org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor Class Reference

Classes
interface	ParseExceptionFunction
class	TsvColumn

Public Member Functions
	LeappFileProcessor (String xmlFile, String moduleName, String leapModule, IngestJobContext context) throws IOException, IngestModuleException, NoCurrentCaseException
ProcessResult	processFiles (Content dataSource, Path moduleOutputPath, AbstractFile LeappFile, DataSourceIngestModuleProgress progress)
ProcessResult	processFileSystem (Content dataSource, Path moduleOutputPath, DataSourceIngestModuleProgress progress)

Private Member Functions
boolean	checkCancelled ()
void	configExtractor () throws IOException
BlackboardArtifact	createArtifactWithAttributes (BlackboardArtifact.Type artType, Content dataSource, Collection< BlackboardAttribute > bbattributes)
void	createCalllogRelationship (Collection< BlackboardAttribute > bbattributes, Content dataSource, String fileName) throws IngestModuleException
void	createContactRelationship (Collection< BlackboardAttribute > bbattributes, Content dataSource, String fileName) throws IngestModuleException
void	createCustomArtifacts (Blackboard blkBoard)
void	createCustomAttributesArtifacts (Blackboard blkBoard, String atType, String atName, String atDescription, String attrType)
void	createMessageRelationship (Collection< BlackboardAttribute > bbattributes, Content dataSource, String fileName) throws IngestModuleException
void	createRoute (Collection< BlackboardAttribute > bbattributes, Content dataSource, String fileName) throws IngestModuleException
AbstractFile	createTrackpoint (Collection< BlackboardAttribute > bbattributes, Content dataSource, String fileName, String trackpointSegmentName, GeoTrackPoints pointList) throws IngestModuleException
AbstractFile	findAbstractFile (Content dataSource, String fileNamePath)
List< String >	findTsvFiles (Path LeappOutputDir) throws IngestModuleException
String	formatValueBasedOnAttrType (TsvColumn colAttr, String value)
Account.Type	getAccountType (String AccountTypeName)
void	getArtifactNode (Document xmlinput)
BlackboardAttribute	getAttribute (BlackboardAttribute.Type attrType, String value, String fileName)
void	getAttributeNodes (Document xmlinput)
void	getFileNode (Document xmlinput)
String	getXmlAttrIdentifier (String fileName, String attributeName)
String	getXmlFileIdentifier (String fileName)
void	loadConfigFile () throws IngestModuleException
void	loadCustomArtifactsAttributes (Blackboard blkBoard, String leapModule)
void	loadIndividualConfigFile (String path) throws IngestModuleException
BlackboardAttribute	parseAttrValue (String value, BlackboardAttribute.Type attrType, String fileName, boolean blankIsNull, boolean zeroIsNull, ParseExceptionFunction valueConverter)
void	processFile (File LeappFile, List< TsvColumn > attrList, String fileName, BlackboardArtifact.Type artifactType, Content dataSource) throws FileNotFoundException, IOException, IngestModuleException, TskCoreException
void	processLeappFiles (List< String > LeappFilesToProcess, Content dataSource, DataSourceIngestModuleProgress progress) throws IngestModuleException
Collection< BlackboardAttribute >	processReadLine (List< String > lineValues, Map< String, Integer > columnIndexes, List< TsvColumn > attrList, String fileName, int lineNum) throws IngestModuleException

Static Private Member Functions
static String	normalizeKey (String origKey)

Private Attributes
final String	ARTIFACT_ATTRIBUTE_REFERENCE_USER = "artifact-attribute-reference-user.xml"
final Blackboard	blkBoard
final IngestJobContext	context
final String	CUSTOM_ARTIFACTS_ATTRIBUTES_FILE = "custom-artifact-attribute-list.csv"
final String	leapModule
final String	moduleName
final Map< String, String >	tsvFileArtifactComments
final Map< String, BlackboardArtifact.Type >	tsvFileArtifacts
final Map< String, List< TsvColumn > >	tsvFileAttributes
final Map< String, String >	tsvFiles
final String	xmlFile

