Inherits org.sleuthkit.autopsy.ingest.DataSourceIngestModule.

Public Member Functions
ProcessResult	process (Content dataSource, DataSourceIngestModuleProgress statusHelper)

default void	shutDown ()

void	startUp (IngestJobContext context) throws IngestModuleException

Private Member Functions
void	addALeappReportToReports (Path aLeappOutputDir, Case currentCase)

ProcessBuilder	buildaLeappCommand (Path moduleOutputPath, String sourceFilePath, String aLeappFileSystemType)

ProcessBuilder	buildaLeappListCommand (Path moduleOutputPath)

void	extractFilesFromDataSource (Content dataSource, List< String > aLeappPathsToProcess, Path moduleOutputPath)

void	extractFileToOutput (Content dataSource, AbstractFile aLeappFile, File fileParentPath, Path parentPath)

List< String >	loadAleappPathFile (Path moduleOutputPath) throws FileNotFoundException, IOException

void	processALeappFile (Content dataSource, Case currentCase, DataSourceIngestModuleProgress statusHelper, int filesProcessedCount, AbstractFile aLeappFile)

void	processALeappFs (Content dataSource, Case currentCase, DataSourceIngestModuleProgress statusHelper, String directoryToProcess)

void	writeaLeappFile (Content dataSource, AbstractFile aLeappFile, String parentPath)

void	writeErrorMsgToIngestInbox ()

Static Private Member Functions
static ProcessBuilder	buildProcessWithRunAsInvoker (String...commandLine)

static File	locateExecutable (String executableName) throws FileNotFoundException

Private Attributes
File	aLeappExecutable

LeappFileProcessor	aLeappFileProcessor

IngestJobContext	context

Static Private Attributes
static final String	ALEAPP = "aLeapp"

static final String	ALEAPP_EXECUTABLE = "aleapp.exe"

static final String	ALEAPP_FS = "fs_"

static final String	ALEAPP_PATHS_FILE = "aLeapp_paths.txt"

static final Logger	logger = Logger.getLogger(ALeappAnalyzerIngestModule.class.getName())

static final String	MODULE_NAME = ALeappAnalyzerModuleFactory.getModuleName()

static final String	XMLFILE = "aleapp-artifact-attribute-reference.xml"

Detailed Description

Data source ingest module that runs aLeapp against logical iOS files.

Definition at line 64 of file ALeappAnalyzerIngestModule.java.

Member Function Documentation

void org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.addALeappReportToReports	(	Path	aLeappOutputDir,
		Case	currentCase
	)

private

Find the index.html file in the aLeapp output directory so it can be added to reports

Definition at line 338 of file ALeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.casemodule.Case.addReport(), and org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.MODULE_NAME.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.processALeappFile(), and org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.processALeappFs().

ProcessBuilder org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.buildaLeappCommand	(	Path	moduleOutputPath,
		String	sourceFilePath,
		String	aLeappFileSystemType
	)

private

Build the aLeapp command to run

Parameters

moduleOutputPath	output path for the aLeapp program.
sourceFilePath	where the source files to process reside.
aLeappFileSystemType	the filesystem type to process

Returns: the command to execute

Definition at line 289 of file ALeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.buildProcessWithRunAsInvoker().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.processALeappFile(), and org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.processALeappFs().

ProcessBuilder org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.buildaLeappListCommand ( Path moduleOutputPath )

private

Definition at line 303 of file ALeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.buildProcessWithRunAsInvoker().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.process().

static ProcessBuilder org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.buildProcessWithRunAsInvoker ( String... commandLine )

staticprivate

Definition at line 314 of file ALeappAnalyzerIngestModule.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.buildaLeappCommand(), and org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.buildaLeappListCommand().

void org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.extractFilesFromDataSource	(	Content	dataSource,
		List< String >	aLeappPathsToProcess,
		Path	moduleOutputPath
	)

private

Definition at line 386 of file ALeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.ingest.IngestJobContext.dataSourceIngestIsCancelled(), org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.extractFileToOutput(), and org.sleuthkit.autopsy.casemodule.services.FileManager.findFiles().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.process().

void org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.extractFileToOutput	(	Content	dataSource,
		AbstractFile	aLeappFile,
		File	fileParentPath,
		Path	parentPath
	)

private

Definition at line 422 of file ALeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.writeaLeappFile().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.extractFilesFromDataSource().

