Autopsy  4.19.3
Graphical digital forensics platform for The Sleuth Kit and other tools.
Public Member Functions | List of all members
org.sleuthkit.autopsy.ingest.IngestModuleFactory Interface Reference

Inherited by org.sleuthkit.autopsy.examples.SampleIngestModuleFactory, org.sleuthkit.autopsy.ingest.IngestModuleFactoryAdapter, org.sleuthkit.autopsy.keywordsearch.KeywordSearchModuleFactory, org.sleuthkit.autopsy.modules.encryptiondetection.EncryptionDetectionModuleFactory, and org.sleuthkit.autopsy.modules.plaso.PlasoModuleFactory.

Public Member Functions

default AnalysisResultIngestModule createAnalysisResultIngestModule (IngestModuleIngestJobSettings settings)
 
default DataArtifactIngestModule createDataArtifactIngestModule (IngestModuleIngestJobSettings settings)
 
default DataSourceIngestModule createDataSourceIngestModule (IngestModuleIngestJobSettings ingestOptions)
 
default FileIngestModule createFileIngestModule (IngestModuleIngestJobSettings ingestOptions)
 
default IngestModuleIngestJobSettings getDefaultIngestJobSettings ()
 
default IngestModuleGlobalSettingsPanel getGlobalSettingsPanel ()
 
default IngestModuleIngestJobSettingsPanel getIngestJobSettingsPanel (IngestModuleIngestJobSettings settings)
 
String getModuleDescription ()
 
String getModuleDisplayName ()
 
String getModuleVersionNumber ()
 
default boolean hasGlobalSettingsPanel ()
 
default boolean hasIngestJobSettingsPanel ()
 
default boolean isAnalysisResultIngestModuleFactory ()
 
default boolean isDataArtifactIngestModuleFactory ()
 
default boolean isDataSourceIngestModuleFactory ()
 
default boolean isFileIngestModuleFactory ()
 

Detailed Description

An interface that must be implemented by all providers of Autopsy ingest modules. An ingest module factory is used to create instances of a type of data source ingest module, a type of file ingest module, or both.

Autopsy will generally use the factory to create several instances of each type of module for each ingest job it performs. Completing an ingest job entails processing a single data source (e.g., a disk image) and all of the files from the data source, including files extracted from archives and any unallocated space (made to look like a series of files). The data source is passed through one or more pipelines of data source ingest modules. The files are passed through one or more pipelines of file ingest modules.

Autopsy may use multiple threads to complete an ingest job, but it is guaranteed that there will be no more than one module instance per thread. However, if the module instances must share resources, the modules are responsible for synchronizing access to the shared resources and doing reference counting as required to release those resources correctly. Also, more than one ingest job may be in progress at any given time. This must also be taken into consideration when sharing resources between module instances.

An ingest module factory may provide global and per ingest job settings user interface panels. The global settings should apply to all module instances. The per ingest job settings should apply to all module instances working on a particular ingest job. Autopsy supports context-sensitive and persistent per ingest job settings, so per ingest job settings must be serializable.

To be discovered at runtime by the ingest framework, IngestModuleFactory implementations must be marked with the following NetBeans Service provider annotation:

@ServiceProvider(service=IngestModuleFactory.class)

IMPORTANT TIP: If an implementation of IngestModuleFactory does not need to provide implementations of all of the IngestModuleFactory methods, it can extend the abstract class IngestModuleFactoryAdapter to get default implementations of most of the IngestModuleFactory methods.

Definition at line 59 of file IngestModuleFactory.java.

Member Function Documentation

default AnalysisResultIngestModule org.sleuthkit.autopsy.ingest.IngestModuleFactory.createAnalysisResultIngestModule ( IngestModuleIngestJobSettings  settings)

Creates an analysis result ingest module instance.

Autopsy will generally use the factory to several instances of each type of module for each ingest job it performs. Completing an ingest job entails processing a single data source (e.g., a disk image) and all of the files from the data source, including files extracted from archives and any unallocated space (made to look like a series of files). The data source is passed through one or more pipelines of data source ingest modules. The files are passed through one or more pipelines of file ingest modules.

