Skip to content
Snippets Groups Projects
Commit 64bc2a2f authored by Richard Cordovano's avatar Richard Cordovano
Browse files

Line endings fix

parent d43343eb
Branches
Tags
No related merge requests found
OpenIDE-Module-Display-Category=Ingest Module OpenIDE-Module-Display-Category=Ingest Module
OpenIDE-Module-Long-Description=\ OpenIDE-Module-Long-Description=\
Hash Database ingest module. \n\n\ Hash Database ingest module. \n\n\
The ingest module analyzes files in the disk image and marks them as "known" (based on NSRL database lookup for "known" files) and "bad / interesting" (based on one or more databases supplied by the user).\n\n\ The ingest module analyzes files in the disk image and marks them as "known" (based on NSRL database lookup for "known" files) and "bad / interesting" (based on one or more databases supplied by the user).\n\n\
The module also contains additional non-ingest tools that are integrated in the GUI, such as file lookup by hash and hash database configuration. The module also contains additional non-ingest tools that are integrated in the GUI, such as file lookup by hash and hash database configuration.
OpenIDE-Module-Name=HashDatabase OpenIDE-Module-Name=HashDatabase
HashDbSimplePanel.knownLabel.text=NSRL Database: HashDbSimplePanel.knownLabel.text=NSRL Database:
HashDbSimplePanel.notableLabel.text=Known Bad Database(s): HashDbSimplePanel.notableLabel.text=Known Bad Database(s):
HashDbSimplePanel.knownValLabel.text=- HashDbSimplePanel.knownValLabel.text=-
HashDbSimplePanel.notableValLabel.text=- HashDbSimplePanel.notableValLabel.text=-
HashDbSimplePanel.jLabel1.text=Enable known bad databases for ingest: HashDbSimplePanel.jLabel1.text=Enable known bad databases for ingest:
HashDbAddDatabaseDialog.cancelButton.text=Cancel HashDbAddDatabaseDialog.cancelButton.text=Cancel
HashDbAddDatabaseDialog.okButton.text=OK HashDbAddDatabaseDialog.okButton.text=OK
HashDbAddDatabaseDialog.nsrlRadioButton.text=NSRL HashDbAddDatabaseDialog.nsrlRadioButton.text=NSRL
HashDbAddDatabaseDialog.knownBadRadioButton.text=Known Bad HashDbAddDatabaseDialog.knownBadRadioButton.text=Known Bad
HashDbAddDatabaseDialog.databasePathTextField.text= HashDbAddDatabaseDialog.databasePathTextField.text=
HashDbAddDatabaseDialog.browseButton.text=Browse HashDbAddDatabaseDialog.browseButton.text=Browse
HashDbAddDatabaseDialog.jLabel1.text=Enter the name of the database: HashDbAddDatabaseDialog.jLabel1.text=Enter the name of the database:
HashDbAddDatabaseDialog.databaseNameTextField.text= HashDbAddDatabaseDialog.databaseNameTextField.text=
HashDbAddDatabaseDialog.jLabel2.text=Select the type of database: HashDbAddDatabaseDialog.jLabel2.text=Select the type of database:
HashDbAddDatabaseDialog.useForIngestCheckbox.text=Enable for ingest HashDbAddDatabaseDialog.useForIngestCheckbox.text=Enable for ingest
HashDbAddDatabaseDialog.sendInboxMessagesCheckbox.text=Enable sending messages to inbox during ingest HashDbAddDatabaseDialog.sendInboxMessagesCheckbox.text=Enable sending messages to inbox during ingest