List<String> org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.loadAleappPathFile ( Path moduleOutputPath ) throws FileNotFoundException, IOException

private

Definition at line 366 of file ALeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.ALEAPP_PATHS_FILE.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.process().

static File org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.locateExecutable ( String executableName ) throws FileNotFoundException

staticprivate

Definition at line 324 of file ALeappAnalyzerIngestModule.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.startUp().

ProcessResult org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.process	(	Content	dataSource,
		DataSourceIngestModuleProgress	progressBar
	)

Processes a data source. Called once between calls to startUp() and shutDown().

IMPORTANT: In addition to returning ProcessResult.OK or ProcessResult.ERROR, modules should log all errors using methods provided by the org.sleuthkit.autopsy.coreutils.Logger class. Log messages should include the name and object ID of the data being processed. If an exception has been caught by the module, the exception should be sent to the Logger along with the log message so that a stack trace will appear in the application log.

Parameters

dataSource	The data source to process.
progressBar	A progress bar to be used to report progress.

Returns: A result code indicating success or failure of the processing.

Implements org.sleuthkit.autopsy.ingest.DataSourceIngestModule.

Definition at line 127 of file ALeappAnalyzerIngestModule.java.

void org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.processALeappFile	(	Content	dataSource,
		Case	currentCase,
		DataSourceIngestModuleProgress	statusHelper,
		int	filesProcessedCount,
		AbstractFile	aLeappFile
	)

private

Process a file from a logical image using the aLeapp program

Parameters

dataSource	datasource to process
currentCase	current case that is being worked on
statusHelper	show progress and update what is being processed
filesProcessedCount	number of files that have been processed
aLeappFile	the abstract file to process

Definition at line 202 of file ALeappAnalyzerIngestModule.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.process().

void org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.processALeappFs	(	Content	dataSource,
		Case	currentCase,
		DataSourceIngestModuleProgress	statusHelper,
		String	directoryToProcess
	)

private

Process a image/directory using the aLeapp program

Parameters

dataSource	datasource to process
currentCase	current case being procesed
statusHelper	show progress and update what is being processed
directoryToProcess	directory to run aLeapp against

Definition at line 246 of file ALeappAnalyzerIngestModule.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.process().

default void org.sleuthkit.autopsy.ingest.IngestModule.shutDown ( )

inherited

Invoked by Autopsy when an ingest job is completed (either because the data has been analyzed or because the job was cancelled), before the ingest module instance is discarded. The module should respond by doing things like releasing private resources, submitting final results, and posting a final ingest message.

IMPORTANT: If the module instances must share resources, the modules are responsible for synchronizing access to the shared resources and doing reference counting as required to release those resources correctly. Also, more than one ingest job may be in progress at any given time. This must also be taken into consideration when sharing resources between module instances. See IngestModuleReferenceCounter.

Implemented in org.sleuthkit.autopsy.thunderbirdparser.ThunderbirdMboxFileIngestModule, org.sleuthkit.autopsy.modules.hashdatabase.HashDbIngestModule, org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule, org.sleuthkit.autopsy.centralrepository.ingestmodule.CentralRepoDataArtifactIngestModule, org.sleuthkit.autopsy.modules.filetypeid.FileTypeIdIngestModule, org.sleuthkit.autopsy.modules.fileextmismatch.FileExtMismatchIngestModule, org.sleuthkit.autopsy.modules.embeddedfileextractor.EmbeddedFileExtractorIngestModule, org.sleuthkit.autopsy.recentactivity.RAImageIngestModule, and org.sleuthkit.autopsy.modules.yara.YaraIngestModule.