The ingest framework may use multiple threads to complete an ingest job, but it is guaranteed that there will be no more than one module instance per thread. However, if the module instances must share resources, the modules are responsible for synchronizing access to the shared resources and doing reference counting as required to release those resources correctly. Also, more than one ingest job may be in progress at any given time. This must also be taken into consideration when sharing resources between module instances. modules.

Parameters
settingsThe settings for the ingest job.
Returns
A file ingest module instance.

Implemented in org.sleuthkit.autopsy.keywordsearch.KeywordSearchModuleFactory.

Definition at line 309 of file IngestModuleFactory.java.

Referenced by org.sleuthkit.autopsy.ingest.IngestModuleTemplate.createAnalysisResultIngestModule().

default DataArtifactIngestModule org.sleuthkit.autopsy.ingest.IngestModuleFactory.createDataArtifactIngestModule ( IngestModuleIngestJobSettings  settings)

Creates a data artifact ingest module instance.

Autopsy will generally use the factory to several instances of each type of module for each ingest job it performs. Completing an ingest job entails processing a single data source (e.g., a disk image) and all of the files from the data source, including files extracted from archives and any unallocated space (made to look like a series of files). The data source is passed through one or more pipelines of data source ingest modules. The files are passed through one or more pipelines of file ingest modules.

The ingest framework may use multiple threads to complete an ingest job, but it is guaranteed that there will be no more than one module instance per thread. However, if the module instances must share resources, the modules are responsible for synchronizing access to the shared resources and doing reference counting as required to release those resources correctly. Also, more than one ingest job may be in progress at any given time. This must also be taken into consideration when sharing resources between module instances. modules.

Parameters
settingsThe settings for the ingest job.
Returns
A file ingest module instance.

Implemented in org.sleuthkit.autopsy.keywordsearch.KeywordSearchModuleFactory, and org.sleuthkit.autopsy.centralrepository.ingestmodule.CentralRepoIngestModuleFactory.

Definition at line 270 of file IngestModuleFactory.java.

Referenced by org.sleuthkit.autopsy.ingest.IngestModuleTemplate.createDataArtifactIngestModule().

default DataSourceIngestModule org.sleuthkit.autopsy.ingest.IngestModuleFactory.createDataSourceIngestModule ( IngestModuleIngestJobSettings  ingestOptions)

Creates a data source ingest module instance.

Autopsy will generally use the factory to several instances of each type of module for each ingest job it performs. Completing an ingest job entails processing a single data source (e.g., a disk image) and all of the files from the data source, including files extracted from archives and any unallocated space (made to look like a series of files). The data source is passed through one or more pipelines of data source ingest modules. The files are passed through one or more pipelines of file ingest modules.

The ingest framework may use multiple threads to complete an ingest job, but it is guaranteed that there will be no more than one module instance per thread. However, if the module instances must share resources, the modules are responsible for synchronizing access to the shared resources and doing reference counting as required to release those resources correctly. Also, more than one ingest job may be in progress at any given time. This must also be taken into consideration when sharing resources between module instances. modules.

Parameters
ingestOptionsThe settings for the ingest job.
Returns
A data source ingest module instance.

Implemented in org.sleuthkit.autopsy.examples.SampleIngestModuleFactory, org.sleuthkit.autopsy.modules.encryptiondetection.EncryptionDetectionModuleFactory, org.sleuthkit.autopsy.test.CustomArtifactsCreatorIngestModuleFactory, org.sleuthkit.autopsy.ingest.IngestModuleFactoryAdapter, org.sleuthkit.autopsy.modules.drones.DroneIngestModuleFactory, org.sleuthkit.autopsy.modules.plaso.PlasoModuleFactory, org.sleuthkit.autopsy.modules.vmextractor.VMExtractorIngestModuleFactory, org.sleuthkit.autopsy.modules.dataSourceIntegrity.DataSourceIntegrityModuleFactory, org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerModuleFactory, org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerModuleFactory, and org.sleuthkit.autopsy.recentactivity.RecentActivityExtracterModuleFactory.

Definition at line 192 of file IngestModuleFactory.java.