HashDbSearchPanel.hashTable.columnModel.title0=MD5 Hashes HashDbSearchPanel.hashTable.columnModel.title0=MD5 Hashes
HashDbSearchPanel.hashTable.columnModel.title3=Title 4 HashDbSearchPanel.hashTable.columnModel.title3=Title 4
HashDbSearchPanel.hashTable.columnModel.title2=Title 3 HashDbSearchPanel.hashTable.columnModel.title2=Title 3
HashDbSearchPanel.hashTable.columnModel.title1=Title 2 HashDbSearchPanel.hashTable.columnModel.title1=Title 2
HashDbSearchPanel.addButton.text=Add Hash HashDbSearchPanel.addButton.text=Add Hash
HashDbSearchPanel.hashField.text= HashDbSearchPanel.hashField.text=
HashDbSearchPanel.hashLabel.text=MD5 hash: HashDbSearchPanel.hashLabel.text=MD5 hash:
HashDbSearchPanel.searchButton.text=Search HashDbSearchPanel.searchButton.text=Search
HashDbSearchPanel.removeButton.text=Remove Selected HashDbSearchPanel.removeButton.text=Remove Selected
HashDbSearchPanel.titleLabel.text=Search for files with the following MD5 hash(es): HashDbSearchPanel.titleLabel.text=Search for files with the following MD5 hash(es):
HashDbSearchPanel.errorField.text=Error: Not all files have been hashed. HashDbSearchPanel.errorField.text=Error: Not all files have been hashed.
HashDbSearchPanel.saveBox.text=Remember Hashes HashDbSearchPanel.saveBox.text=Remember Hashes
HashDbSearchPanel.cancelButton.text=Cancel HashDbSearchPanel.cancelButton.text=Cancel
HashDbSimplePanel.calcHashesButton.text=Calculate hashes even if no hash database is selected HashDbSimplePanel.calcHashesButton.text=Calculate hashes even if no hash database is selected
HashDbSimplePanel.nsrlDbLabel.text=NSRL Database: HashDbSimplePanel.nsrlDbLabel.text=NSRL Database:
HashDbSimplePanel.nsrlDbLabelVal.text=- HashDbSimplePanel.nsrlDbLabelVal.text=-
HashDbManagementPanel.hashDbIndexStatusLabel.text=No database selected HashDbManagementPanel.hashDbIndexStatusLabel.text=No database selected
HashDbManagementPanel.jLabel2.text=Name: HashDbManagementPanel.jLabel2.text=Name:
HashDbManagementPanel.showInboxMessagesCheckBox.text=Enable sending messages to inbox during ingest HashDbManagementPanel.showInboxMessagesCheckBox.text=Enable sending messages to inbox during ingest
HashDbManagementPanel.useForIngestCheckbox.text=Enable for ingest HashDbManagementPanel.useForIngestCheckbox.text=Enable for ingest
HashDbManagementPanel.indexButton.text=Index HashDbManagementPanel.indexButton.text=Index
HashDbManagementPanel.indexLabel.text=Index Status: HashDbManagementPanel.indexLabel.text=Index Status:
HashDbManagementPanel.optionsLabel.text=Options HashDbManagementPanel.optionsLabel.text=Options
HashDbManagementPanel.jLabel4.text=Location: HashDbManagementPanel.jLabel4.text=Location:
HashDbManagementPanel.jLabel6.text=Type: HashDbManagementPanel.jLabel6.text=Type:
HashDbManagementPanel.ingestWarningLabel.text=Ingest is ongoing, some settings will be unavailable until it finishes. HashDbManagementPanel.ingestWarningLabel.text=Ingest is ongoing, some settings will be unavailable until it finishes.