Static Private Attributes
static final Map< String, String >	ACCOUNT_RELATIONSHIPS
static final Set< String >	ALLOWED_EXTENSIONS = new HashSet<>(Arrays.asList("zip", "tar", "tgz"))
static final Map< String, String >	CUSTOM_ARTIFACT_MAP
static final Logger	logger = Logger.getLogger(LeappFileProcessor.class.getName())
static final DateFormat	TIMESTAMP_FORMAT = new SimpleDateFormat("yyyy-MM-d HH:mm:ss", US)

Detailed Description

Find and process output from Leapp program and bring into Autopsy

Definition at line 99 of file LeappFileProcessor.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.LeappFileProcessor	(	String	xmlFile,
		String	moduleName,
		String	leapModule,
		IngestJobContext	context
	)		throws IOException, IngestModuleException, NoCurrentCaseException

Definition at line 205 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.configExtractor(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.context, org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.createCustomArtifacts(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.leapModule, org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.loadConfigFile(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.loadCustomArtifactsAttributes(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.moduleName, org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.tsvFileArtifacts, and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.xmlFile.

Member Function Documentation

boolean org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.checkCancelled ( )

private

Definition at line 307 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.ingest.IngestJobContext.dataSourceIngestIsCancelled().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFiles(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFileSystem(), and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processLeappFiles().

void org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.configExtractor ( ) throws IOException

private

Extract the Leapp config xml file to the user directory to process

Exceptions

org.sleuthkit.autopsy.ingest.IngestModule.IngestModuleException

Definition at line 1299 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.coreutils.PlatformUtil.extractResourceToUserConfigDir().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.LeappFileProcessor().

BlackboardArtifact org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.createArtifactWithAttributes ( BlackboardArtifact.Type  artType, Content  dataSource, Collection< BlackboardAttribute >  bbattributes  )

private

Generic method for creating a blackboard artifact with attributes

Parameters

artType	The artifact type.
dataSource	is the Content object that needs to have the artifact added for it
bbattributes	is the collection of blackboard attributes that need to be added to the artifact after the artifact has been created

Returns

The newly-created artifact, or null on error

Definition at line 1259 of file LeappFileProcessor.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFile().

void org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.createCalllogRelationship ( Collection< BlackboardAttribute >  bbattributes, Content  dataSource, String  fileName  ) throws IngestModuleException

private

Definition at line 750 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.findAbstractFile(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getAccountType(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.ingest.IngestJobContext.getJobId(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.moduleName.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFile().

void org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.createContactRelationship ( Collection< BlackboardAttribute >  bbattributes, Content  dataSource, String  fileName  ) throws IngestModuleException

private

Definition at line 680 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.findAbstractFile(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getAccountType(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.ingest.IngestJobContext.getJobId(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.moduleName.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFile().

void org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.createCustomArtifacts ( Blackboard  blkBoard )

private

Create custom artifacts that are defined in the xLeapp xml file(s).

Definition at line 1449 of file LeappFileProcessor.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.LeappFileProcessor().

void org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.createCustomAttributesArtifacts ( Blackboard  blkBoard, String  atType, String  atName, String  atDescription, String  attrType  )

private

Create custom attributes that are defined in the xLeapp xml file(s).

Definition at line 1383 of file LeappFileProcessor.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.loadCustomArtifactsAttributes().

void org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.createMessageRelationship ( Collection< BlackboardAttribute >  bbattributes, Content  dataSource, String  fileName  ) throws IngestModuleException

private

Definition at line 577 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.findAbstractFile(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getAccountType(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.ingest.IngestJobContext.getJobId(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.moduleName.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFile().

void org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.createRoute ( Collection< BlackboardAttribute >  bbattributes, Content  dataSource, String  fileName  ) throws IngestModuleException

private

Definition at line 444 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.findAbstractFile(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.ingest.IngestJobContext.getJobId(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.moduleName.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFile().