Referenced by org.sleuthkit.autopsy.ingest.IngestModuleTemplate.createDataSourceIngestModule().

default FileIngestModule org.sleuthkit.autopsy.ingest.IngestModuleFactory.createFileIngestModule ( IngestModuleIngestJobSettings  ingestOptions)

Creates a file ingest module instance.

Autopsy will generally use the factory to several instances of each type of module for each ingest job it performs. Completing an ingest job entails processing a single data source (e.g., a disk image) and all of the files from the data source, including files extracted from archives and any unallocated space (made to look like a series of files). The data source is passed through one or more pipelines of data source ingest modules. The files are passed through one or more pipelines of file ingest modules.

The ingest framework may use multiple threads to complete an ingest job, but it is guaranteed that there will be no more than one module instance per thread. However, if the module instances must share resources, the modules are responsible for synchronizing access to the shared resources and doing reference counting as required to release those resources correctly. Also, more than one ingest job may be in progress at any given time. This must also be taken into consideration when sharing resources between module instances. modules.

Parameters
settingsThe settings for the ingest job.
Returns
A file ingest module instance.

Implemented in org.sleuthkit.autopsy.examples.SampleIngestModuleFactory, org.sleuthkit.autopsy.test.CustomArtifactsCreatorIngestModuleFactory, org.sleuthkit.autopsy.keywordsearch.KeywordSearchModuleFactory, org.sleuthkit.autopsy.modules.interestingitems.InterestingItemsIngestModuleFactory, org.sleuthkit.autopsy.modules.plaso.PlasoModuleFactory, org.sleuthkit.autopsy.modules.hashdatabase.HashLookupModuleFactory, org.sleuthkit.autopsy.modules.fileextmismatch.FileExtMismatchDetectorModuleFactory, org.sleuthkit.autopsy.modules.filetypeid.FileTypeIdModuleFactory, org.sleuthkit.autopsy.modules.yara.YaraIngestModuleFactory, org.sleuthkit.autopsy.ingest.IngestModuleFactoryAdapter, org.sleuthkit.autopsy.modules.encryptiondetection.EncryptionDetectionModuleFactory, org.sleuthkit.autopsy.centralrepository.ingestmodule.CentralRepoIngestModuleFactory, org.sleuthkit.autopsy.modules.embeddedfileextractor.EmbeddedFileExtractorModuleFactory, org.sleuthkit.autopsy.modules.photoreccarver.PhotoRecCarverIngestModuleFactory, org.sleuthkit.autopsy.thunderbirdparser.EmailParserModuleFactory, org.sleuthkit.autopsy.modules.pictureanalyzer.PictureAnalyzerIngestModuleFactory, and org.sleuthkit.autopsy.test.InterestingArtifactCreatorIngestModuleFactory.

Definition at line 231 of file IngestModuleFactory.java.

Referenced by org.sleuthkit.autopsy.ingest.IngestModuleTemplate.createFileIngestModule().

default IngestModuleIngestJobSettings org.sleuthkit.autopsy.ingest.IngestModuleFactory.getDefaultIngestJobSettings ( )
default IngestModuleGlobalSettingsPanel org.sleuthkit.autopsy.ingest.IngestModuleFactory.getGlobalSettingsPanel ( )
default IngestModuleIngestJobSettingsPanel org.sleuthkit.autopsy.ingest.IngestModuleFactory.getIngestJobSettingsPanel ( IngestModuleIngestJobSettings  settings)
String org.sleuthkit.autopsy.ingest.IngestModuleFactory.getModuleDescription ( )

Gets a brief, user-friendly description of the family of ingest modules the factory creates. Autopsy uses this string to describe the module in user interface components.

Returns
The module family description.