HashDbManagementPanel.hashDbTypeLabel.text=No database selected HashDbManagementPanel.hashDbTypeLabel.text=No database selected
HashDbManagementPanel.typeLabel.text=Type: HashDbManagementPanel.typeLabel.text=Type:
HashDbManagementPanel.deleteButton.text=Delete Database HashDbManagementPanel.deleteButton.text=Delete Database
HashDbManagementPanel.importButton.text=Import Database HashDbManagementPanel.importButton.text=Import Database
HashDbManagementPanel.hashDbNameLabel.text=No database selected HashDbManagementPanel.hashDbNameLabel.text=No database selected
HashDbManagementPanel.nameLabel.text=Name: HashDbManagementPanel.nameLabel.text=Name:
HashDbManagementPanel.jButton3.text=Import Database HashDbManagementPanel.jButton3.text=Import Database
HashDbManagementPanel.locationLabel.text=Location: HashDbManagementPanel.locationLabel.text=Location:
HashDbManagementPanel.hashDbLocationLabel.text=No database selected HashDbManagementPanel.hashDbLocationLabel.text=No database selected
HashDbManagementPanel.informationLabel.text=Information HashDbManagementPanel.informationLabel.text=Information
HashDbManagementPanel.hashDatabasesLabel.text=Hash Databases: HashDbManagementPanel.hashDatabasesLabel.text=Hash Databases:
OpenIDE-Module-Short-Description=Hash Database Ingest Module and hash db tools OpenIDE-Module-Short-Description=Hash Database Ingest Module and hash db tools
ModalNoButtons.CURRENTLYON_LABEL.text=Currently Indexing x of y ModalNoButtons.CURRENTLYON_LABEL.text=Currently Indexing x of y
ModalNoButtons.GO_GET_COFFEE_LABEL.text=Hash databases are currently being indexed, this may take some time. ModalNoButtons.GO_GET_COFFEE_LABEL.text=Hash databases are currently being indexed, this may take some time.
ModalNoButtons.CURRENTDB_LABEL.text=(CurrentDb) ModalNoButtons.CURRENTDB_LABEL.text=(CurrentDb)
ModalNoButtons.CANCEL_BUTTON.text=Cancel ModalNoButtons.CANCEL_BUTTON.text=Cancel
/* /*
* Autopsy Forensic Browser * Autopsy Forensic Browser
* *
* Copyright 2011 Basis Technology Corp. * Copyright 2011 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org * Contact: carrier <at> sleuthkit <dot> org
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
* You may obtain a copy of the License at * You may obtain a copy of the License at
* *
* http://www.apache.org/licenses/LICENSE-2.0 * http://www.apache.org/licenses/LICENSE-2.0
* *
* Unless required by applicable law or agreed to in writing, software * Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, * distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and * See the License for the specific language governing permissions and
* limitations under the License. * limitations under the License.
*/ */
package org.sleuthkit.autopsy.hashdatabase; package org.sleuthkit.autopsy.hashdatabase;
import java.beans.PropertyChangeListener; import java.beans.PropertyChangeListener;
import java.beans.PropertyChangeSupport; import java.beans.PropertyChangeSupport;
import java.io.File; import java.io.File;
import java.util.List; import java.util.List;
import java.util.logging.Level; import java.util.logging.Level;
import javax.swing.SwingWorker; import javax.swing.SwingWorker;
import org.netbeans.api.progress.ProgressHandle; import org.netbeans.api.progress.ProgressHandle;
import org.netbeans.api.progress.ProgressHandleFactory; import org.netbeans.api.progress.ProgressHandleFactory;
import org.openide.util.Cancellable; import org.openide.util.Cancellable;
import org.sleuthkit.autopsy.coreutils.Logger; import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.datamodel.SleuthkitJNI; import org.sleuthkit.datamodel.SleuthkitJNI;
import org.sleuthkit.datamodel.TskException; import org.sleuthkit.datamodel.TskException;
/** /**
* Hash database representation of NSRL and Known Bad hash databases * Hash database representation of NSRL and Known Bad hash databases
* with indexing capability * with indexing capability
* *
*/ */
public class HashDb implements Comparable<HashDb> { public class HashDb implements Comparable<HashDb> {
enum EVENT {INDEXING_DONE }; enum EVENT {INDEXING_DONE };
private final PropertyChangeSupport pcs = new PropertyChangeSupport(this); private final PropertyChangeSupport pcs = new PropertyChangeSupport(this);
public enum DBType{ public enum DBType{
NSRL("NSRL"), KNOWN_BAD("Known Bad"); NSRL("NSRL"), KNOWN_BAD("Known Bad");
private String displayName; private String displayName;
private DBType(String displayName) { private DBType(String displayName) {
this.displayName = displayName; this.displayName = displayName;
} }
public String getDisplayName() { public String getDisplayName() {
return this.displayName; return this.displayName;
} }
} }
// Suffix added to the end of a database name to get its index file // Suffix added to the end of a database name to get its index file
private static final String INDEX_SUFFIX = "-md5.idx"; private static final String INDEX_SUFFIX = "-md5.idx";
private String name; private String name;
private List<String> databasePaths; // TODO: Length limited to one for now... private List<String> databasePaths; // TODO: Length limited to one for now...
private boolean useForIngest; private boolean useForIngest;
private boolean showInboxMessages; private boolean showInboxMessages;
private boolean indexing; private boolean indexing;
private DBType type; private DBType type;
public HashDb(String name, List<String> databasePaths, boolean useForIngest, boolean showInboxMessages, DBType type) { public HashDb(String name, List<String> databasePaths, boolean useForIngest, boolean showInboxMessages, DBType type) {
this.name = name; this.name = name;
this.databasePaths = databasePaths; this.databasePaths = databasePaths;
this.useForIngest = useForIngest; this.useForIngest = useForIngest;
this.showInboxMessages = showInboxMessages; this.showInboxMessages = showInboxMessages;
this.type = type; this.type = type;
this.indexing = false; this.indexing = false;
} }
void addPropertyChangeListener(PropertyChangeListener pcl) { void addPropertyChangeListener(PropertyChangeListener pcl) {
pcs.addPropertyChangeListener(pcl); pcs.addPropertyChangeListener(pcl);
} }
void removePropertyChangeListener(PropertyChangeListener pcl) { void removePropertyChangeListener(PropertyChangeListener pcl) {
pcs.removePropertyChangeListener(pcl); pcs.removePropertyChangeListener(pcl);
} }
boolean getUseForIngest() { boolean getUseForIngest() {
return useForIngest; return useForIngest;
} }
boolean getShowInboxMessages() { boolean getShowInboxMessages() {
return showInboxMessages; return showInboxMessages;
} }
DBType getDbType() { DBType getDbType() {
return type; return type;
} }
String getName() { String getName() {
return name; return name;
} }
List<String> getDatabasePaths() { List<String> getDatabasePaths() {
return databasePaths; return databasePaths;
} }
void setUseForIngest(boolean useForIngest) { void setUseForIngest(boolean useForIngest) {
this.useForIngest = useForIngest; this.useForIngest = useForIngest;
} }
void setShowInboxMessages(boolean showInboxMessages) { void setShowInboxMessages(boolean showInboxMessages) {
this.showInboxMessages = showInboxMessages; this.showInboxMessages = showInboxMessages;
} }
void setName(String name) { void setName(String name) {
this.name = name; this.name = name;
} }
void setDatabasePaths(List<String> databasePaths) { void setDatabasePaths(List<String> databasePaths) {
this.databasePaths = databasePaths; this.databasePaths = databasePaths;
} }
void setDbType(DBType type) { void setDbType(DBType type) {
this.type = type; this.type = type;
} }
/** /**
* Checks if the database exists. * Checks if the database exists.
* @return true if a file exists at the database path, else false * @return true if a file exists at the database path, else false
*/ */
boolean databaseExists() { boolean databaseExists() {
return databaseFile().exists(); return databaseFile().exists();
} }
/** /**
* Checks if Sleuth Kit can open the index for the database path. * Checks if Sleuth Kit can open the index for the database path.