AbstractFile org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.createTrackpoint ( Collection< BlackboardAttribute >  bbattributes, Content  dataSource, String  fileName, String  trackpointSegmentName, GeoTrackPoints  pointList  ) throws IngestModuleException

private

Definition at line 512 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.findAbstractFile(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.ingest.IngestJobContext.getJobId(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.moduleName.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFile().

AbstractFile org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.findAbstractFile ( Content  dataSource, String  fileNamePath  )

private

Definition at line 1464 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.casemodule.services.FileManager.findFiles(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCase(), org.sleuthkit.autopsy.casemodule.services.Services.getFileManager(), and org.sleuthkit.autopsy.casemodule.Case.getServices().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.createCalllogRelationship(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.createContactRelationship(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.createMessageRelationship(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.createRoute(), and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.createTrackpoint().

List<String> org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.findTsvFiles ( Path  LeappOutputDir ) throws IngestModuleException

private

Find the tsv files in the Leapp output directory and match them to files we know we want to process and return the list to process those files.

Definition at line 284 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.normalizeKey().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFiles(), and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFileSystem().

String org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.formatValueBasedOnAttrType ( TsvColumn  colAttr, String  value  )

private

Check type of attribute and possibly format string based on it.

Parameters

colAttr	Column Attribute information
value	string to be formatted

Returns

formatted string based on attribute type if no attribute type found then return original string

Definition at line 976 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.coreutils.NetworkUtils.extractDomain().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processReadLine().

Account.Type org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getAccountType ( String  AccountTypeName )

private

Definition at line 827 of file LeappFileProcessor.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.createCalllogRelationship(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.createContactRelationship(), and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.createMessageRelationship().

void org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getArtifactNode ( Document  xmlinput )

private

Definition at line 1147 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.casemodule.Case.getCurrentCase(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getXmlFileIdentifier(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.normalizeKey(), and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.tsvFileArtifacts.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.loadIndividualConfigFile().

BlackboardAttribute org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getAttribute ( BlackboardAttribute.Type  attrType, String  value, String  fileName  )

private

Gets an appropriate attribute based on the attribute type and string value.

Parameters

attrType	The attribute type.
value	The string value to be converted to the appropriate data type for the attribute type.
fileName	The file name that the value comes from.

Returns

The generated blackboard attribute.

Definition at line 1000 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.parseAttrValue().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processReadLine().

void org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getAttributeNodes ( Document  xmlinput )

private

Definition at line 1189 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.casemodule.Case.getCurrentCase(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getXmlAttrIdentifier(), and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.normalizeKey().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.loadIndividualConfigFile().

void org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getFileNode ( Document  xmlinput )

private

Definition at line 1135 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.normalizeKey().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.loadIndividualConfigFile().

String org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getXmlAttrIdentifier ( String  fileName, String  attributeName  )

private

Definition at line 1183 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getXmlFileIdentifier().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getAttributeNodes().

String org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getXmlFileIdentifier ( String  fileName )

private

Definition at line 1177 of file LeappFileProcessor.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getArtifactNode(), and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getXmlAttrIdentifier().

void org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.loadConfigFile ( ) throws IngestModuleException

private

Read the XML config file and load the mappings into maps

Definition at line 1094 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.ARTIFACT_ATTRIBUTE_REFERENCE_USER, org.sleuthkit.autopsy.coreutils.PlatformUtil.getUserConfigDirectory(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.loadIndividualConfigFile(), and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.xmlFile.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.LeappFileProcessor().

void org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.loadCustomArtifactsAttributes ( Blackboard  blkBoard, String  leapModule  )

private

Create custom artifacts that are defined in the xLeapp xml file(s).