Implemented in org.sleuthkit.autopsy.examples.SampleIngestModuleFactory, org.sleuthkit.autopsy.test.CustomArtifactsCreatorIngestModuleFactory, org.sleuthkit.autopsy.modules.encryptiondetection.EncryptionDetectionModuleFactory, org.sleuthkit.autopsy.centralrepository.ingestmodule.CentralRepoIngestModuleFactory, org.sleuthkit.autopsy.modules.interestingitems.InterestingItemsIngestModuleFactory, org.sleuthkit.autopsy.keywordsearch.KeywordSearchModuleFactory, org.sleuthkit.autopsy.modules.filetypeid.FileTypeIdModuleFactory, org.sleuthkit.autopsy.modules.hashdatabase.HashLookupModuleFactory, org.sleuthkit.autopsy.modules.embeddedfileextractor.EmbeddedFileExtractorModuleFactory, org.sleuthkit.autopsy.modules.photoreccarver.PhotoRecCarverIngestModuleFactory, org.sleuthkit.autopsy.modules.drones.DroneIngestModuleFactory, org.sleuthkit.autopsy.modules.pictureanalyzer.PictureAnalyzerIngestModuleFactory, org.sleuthkit.autopsy.modules.yara.YaraIngestModuleFactory, org.sleuthkit.autopsy.modules.plaso.PlasoModuleFactory, org.sleuthkit.autopsy.modules.vmextractor.VMExtractorIngestModuleFactory, org.sleuthkit.autopsy.thunderbirdparser.EmailParserModuleFactory, org.sleuthkit.autopsy.modules.dataSourceIntegrity.DataSourceIntegrityModuleFactory, org.sleuthkit.autopsy.modules.fileextmismatch.FileExtMismatchDetectorModuleFactory, org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerModuleFactory, org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerModuleFactory, org.sleuthkit.autopsy.recentactivity.RecentActivityExtracterModuleFactory, org.sleuthkit.autopsy.test.InterestingArtifactCreatorIngestModuleFactory, and org.sleuthkit.autopsy.ingest.IngestModuleFactoryAdapter.

Referenced by org.sleuthkit.autopsy.ingest.IngestModuleTemplate.getModuleDescription().

String org.sleuthkit.autopsy.ingest.IngestModuleFactory.getModuleDisplayName ( )

Gets the display name that identifies the family of ingest modules the factory creates. Autopsy uses this string to identify the module in user interface components and log messages. The module name must be unique. so a brief but distinctive name is recommended.

Returns
The module family display name.

Implemented in org.sleuthkit.autopsy.examples.SampleIngestModuleFactory, org.sleuthkit.autopsy.test.CustomArtifactsCreatorIngestModuleFactory, org.sleuthkit.autopsy.centralrepository.ingestmodule.CentralRepoIngestModuleFactory, org.sleuthkit.autopsy.modules.filetypeid.FileTypeIdModuleFactory, org.sleuthkit.autopsy.modules.photoreccarver.PhotoRecCarverIngestModuleFactory, org.sleuthkit.autopsy.modules.drones.DroneIngestModuleFactory, org.sleuthkit.autopsy.modules.encryptiondetection.EncryptionDetectionModuleFactory, org.sleuthkit.autopsy.modules.interestingitems.InterestingItemsIngestModuleFactory, org.sleuthkit.autopsy.modules.yara.YaraIngestModuleFactory, org.sleuthkit.autopsy.keywordsearch.KeywordSearchModuleFactory, org.sleuthkit.autopsy.modules.vmextractor.VMExtractorIngestModuleFactory, org.sleuthkit.autopsy.modules.embeddedfileextractor.EmbeddedFileExtractorModuleFactory, org.sleuthkit.autopsy.modules.plaso.PlasoModuleFactory, org.sleuthkit.autopsy.thunderbirdparser.EmailParserModuleFactory, org.sleuthkit.autopsy.modules.dataSourceIntegrity.DataSourceIntegrityModuleFactory, org.sleuthkit.autopsy.modules.fileextmismatch.FileExtMismatchDetectorModuleFactory, org.sleuthkit.autopsy.modules.pictureanalyzer.PictureAnalyzerIngestModuleFactory, org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerModuleFactory, org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerModuleFactory, org.sleuthkit.autopsy.modules.hashdatabase.HashLookupModuleFactory, org.sleuthkit.autopsy.recentactivity.RecentActivityExtracterModuleFactory, org.sleuthkit.autopsy.test.InterestingArtifactCreatorIngestModuleFactory, and org.sleuthkit.autopsy.ingest.IngestModuleFactoryAdapter.

