diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/ArtifactTypeNode.java b/Core/src/org/sleuthkit/autopsy/datamodel/ArtifactTypeNode.java index 32367d2d1c76b1657a3f0bbc695a1b2a832f91cd..72469cef5eab297b856940932c921f485063b094 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/ArtifactTypeNode.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/ArtifactTypeNode.java @@ -124,6 +124,8 @@ private String getIcon(BlackboardArtifact.ARTIFACT_TYPE type) { return "gps-search.png"; case TSK_SERVICE_ACCOUNT: return "account-icon-16.png"; + case TSK_ENCRYPTION_DETECTED: + return "encrypted-file.png"; } return "artifact-icon.png"; } diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java b/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java index 9b1a545bd1b827f5d53e9e63500401e141658984..4d528912fcc6921a18d9821db84037cc24939f9f 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java @@ -351,6 +351,8 @@ private String getIcon(BlackboardArtifact.ARTIFACT_TYPE type) { return "gps-search.png"; case TSK_SERVICE_ACCOUNT: return "account-icon-16.png"; + case TSK_ENCRYPTION_DETECTED: + return "encrypted-file.png"; } return "artifact-icon.png"; diff --git a/Core/src/org/sleuthkit/autopsy/images/encrypted-file.png b/Core/src/org/sleuthkit/autopsy/images/encrypted-file.png new file mode 100755 index 0000000000000000000000000000000000000000..d6626cb09eb11a298b90a8a27b0d8eab41f49a82 Binary files /dev/null and b/Core/src/org/sleuthkit/autopsy/images/encrypted-file.png differ diff --git a/Core/src/org/sleuthkit/autopsy/report/ReportGenerator.java b/Core/src/org/sleuthkit/autopsy/report/ReportGenerator.java index f95c0021343999f337cc919741617db383b12d2b..3644148ad0f5886f93efaeccae1867b20457cf78 100644 --- a/Core/src/org/sleuthkit/autopsy/report/ReportGenerator.java +++ b/Core/src/org/sleuthkit/autopsy/report/ReportGenerator.java @@ -1016,6 +1016,9 @@ private List<String> getArtifactTableColumnHeaders(int artifactTypeId) { case TSK_TOOL_OUTPUT: columnHeaders = new ArrayList<>(Arrays.asList(new String[] {"Program Name", "Text", "Source File"})); break; + case TSK_ENCRYPTION_DETECTED: + columnHeaders = new ArrayList<>(Arrays.asList(new String[] {"Name", "Source File"})); + break; default: return null; } @@ -1340,6 +1343,10 @@ private List<String> getOrderedRowDataAsStrings() throws TskCoreException { orderedRowData.add(mappedAttributes.get(ATTRIBUTE_TYPE.TSK_TEXT.getTypeID())); orderedRowData.add(getFileUniquePath(getObjectID())); break; + case TSK_ENCRYPTION_DETECTED: + orderedRowData.add(mappedAttributes.get(ATTRIBUTE_TYPE.TSK_NAME.getTypeID())); + orderedRowData.add(getFileUniquePath(getObjectID())); + break; } orderedRowData.add(makeCommaSeparatedList(getTags())); diff --git a/SevenZip/src/org/sleuthkit/autopsy/sevenzip/SevenZipIngestModule.java b/SevenZip/src/org/sleuthkit/autopsy/sevenzip/SevenZipIngestModule.java index cf39a2a16ac0c5a1284674fbe44bae2fe5725afa..4f79973dcdece028a4a5fee6855079e943d43d1c 100644 --- a/SevenZip/src/org/sleuthkit/autopsy/sevenzip/SevenZipIngestModule.java +++ b/SevenZip/src/org/sleuthkit/autopsy/sevenzip/SevenZipIngestModule.java @@ -51,6 +51,7 @@ import org.sleuthkit.autopsy.ingest.IngestMessage; import org.sleuthkit.autopsy.ingest.IngestMonitor; import org.sleuthkit.autopsy.ingest.ModuleContentEvent; +import org.sleuthkit.autopsy.ingest.ModuleDataEvent; import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.BlackboardAttribute; import org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE; @@ -553,11 +554,9 @@ else if (ext.equals(".tgz")) { if (hasEncrypted) { String encryptionType = fullEncryption ? ENCRYPTION_FULL : ENCRYPTION_FILE_LEVEL; try { - BlackboardArtifact generalInfo = archiveFile.getGenInfoArtifact(); - generalInfo.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_ENCRYPTION_DETECTED.getTypeID(), - MODULE_NAME, encryptionType)); - //@@@ We don't fire here because GEN_INFO isn't displayed in the tree.... Need to address how these should be displayed - //services.fireModuleDataEvent(new ModuleDataEvent(MODULE_NAME, BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF)); + BlackboardArtifact artifact = archiveFile.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED); + artifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME.getTypeID(), MODULE_NAME, encryptionType)); + services.fireModuleDataEvent(new ModuleDataEvent(MODULE_NAME, BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED)); } catch (TskCoreException ex) { logger.log(Level.SEVERE, "Error creating blackboard artifact for encryption detected for file: " + archiveFile, ex); }