Definition at line 1344 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.createCustomAttributesArtifacts(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.CUSTOM_ARTIFACTS_ATTRIBUTES_FILE, and org.sleuthkit.autopsy.coreutils.PlatformUtil.getUserConfigDirectory().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.LeappFileProcessor().

void org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.loadIndividualConfigFile ( String  path ) throws IngestModuleException

private

Read the XML config file and load the mappings into maps

Definition at line 1113 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getArtifactNode(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getAttributeNodes(), and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getFileNode().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.loadConfigFile().

static String org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.normalizeKey ( String  origKey )

staticprivate

Generates a key trimmed and case-insensitive that can be used for a case-insensitive lookup in a map.

Parameters

origKey

The original key.

Returns

The normalized key.

Definition at line 231 of file LeappFileProcessor.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.findTsvFiles(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getArtifactNode(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getAttributeNodes(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getFileNode(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processLeappFiles(), and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processReadLine().

BlackboardAttribute org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.parseAttrValue ( String  value, BlackboardAttribute.Type  attrType, String  fileName, boolean  blankIsNull, boolean  zeroIsNull, ParseExceptionFunction  valueConverter  )

private

Runs parsing function on string value to convert to right data type and generates a blackboard attribute for that converted data type.

Parameters

value	The string value.
attrType	The blackboard attribute type.
fileName	The name of the file from which the value comes.
blankIsNull	If string is blank return null attribute.
zeroIsNull	If string is some version of 0, return null attribute.
valueConverter	The means of converting the string value to an appropriate blackboard attribute.

Returns

The generated blackboard attribute or null if not determined.

Definition at line 1070 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.ParseExceptionFunction.apply().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getAttribute().

void org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFile ( File  LeappFile, List< TsvColumn >  attrList, String  fileName, BlackboardArtifact.Type  artifactType, Content  dataSource  ) throws FileNotFoundException, IOException, IngestModuleException, TskCoreException

private

Definition at line 358 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.createArtifactWithAttributes(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.createCalllogRelationship(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.createContactRelationship(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.createMessageRelationship(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.createRoute(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.createTrackpoint(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.ingest.IngestJobContext.getJobId(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.moduleName, and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processReadLine().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processLeappFiles().

ProcessResult org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFiles	(	Content	dataSource,
		Path	moduleOutputPath,
		AbstractFile	LeappFile,
		DataSourceIngestModuleProgress	progress
	)

Definition at line 246 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.checkCancelled(), org.sleuthkit.autopsy.ingest.IngestModule.ProcessResult.ERROR, org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.findTsvFiles(), org.sleuthkit.autopsy.ingest.IngestModule.ProcessResult.OK, org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processLeappFiles(), org.sleuthkit.autopsy.ingest.DataSourceIngestModuleProgress.progress(), and org.sleuthkit.autopsy.ingest.DataSourceIngestModuleProgress.switchToIndeterminate().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.processALeappFile(), and org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.processILeappFile().

ProcessResult org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFileSystem	(	Content	dataSource,
		Path	moduleOutputPath,
		DataSourceIngestModuleProgress	progress
	)

Definition at line 263 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.checkCancelled(), org.sleuthkit.autopsy.ingest.IngestModule.ProcessResult.ERROR, org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.findTsvFiles(), org.sleuthkit.autopsy.ingest.IngestModule.ProcessResult.OK, org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processLeappFiles(), org.sleuthkit.autopsy.ingest.DataSourceIngestModuleProgress.progress(), and org.sleuthkit.autopsy.ingest.DataSourceIngestModuleProgress.switchToIndeterminate().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.processALeappFs(), and org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.processILeappFs().

void org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processLeappFiles ( List< String >  LeappFilesToProcess, Content  dataSource, DataSourceIngestModuleProgress  progress  ) throws IngestModuleException

private

Process the Leapp files that were found that match the xml mapping file

Parameters

LeappFilesToProcess	List of files to process.
dataSource	The data source.
progress	Means of updating progress in UI.

Exceptions

FileNotFoundException
IOException

Definition at line 330 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.checkCancelled(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.normalizeKey(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFile(), org.sleuthkit.autopsy.ingest.DataSourceIngestModuleProgress.progress(), org.sleuthkit.autopsy.ingest.DataSourceIngestModuleProgress.switchToDeterminate(), and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.tsvFileArtifacts.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFiles(), and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFileSystem().