Referenced by org.sleuthkit.autopsy.ingest.IngestJobSettingsPanel.IngestModulesTableModel.getIcon(), org.sleuthkit.autopsy.ingest.IngestModuleTemplate.getModuleName(), org.sleuthkit.autopsy.ingest.IngestJobSettings.loadModuleSettings(), and org.sleuthkit.autopsy.ingest.IngestJobSettings.saveModuleSettings().

String org.sleuthkit.autopsy.ingest.IngestModuleFactory.getModuleVersionNumber ( )

Gets the version number of the family of ingest modules the factory creates.

Returns
The module family version number.

Implemented in org.sleuthkit.autopsy.examples.SampleIngestModuleFactory, org.sleuthkit.autopsy.test.CustomArtifactsCreatorIngestModuleFactory, org.sleuthkit.autopsy.modules.encryptiondetection.EncryptionDetectionModuleFactory, org.sleuthkit.autopsy.centralrepository.ingestmodule.CentralRepoIngestModuleFactory, org.sleuthkit.autopsy.modules.filetypeid.FileTypeIdModuleFactory, org.sleuthkit.autopsy.modules.interestingitems.InterestingItemsIngestModuleFactory, org.sleuthkit.autopsy.keywordsearch.KeywordSearchModuleFactory, org.sleuthkit.autopsy.modules.hashdatabase.HashLookupModuleFactory, org.sleuthkit.autopsy.modules.embeddedfileextractor.EmbeddedFileExtractorModuleFactory, org.sleuthkit.autopsy.modules.photoreccarver.PhotoRecCarverIngestModuleFactory, org.sleuthkit.autopsy.modules.drones.DroneIngestModuleFactory, org.sleuthkit.autopsy.modules.pictureanalyzer.PictureAnalyzerIngestModuleFactory, org.sleuthkit.autopsy.modules.yara.YaraIngestModuleFactory, org.sleuthkit.autopsy.modules.plaso.PlasoModuleFactory, org.sleuthkit.autopsy.modules.vmextractor.VMExtractorIngestModuleFactory, org.sleuthkit.autopsy.thunderbirdparser.EmailParserModuleFactory, org.sleuthkit.autopsy.modules.dataSourceIntegrity.DataSourceIntegrityModuleFactory, org.sleuthkit.autopsy.modules.fileextmismatch.FileExtMismatchDetectorModuleFactory, org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerModuleFactory, org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerModuleFactory, org.sleuthkit.autopsy.recentactivity.RecentActivityExtracterModuleFactory, org.sleuthkit.autopsy.test.InterestingArtifactCreatorIngestModuleFactory, and org.sleuthkit.autopsy.ingest.IngestModuleFactoryAdapter.

Referenced by org.sleuthkit.autopsy.ingest.IngestJobSettingsPanel.IngestModulesTableModel.getIcon().

default boolean org.sleuthkit.autopsy.ingest.IngestModuleFactory.hasGlobalSettingsPanel ( )

Queries the factory to determine if it provides a user interface panel to allow a user to change settings that are used by all instances of the family of ingest modules the factory creates. For example, the Autopsy core hash lookup ingest module factory provides a global settings panel to import and create hash databases. The hash databases are then enabled or disabled per ingest job using an ingest job settings panel.

Returns
True if the factory provides a global settings panel.

Implemented in org.sleuthkit.autopsy.examples.SampleIngestModuleFactory, org.sleuthkit.autopsy.keywordsearch.KeywordSearchModuleFactory, org.sleuthkit.autopsy.modules.yara.YaraIngestModuleFactory, org.sleuthkit.autopsy.modules.hashdatabase.HashLookupModuleFactory, org.sleuthkit.autopsy.centralrepository.ingestmodule.CentralRepoIngestModuleFactory, org.sleuthkit.autopsy.modules.encryptiondetection.EncryptionDetectionModuleFactory, org.sleuthkit.autopsy.modules.fileextmismatch.FileExtMismatchDetectorModuleFactory, org.sleuthkit.autopsy.modules.plaso.PlasoModuleFactory, org.sleuthkit.autopsy.modules.filetypeid.FileTypeIdModuleFactory, org.sleuthkit.autopsy.modules.interestingitems.InterestingItemsIngestModuleFactory, and org.sleuthkit.autopsy.ingest.IngestModuleFactoryAdapter.