* @return true if the index was found and opened successfully, else false * @return true if the index was found and opened successfully, else false
*/ */
boolean indexExists() { boolean indexExists() {
try { try {
return hasIndex(databasePaths.get(0)); // TODO: support multiple paths return hasIndex(databasePaths.get(0)); // TODO: support multiple paths
} catch (TskException ex) { } catch (TskException ex) {
Logger.getLogger(this.getClass().getName()).log(Level.WARNING, "Error checking if index exists.", ex); Logger.getLogger(this.getClass().getName()).log(Level.WARNING, "Error checking if index exists.", ex);
return false; return false;
} }
} }
/** /**
* Gets the database file. * Gets the database file.
* @return a File initialized with the database path * @return a File initialized with the database path
*/ */
File databaseFile() { File databaseFile() {
return new File(databasePaths.get(0)); // TODO: support multiple paths return new File(databasePaths.get(0)); // TODO: support multiple paths
} }
/** /**
* Gets the index file * Gets the index file
* @return a File initialized with an index path derived from the database * @return a File initialized with an index path derived from the database
* path * path
*/ */
File indexFile() { File indexFile() {
return new File(toIndexPath(databasePaths.get(0))); // TODO: support multiple paths return new File(toIndexPath(databasePaths.get(0))); // TODO: support multiple paths
} }
/** /**
* Checks if the index file is older than the database file * Checks if the index file is older than the database file
* @return true if there is are files at the index path and the database * @return true if there is are files at the index path and the database
* path, and the index file has an older modified-time than the database * path, and the index file has an older modified-time than the database
* file, else false * file, else false
*/ */
boolean isOutdated() { boolean isOutdated() {
File i = indexFile(); File i = indexFile();
File db = databaseFile(); File db = databaseFile();
return i.exists() && db.exists() && isOlderThan(i, db); return i.exists() && db.exists() && isOlderThan(i, db);
} }
/** /**
* Checks if the database is being indexed * Checks if the database is being indexed
*/ */
boolean isIndexing() { boolean isIndexing() {
return indexing; return indexing;
} }
/** /**
* Returns the status of the HashDb as determined from indexExists(), * Returns the status of the HashDb as determined from indexExists(),
* databaseExists(), and isOutdated() * databaseExists(), and isOutdated()
* @return IndexStatus enum according to their definitions * @return IndexStatus enum according to their definitions
*/ */
IndexStatus status() { IndexStatus status() {
boolean i = this.indexExists(); boolean i = this.indexExists();
boolean db = this.databaseExists(); boolean db = this.databaseExists();
if(indexing) if(indexing)
return IndexStatus.INDEXING; return IndexStatus.INDEXING;
if (i) { if (i) {
if (db) { if (db) {
return this.isOutdated() ? IndexStatus.INDEX_OUTDATED : IndexStatus.INDEX_CURRENT; return this.isOutdated() ? IndexStatus.INDEX_OUTDATED : IndexStatus.INDEX_CURRENT;
} else { } else {
return IndexStatus.NO_DB; return IndexStatus.NO_DB;
} }
} else { } else {
return db ? IndexStatus.NO_INDEX : IndexStatus.NONE; return db ? IndexStatus.NO_INDEX : IndexStatus.NONE;
} }
} }
/** /**
* Tries to index the database (overwrites any existing index) * Tries to index the database (overwrites any existing index)
* @throws TskException if an error occurs in the SleuthKit bindings * @throws TskException if an error occurs in the SleuthKit bindings
*/ */
void createIndex() throws TskException { void createIndex() throws TskException {
indexing = true; indexing = true;
CreateIndex creator = new CreateIndex(); CreateIndex creator = new CreateIndex();
creator.execute(); creator.execute();
} }
/** /**
* Checks if one file is older than an other * Checks if one file is older than an other
* @param a first file * @param a first file
* @param b second file * @param b second file
* @return true if the first file's last modified data is before the second * @return true if the first file's last modified data is before the second
* file's last modified date * file's last modified date
*/ */
private static boolean isOlderThan(File a, File b) { private static boolean isOlderThan(File a, File b) {
return a.lastModified() < b.lastModified(); return a.lastModified() < b.lastModified();
} }
/** /**
* Determines if a path points to an index by checking the suffix * Determines if a path points to an index by checking the suffix
* @param path * @param path
* @return true if index * @return true if index
*/ */
static boolean isIndexPath(String path) { static boolean isIndexPath(String path) {
return path.endsWith(INDEX_SUFFIX); return path.endsWith(INDEX_SUFFIX);
} }
/** /**
* Derives database path from an image path by removing the suffix. * Derives database path from an image path by removing the suffix.