Collection<BlackboardAttribute> org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processReadLine ( List< String >  lineValues, Map< String, Integer >  columnIndexes, List< TsvColumn >  attrList, String  fileName, int  lineNum  ) throws IngestModuleException

private

Process the line read and create the necessary attributes for it.

Parameters

lineValues	List of column values.
columnIndexes	Mapping of column headers (trimmed; to lower case) to column index. All header columns and only all header columns should be present.
attrList	The list of attributes as specified for the schema of this file.
fileName	The name of the file being processed.
lineNum	The line number in the file.

Returns

The collection of blackboard attributes for the artifact created from this line.

Exceptions

IngestModuleException

Definition at line 913 of file LeappFileProcessor.java.

References org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.formatValueBasedOnAttrType(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getAttribute(), and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.normalizeKey().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFile().

Member Data Documentation

final Map<String, String> org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.ACCOUNT_RELATIONSHIPS

staticprivate

Definition at line 165 of file LeappFileProcessor.java.

final Set<String> org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.ALLOWED_EXTENSIONS = new HashSet<>(Arrays.asList("zip", "tar", "tgz"))

staticprivate

Definition at line 1304 of file LeappFileProcessor.java.

final String org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.ARTIFACT_ATTRIBUTE_REFERENCE_USER = "artifact-attribute-reference-user.xml"

private

Definition at line 149 of file LeappFileProcessor.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.loadConfigFile().

final Blackboard org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.blkBoard

private

Definition at line 203 of file LeappFileProcessor.java.

final IngestJobContext org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.context

private

Definition at line 154 of file LeappFileProcessor.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.LeappFileProcessor().

final Map<String, String> org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.CUSTOM_ARTIFACT_MAP

staticprivate

Initial value:

= ImmutableMap.<String, String>builder()
            .put("TSK_IP_DHCP", "DHCP Information")
            .build()

Definition at line 161 of file LeappFileProcessor.java.

final String org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.CUSTOM_ARTIFACTS_ATTRIBUTES_FILE = "custom-artifact-attribute-list.csv"

private

Definition at line 148 of file LeappFileProcessor.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.loadCustomArtifactsAttributes().

final String org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.leapModule

private

Definition at line 152 of file LeappFileProcessor.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.LeappFileProcessor().

final Logger org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.logger = Logger.getLogger(LeappFileProcessor.class.getName())

staticprivate

Definition at line 147 of file LeappFileProcessor.java.

final String org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.moduleName

private

Definition at line 153 of file LeappFileProcessor.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.createCalllogRelationship(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.createContactRelationship(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.createMessageRelationship(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.createRoute(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.createTrackpoint(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.LeappFileProcessor(), and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processFile().

final DateFormat org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.TIMESTAMP_FORMAT = new SimpleDateFormat("yyyy-MM-d HH:mm:ss", US)

staticprivate

The format of time stamps in tsv.

Definition at line 987 of file LeappFileProcessor.java.

final Map<String, String> org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.tsvFileArtifactComments

private

Definition at line 158 of file LeappFileProcessor.java.

final Map<String, BlackboardArtifact.Type> org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.tsvFileArtifacts

private

Definition at line 157 of file LeappFileProcessor.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.getArtifactNode(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.LeappFileProcessor(), and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.processLeappFiles().

final Map<String, List<TsvColumn> > org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.tsvFileAttributes

private

Definition at line 159 of file LeappFileProcessor.java.

final Map<String, String> org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.tsvFiles

private

Definition at line 156 of file LeappFileProcessor.java.

final String org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.xmlFile

private

Definition at line 151 of file LeappFileProcessor.java.

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.LeappFileProcessor(), and org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.loadConfigFile().

---

The documentation for this class was generated from the following file:

• /home/carriersleuth/repos/autopsy/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/LeappFileProcessor.java