Definition at line 98 of file IngestModuleFactory.java.

Referenced by org.sleuthkit.autopsy.ingest.IngestModuleTemplate.hasGlobalSettingsPanel().

default boolean org.sleuthkit.autopsy.ingest.IngestModuleFactory.hasIngestJobSettingsPanel ( )
default boolean org.sleuthkit.autopsy.ingest.IngestModuleFactory.isAnalysisResultIngestModuleFactory ( )

Queries the factory to determine if it is capable of creating analysis result ingest modules.

Returns
True or false.

Implemented in org.sleuthkit.autopsy.keywordsearch.KeywordSearchModuleFactory.

Definition at line 280 of file IngestModuleFactory.java.

Referenced by org.sleuthkit.autopsy.ingest.IngestModuleTemplate.isAnalysisResultIngestModuleTemplate().

default boolean org.sleuthkit.autopsy.ingest.IngestModuleFactory.isDataArtifactIngestModuleFactory ( )

Queries the factory to determine if it is capable of creating data artifact ingest modules.

Returns
True or false.

Implemented in org.sleuthkit.autopsy.keywordsearch.KeywordSearchModuleFactory, and org.sleuthkit.autopsy.centralrepository.ingestmodule.CentralRepoIngestModuleFactory.

Definition at line 241 of file IngestModuleFactory.java.

Referenced by org.sleuthkit.autopsy.ingest.IngestModuleTemplate.isDataArtifactIngestModuleTemplate().

default boolean org.sleuthkit.autopsy.ingest.IngestModuleFactory.isDataSourceIngestModuleFactory ( )
default boolean org.sleuthkit.autopsy.ingest.IngestModuleFactory.isFileIngestModuleFactory ( )

Queries the factory to determine if it is capable of creating file ingest modules.

Returns
True if the factory can create file ingest modules.

Implemented in org.sleuthkit.autopsy.examples.SampleIngestModuleFactory, org.sleuthkit.autopsy.keywordsearch.KeywordSearchModuleFactory, org.sleuthkit.autopsy.test.CustomArtifactsCreatorIngestModuleFactory, org.sleuthkit.autopsy.modules.interestingitems.InterestingItemsIngestModuleFactory, org.sleuthkit.autopsy.modules.plaso.PlasoModuleFactory, org.sleuthkit.autopsy.modules.hashdatabase.HashLookupModuleFactory, org.sleuthkit.autopsy.modules.fileextmismatch.FileExtMismatchDetectorModuleFactory, org.sleuthkit.autopsy.modules.filetypeid.FileTypeIdModuleFactory, org.sleuthkit.autopsy.modules.yara.YaraIngestModuleFactory, org.sleuthkit.autopsy.ingest.IngestModuleFactoryAdapter, org.sleuthkit.autopsy.modules.encryptiondetection.EncryptionDetectionModuleFactory, org.sleuthkit.autopsy.centralrepository.ingestmodule.CentralRepoIngestModuleFactory, org.sleuthkit.autopsy.modules.pictureanalyzer.PictureAnalyzerIngestModuleFactory, org.sleuthkit.autopsy.modules.embeddedfileextractor.EmbeddedFileExtractorModuleFactory, org.sleuthkit.autopsy.modules.photoreccarver.PhotoRecCarverIngestModuleFactory, org.sleuthkit.autopsy.thunderbirdparser.EmailParserModuleFactory, and org.sleuthkit.autopsy.test.InterestingArtifactCreatorIngestModuleFactory.

Definition at line 202 of file IngestModuleFactory.java.

Referenced by org.sleuthkit.autopsy.ingest.IngestJobSettingsPanel.IngestModulesTableModel.getIcon(), and org.sleuthkit.autopsy.ingest.IngestModuleTemplate.isFileIngestModuleTemplate().


The documentation for this interface was generated from the following file:

Copyright © 2012-2022 Basis Technology. Generated on: Mon Oct 3 2022
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.