Definition at line 91 of file IngestModule.java.

void org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.startUp ( IngestJobContext context ) throws IngestModuleException

Invoked by Autopsy to allow an ingest module instance to set up any internal data structures and acquire any private resources it will need during an ingest job. If the module depends on loading any resources, it should do so in this method so that it can throw an exception in the case of an error and alert the user. Exceptions that are thrown from startUp() are logged and stop processing of the data source.

IMPORTANT: If the module instances must share resources, the modules are responsible for synchronizing access to the shared resources and doing reference counting as required to release those resources correctly. Also, more than one ingest job may be in progress at any given time. This must also be taken into consideration when sharing resources between module instances. See IngestModuleReferenceCounter.

IMPORTANT: Start up IngestModuleException messages are displayed to the user, if a user is present. Therefore, an exception to the policy that exception messages are not localized is appropriate in this method. Also, the exception messages should be user-friendly.

Parameters

context Provides data and services specific to the ingest job and the ingest pipeline of which the module is a part.

Exceptions

org.sleuthkit.autopsy.ingest.IngestModule.IngestModuleException

Implements org.sleuthkit.autopsy.ingest.IngestModule.

Definition at line 91 of file ALeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.ALEAPP, org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.context, org.sleuthkit.autopsy.coreutils.PlatformUtil.is64BitOS(), org.sleuthkit.autopsy.coreutils.PlatformUtil.isWindowsOS(), and org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.locateExecutable().

void org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.writeaLeappFile	(	Content	dataSource,
		AbstractFile	aLeappFile,
		String	parentPath
	)

private

Definition at line 451 of file ALeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.datamodel.ContentUtils.writeToFile().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.extractFileToOutput().

void org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.writeErrorMsgToIngestInbox ( )

private

Writes a generic error message to the ingest inbox, directing the user to consult the application log fpor more details.

Definition at line 472 of file ALeappAnalyzerIngestModule.java.

References org.sleuthkit.autopsy.ingest.IngestMessage.createMessage(), org.sleuthkit.autopsy.ingest.IngestMessage.MessageType.ERROR, org.sleuthkit.autopsy.ingest.IngestServices.getInstance(), and org.sleuthkit.autopsy.ingest.IngestServices.postMessage().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.process().

Member Data Documentation

final String org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.ALEAPP = "aLeapp"

staticprivate

Definition at line 69 of file ALeappAnalyzerIngestModule.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.process(), org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.processALeappFile(), org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.processALeappFs(), and org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.startUp().

final String org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.ALEAPP_EXECUTABLE = "aleapp.exe"

staticprivate

Definition at line 71 of file ALeappAnalyzerIngestModule.java.

final String org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.ALEAPP_FS = "fs_"

staticprivate

Definition at line 70 of file ALeappAnalyzerIngestModule.java.

final String org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.ALEAPP_PATHS_FILE = "aLeapp_paths.txt"

staticprivate

Definition at line 72 of file ALeappAnalyzerIngestModule.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.loadAleappPathFile().

File org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.aLeappExecutable

private

Definition at line 76 of file ALeappAnalyzerIngestModule.java.

LeappFileProcessor org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.aLeappFileProcessor

private

Definition at line 80 of file ALeappAnalyzerIngestModule.java.

IngestJobContext org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.context

private

Definition at line 78 of file ALeappAnalyzerIngestModule.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.startUp().

final Logger org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.logger = Logger.getLogger(ALeappAnalyzerIngestModule.class.getName())

staticprivate

Definition at line 66 of file ALeappAnalyzerIngestModule.java.

final String org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.MODULE_NAME = ALeappAnalyzerModuleFactory.getModuleName()

staticprivate

Definition at line 67 of file ALeappAnalyzerIngestModule.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.addALeappReportToReports().

final String org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.XMLFILE = "aleapp-artifact-attribute-reference.xml"

staticprivate

Definition at line 74 of file ALeappAnalyzerIngestModule.java.

The documentation for this class was generated from the following file: