of file CreatePortableCaseModule.java.
References org.sleuthkit.autopsy.report.ReportProgressPanel.updateStatusLabel().
|
private |
Create the case directory and case database. portableSkCase will be set if this completes without error.
outputDir | The parent for the case folder |
progressPanel |
Definition at line 299 of file CreatePortableCaseModule.java.
References org.sleuthkit.autopsy.casemodule.Case.createPortableCase(), and org.sleuthkit.autopsy.casemodule.Case.getDisplayName().
void org.sleuthkit.autopsy.report.CreatePortableCaseModule.generateReport | ( | String | baseReportDir, |
ReportProgressPanel | progressPanel | ||
) |
Called to generate the report. Method is responsible for saving the file at the path specified and updating progress via the progressPanel object.
baseReportDir | Base directory that reports are being stored in. Report should go into baseReportDir + getRelativeFilePath(). |
progressPanel | panel to update the report's progress with |
Implements org.sleuthkit.autopsy.report.GeneralReportModule.
Definition at line 167 of file CreatePortableCaseModule.java.
References org.sleuthkit.autopsy.report.ReportProgressPanel.ReportStatus.CANCELED, org.sleuthkit.autopsy.report.ReportProgressPanel.ReportStatus.COMPLETE, org.sleuthkit.autopsy.report.ReportProgressPanel.complete(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.report.ReportProgressPanel.getStatus(), org.sleuthkit.autopsy.report.ReportProgressPanel.setIndeterminate(), org.sleuthkit.autopsy.report.ReportProgressPanel.start(), and org.sleuthkit.autopsy.report.ReportProgressPanel.updateStatusLabel().
JPanel org.sleuthkit.autopsy.report.CreatePortableCaseModule.getConfigurationPanel | ( | ) |
Definition at line 725 of file CreatePortableCaseModule.java.
String org.sleuthkit.autopsy.report.CreatePortableCaseModule.getDescription | ( | ) |
Definition at line 115 of file CreatePortableCaseModule.java.
|
private |
Return the subfolder name for this file based on MIME type
abstractFile | the file |
Definition at line 691 of file CreatePortableCaseModule.java.
String org.sleuthkit.autopsy.report.CreatePortableCaseModule.getName | ( | ) |
Definition at line 107 of file CreatePortableCaseModule.java.
|
private |
Get the artifact type ID in the portable case and create new artifact type if needed. For built-in artifacts this will be the same as the original.
oldArtifactTypeId | The artifact type ID in the current case |
Definition at line 525 of file CreatePortableCaseModule.java.
References org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().
|
private |
Get the attribute type ID in the portable case and create new attribute type if needed. For built-in attributes this will be the same as the original.
oldAttributeTypeId | The attribute type ID in the current case |
Definition at line 548 of file CreatePortableCaseModule.java.
String org.sleuthkit.autopsy.report.CreatePortableCaseModule.getRelativeFilePath | ( | ) |
Definition at line 120 of file CreatePortableCaseModule.java.
|
private |
Convenience method to avoid code duplication. Assumes that if an exception is supplied then the error is SEVERE. Otherwise it is logged as a WARNING.
logWarning | Warning to write to the log |
dialogWarning | Warning to write to a pop-up window |
ex | The exception (can be null) |
progressPanel | The report progress panel |
Definition at line 134 of file CreatePortableCaseModule.java.
References org.sleuthkit.autopsy.report.ReportProgressPanel.complete(), org.sleuthkit.autopsy.report.ReportProgressPanel.ReportStatus.ERROR, org.sleuthkit.autopsy.coreutils.MessageNotifyUtil.Message.error(), and org.sleuthkit.autopsy.report.ReportProgressPanel.setIndeterminate().
|
private |
Save the current highest IDs to the portable case.
TskCoreException |
Definition at line 360 of file CreatePortableCaseModule.java.
References org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().
|
private |
Definition at line 78 of file CreatePortableCaseModule.java.
|
private |
Definition at line 70 of file CreatePortableCaseModule.java.
|
private |
Definition at line 79 of file CreatePortableCaseModule.java.
|
private |
Definition at line 76 of file CreatePortableCaseModule.java.
|
staticprivate |
Definition at line 67 of file CreatePortableCaseModule.java.
|
staticprivate |
Definition at line 73 of file CreatePortableCaseModule.java.
|
staticprivate |
Definition at line 66 of file CreatePortableCaseModule.java.
|
staticprivate |
Definition at line 69 of file CreatePortableCaseModule.java.
|
private |
Definition at line 85 of file CreatePortableCaseModule.java.
|
private |
Definition at line 97 of file CreatePortableCaseModule.java.
|
private |
Definition at line 91 of file CreatePortableCaseModule.java.
|
private |
Definition at line 94 of file CreatePortableCaseModule.java.
|
private |
Definition at line 82 of file CreatePortableCaseModule.java.
|
private |
Definition at line 88 of file CreatePortableCaseModule.java.
|
private |
Definition at line 77 of file CreatePortableCaseModule.java.
|
staticprivate |
Definition at line 68 of file CreatePortableCaseModule.java.
Copyright © 2012-2018 Basis Technology. Generated on: Fri Mar 22 2019
This work is licensed under a
Creative Commons Attribution-Share Alike 3.0 United States License.