* @param indexPath * @param indexPath
* @return * @return
*/ */
static String toDatabasePath(String indexPath) { static String toDatabasePath(String indexPath) {
return indexPath.substring(0, indexPath.lastIndexOf(INDEX_SUFFIX)); return indexPath.substring(0, indexPath.lastIndexOf(INDEX_SUFFIX));
} }
/** /**
* Derives image path from an database path by appending the suffix. * Derives image path from an database path by appending the suffix.
* @param databasePath * @param databasePath
* @return * @return
*/ */
static String toIndexPath(String databasePath) { static String toIndexPath(String databasePath) {
return databasePath.concat(INDEX_SUFFIX); return databasePath.concat(INDEX_SUFFIX);
} }
/** /**
* Calls Sleuth Kit method via JNI to determine whether there is an * Calls Sleuth Kit method via JNI to determine whether there is an
* index for the given path * index for the given path
* @param databasePath path Path for the database the index is of * @param databasePath path Path for the database the index is of
* (database doesn't have to actually exist)' * (database doesn't have to actually exist)'
* @return true if index exists * @return true if index exists
* @throws TskException if there is an error in the JNI call * @throws TskException if there is an error in the JNI call
*/ */
static boolean hasIndex(String databasePath) throws TskException { static boolean hasIndex(String databasePath) throws TskException {
return SleuthkitJNI.lookupIndexExists(databasePath); return SleuthkitJNI.lookupIndexExists(databasePath);
} }
@Override @Override
public int compareTo(HashDb o) { public int compareTo(HashDb o) {
return this.name.compareTo(o.name); return this.name.compareTo(o.name);
} }
/* Thread that creates a database's index */ /* Thread that creates a database's index */
private class CreateIndex extends SwingWorker<Object,Void> { private class CreateIndex extends SwingWorker<Object,Void> {
private ProgressHandle progress; private ProgressHandle progress;
CreateIndex(){}; CreateIndex(){};
@Override @Override
protected Object doInBackground() throws Exception { protected Object doInBackground() throws Exception {
progress = ProgressHandleFactory.createHandle("Indexing " + name); progress = ProgressHandleFactory.createHandle("Indexing " + name);
/** We need proper cancel support in TSK to make the task cancellable /** We need proper cancel support in TSK to make the task cancellable
new Cancellable() { new Cancellable() {
Override Override
public boolean cancel() { public boolean cancel() {
return CreateIndex.this.cancel(true); return CreateIndex.this.cancel(true);
} }
}); });
*/ */
progress.start(); progress.start();
progress.switchToIndeterminate(); progress.switchToIndeterminate();
SleuthkitJNI.createLookupIndex(databasePaths.get(0)); SleuthkitJNI.createLookupIndex(databasePaths.get(0));
return null; return null;
} }
/* clean up or start the worker threads */ /* clean up or start the worker threads */
@Override @Override
protected void done() { protected void done() {
indexing = false; indexing = false;
progress.finish(); progress.finish();
pcs.firePropertyChange(EVENT.INDEXING_DONE.toString(), null, name); pcs.firePropertyChange(EVENT.INDEXING_DONE.toString(), null, name);
} }
} }
} }
\ No newline at end of file
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment