Skip to content
Snippets Groups Projects
Commit d31ed4a8 authored by Jeff Wallace's avatar Jeff Wallace
Browse files

line endings.

parent bc4705cb
Branches
Tags
No related merge requests found
Showing
with 1456 additions and 1456 deletions
Manifest-Version: 1.0 Manifest-Version: 1.0
OpenIDE-Module: org.sleuthkit.autopsy.core/9 OpenIDE-Module: org.sleuthkit.autopsy.core/9
OpenIDE-Module-Localizing-Bundle: org/sleuthkit/autopsy/core/Bundle.properties OpenIDE-Module-Localizing-Bundle: org/sleuthkit/autopsy/core/Bundle.properties
OpenIDE-Module-Layer: org/sleuthkit/autopsy/core/layer.xml OpenIDE-Module-Layer: org/sleuthkit/autopsy/core/layer.xml
OpenIDE-Module-Implementation-Version: 9 OpenIDE-Module-Implementation-Version: 9
OpenIDE-Module-Requires: org.openide.windows.WindowManager, org.netbeans.api.javahelp.Help OpenIDE-Module-Requires: org.openide.windows.WindowManager, org.netbeans.api.javahelp.Help
AutoUpdate-Show-In-Client: true AutoUpdate-Show-In-Client: true
AutoUpdate-Essential-Module: true AutoUpdate-Essential-Module: true
OpenIDE-Module-Install: org/sleuthkit/autopsy/core/Installer.class OpenIDE-Module-Install: org/sleuthkit/autopsy/core/Installer.class
/* /*
* Autopsy Forensic Browser * Autopsy Forensic Browser
* *
* Copyright 2011 Basis Technology Corp. * Copyright 2011 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org * Contact: carrier <at> sleuthkit <dot> org
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
* You may obtain a copy of the License at * You may obtain a copy of the License at
* *
* http://www.apache.org/licenses/LICENSE-2.0 * http://www.apache.org/licenses/LICENSE-2.0
* *
* Unless required by applicable law or agreed to in writing, software * Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, * distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and * See the License for the specific language governing permissions and
* limitations under the License. * limitations under the License.
*/ */
package org.sleuthkit.autopsy.datamodel; package org.sleuthkit.autopsy.datamodel;
import java.util.ArrayList; import java.util.ArrayList;
import java.util.List; import java.util.List;
import javax.swing.Action; import javax.swing.Action;
import org.sleuthkit.autopsy.directorytree.ExtractAction; import org.sleuthkit.autopsy.directorytree.ExtractAction;
import org.sleuthkit.autopsy.directorytree.NewWindowViewAction; import org.sleuthkit.autopsy.directorytree.NewWindowViewAction;
import org.sleuthkit.autopsy.directorytree.TagAbstractFileAction; import org.sleuthkit.autopsy.directorytree.TagAbstractFileAction;
import org.sleuthkit.autopsy.directorytree.ViewContextAction; import org.sleuthkit.autopsy.directorytree.ViewContextAction;
import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.Directory; import org.sleuthkit.datamodel.Directory;
import org.sleuthkit.datamodel.TskData.TSK_FS_NAME_FLAG_ENUM; import org.sleuthkit.datamodel.TskData.TSK_FS_NAME_FLAG_ENUM;
/** /**
* This class is used to represent the "Node" for the directory. Its children * This class is used to represent the "Node" for the directory. Its children
* are more directories. * are more directories.
*/ */
public class DirectoryNode extends AbstractFsContentNode<AbstractFile> { public class DirectoryNode extends AbstractFsContentNode<AbstractFile> {
public static final String DOTDOTDIR = "[parent folder]"; public static final String DOTDOTDIR = "[parent folder]";
public static final String DOTDIR = "[current folder]"; public static final String DOTDIR = "[current folder]";
public DirectoryNode(Directory dir) { public DirectoryNode(Directory dir) {
this(dir, true); this(dir, true);
setIcon(dir); setIcon(dir);
} }
public DirectoryNode(AbstractFile dir, boolean directoryBrowseMode) { public DirectoryNode(AbstractFile dir, boolean directoryBrowseMode) {
super(dir, directoryBrowseMode); super(dir, directoryBrowseMode);
setIcon(dir); setIcon(dir);
} }
private void setIcon(AbstractFile dir) { private void setIcon(AbstractFile dir) {
// set name, display name, and icon // set name, display name, and icon
if (dir.isDirNameFlagSet(TSK_FS_NAME_FLAG_ENUM.UNALLOC)) { if (dir.isDirNameFlagSet(TSK_FS_NAME_FLAG_ENUM.UNALLOC)) {
this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/folder-icon-deleted.png"); this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/folder-icon-deleted.png");
} else { } else {
this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/Folder-icon.png"); this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/Folder-icon.png");
} }
} }
/** /**
* Right click action for this node * Right click action for this node
* *
* @param popup * @param popup
* @return * @return
*/ */
@Override @Override
public Action[] getActions(boolean popup) { public Action[] getActions(boolean popup) {
List<Action> actions = new ArrayList<>(); List<Action> actions = new ArrayList<>();
if (!getDirectoryBrowseMode()) { if (!getDirectoryBrowseMode()) {
actions.add(new ViewContextAction("View File in Directory", this)); actions.add(new ViewContextAction("View File in Directory", this));
actions.add(null); // creates a menu separator actions.add(null); // creates a menu separator
} }
actions.add(new NewWindowViewAction("View in New Window", this)); actions.add(new NewWindowViewAction("View in New Window", this));
actions.add(null); // creates a menu separator actions.add(null); // creates a menu separator
actions.add(ExtractAction.getInstance()); actions.add(ExtractAction.getInstance());
actions.add(null); // creates a menu separator actions.add(null); // creates a menu separator
actions.add(TagAbstractFileAction.getInstance()); actions.add(TagAbstractFileAction.getInstance());
return actions.toArray(new Action[0]); return actions.toArray(new Action[0]);
} }
@Override @Override
public <T> T accept(ContentNodeVisitor<T> v) { public <T> T accept(ContentNodeVisitor<T> v) {
return v.visit(this); return v.visit(this);
} }
@Override @Override
public <T> T accept(DisplayableItemNodeVisitor<T> v) { public <T> T accept(DisplayableItemNodeVisitor<T> v) {
return v.visit(this); return v.visit(this);
} }
@Override @Override
public TYPE getDisplayableItemNodeType() { public TYPE getDisplayableItemNodeType() {
return TYPE.CONTENT; return TYPE.CONTENT;
} }
} }
/* /*
* Autopsy Forensic Browser * Autopsy Forensic Browser
* *
* Copyright 2011 Basis Technology Corp. * Copyright 2011 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org * Contact: carrier <at> sleuthkit <dot> org
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
* You may obtain a copy of the License at * You may obtain a copy of the License at
* *
* http://www.apache.org/licenses/LICENSE-2.0 * http://www.apache.org/licenses/LICENSE-2.0
* *
* Unless required by applicable law or agreed to in writing, software * Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, * distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and * See the License for the specific language governing permissions and
* limitations under the License. * limitations under the License.
*/ */
package org.sleuthkit.autopsy.datamodel; package org.sleuthkit.autopsy.datamodel;
import java.util.ArrayList; import java.util.ArrayList;
import java.util.List; import java.util.List;
import javax.swing.Action; import javax.swing.Action;
import org.sleuthkit.autopsy.directorytree.ExternalViewerAction; import org.sleuthkit.autopsy.directorytree.ExternalViewerAction;
import org.sleuthkit.autopsy.directorytree.ExtractAction; import org.sleuthkit.autopsy.directorytree.ExtractAction;
import org.sleuthkit.autopsy.directorytree.HashSearchAction; import org.sleuthkit.autopsy.directorytree.HashSearchAction;
import org.sleuthkit.autopsy.directorytree.NewWindowViewAction; import org.sleuthkit.autopsy.directorytree.NewWindowViewAction;
import org.sleuthkit.autopsy.directorytree.TagAbstractFileAction; import org.sleuthkit.autopsy.directorytree.TagAbstractFileAction;
import org.sleuthkit.autopsy.directorytree.ViewContextAction; import org.sleuthkit.autopsy.directorytree.ViewContextAction;
import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.TskData.TSK_DB_FILES_TYPE_ENUM; import org.sleuthkit.datamodel.TskData.TSK_DB_FILES_TYPE_ENUM;
import org.sleuthkit.datamodel.TskData.TSK_FS_NAME_FLAG_ENUM; import org.sleuthkit.datamodel.TskData.TSK_FS_NAME_FLAG_ENUM;
/** /**
* This class is used to represent the "Node" for the file. It may have derived * This class is used to represent the "Node" for the file. It may have derived
* files children. * files children.
*/ */
public class FileNode extends AbstractFsContentNode<AbstractFile> { public class FileNode extends AbstractFsContentNode<AbstractFile> {
/** /**
* @param file underlying Content * @param file underlying Content
*/ */
public FileNode(AbstractFile file) { public FileNode(AbstractFile file) {
this(file, true); this(file, true);
setIcon(file); setIcon(file);
} }
public FileNode(AbstractFile file, boolean directoryBrowseMode) { public FileNode(AbstractFile file, boolean directoryBrowseMode) {
super(file, directoryBrowseMode); super(file, directoryBrowseMode);
setIcon(file); setIcon(file);
} }
private void setIcon(AbstractFile file) { private void setIcon(AbstractFile file) {
// set name, display name, and icon // set name, display name, and icon
if (file.isDirNameFlagSet(TSK_FS_NAME_FLAG_ENUM.UNALLOC)) { if (file.isDirNameFlagSet(TSK_FS_NAME_FLAG_ENUM.UNALLOC)) {
if (file.getType().equals(TSK_DB_FILES_TYPE_ENUM.CARVED)) { if (file.getType().equals(TSK_DB_FILES_TYPE_ENUM.CARVED)) {
this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/carved-file-icon-16.png"); this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/carved-file-icon-16.png");
} else { } else {
this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/file-icon-deleted.png"); this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/file-icon-deleted.png");
} }
} else { } else {
this.setIconBaseWithExtension(getIconForFileType(file)); this.setIconBaseWithExtension(getIconForFileType(file));
} }
} }
/** /**
* Right click action for this node * Right click action for this node
* *
* @param popup * @param popup
* @return * @return
*/ */
@Override @Override
public Action[] getActions(boolean popup) { public Action[] getActions(boolean popup) {
List<Action> actionsList = new ArrayList<>(); List<Action> actionsList = new ArrayList<>();
if (!this.getDirectoryBrowseMode()) { if (!this.getDirectoryBrowseMode()) {
actionsList.add(new ViewContextAction("View File in Directory", this)); actionsList.add(new ViewContextAction("View File in Directory", this));
actionsList.add(null); // creates a menu separator actionsList.add(null); // creates a menu separator
} }
actionsList.add(new NewWindowViewAction("View in New Window", this)); actionsList.add(new NewWindowViewAction("View in New Window", this));
actionsList.add(new ExternalViewerAction("Open in External Viewer", this)); actionsList.add(new ExternalViewerAction("Open in External Viewer", this));
actionsList.add(null); // creates a menu separator actionsList.add(null); // creates a menu separator
actionsList.add(ExtractAction.getInstance()); actionsList.add(ExtractAction.getInstance());
actionsList.add(new HashSearchAction("Search for files with the same MD5 hash", this)); actionsList.add(new HashSearchAction("Search for files with the same MD5 hash", this));
actionsList.add(null); // creates a menu separator actionsList.add(null); // creates a menu separator
actionsList.add(TagAbstractFileAction.getInstance()); actionsList.add(TagAbstractFileAction.getInstance());
return actionsList.toArray(new Action[0]); return actionsList.toArray(new Action[0]);
} }
@Override @Override
public <T> T accept(ContentNodeVisitor< T> v) { public <T> T accept(ContentNodeVisitor< T> v) {
return v.visit(this); return v.visit(this);
} }
@Override @Override
public <T> T accept(DisplayableItemNodeVisitor< T> v) { public <T> T accept(DisplayableItemNodeVisitor< T> v) {
return v.visit(this); return v.visit(this);
} }
// Given a file, returns the correct icon for said // Given a file, returns the correct icon for said
// file based off it's extension // file based off it's extension
static String getIconForFileType(AbstractFile file) { static String getIconForFileType(AbstractFile file) {
// Get the name, extension // Get the name, extension
String name = file.getName(); String name = file.getName();
int dotIndex = name.lastIndexOf("."); int dotIndex = name.lastIndexOf(".");
if (dotIndex == -1) { if (dotIndex == -1) {
return "org/sleuthkit/autopsy/images/file-icon.png"; return "org/sleuthkit/autopsy/images/file-icon.png";
} }
String ext = name.substring(dotIndex).toLowerCase(); String ext = name.substring(dotIndex).toLowerCase();
// Images // Images
for (String s : FileTypeExtensions.getImageExtensions()) { for (String s : FileTypeExtensions.getImageExtensions()) {
if (ext.equals(s)) { if (ext.equals(s)) {
return "org/sleuthkit/autopsy/images/image-file.png"; return "org/sleuthkit/autopsy/images/image-file.png";
} }
} }
// Videos // Videos
for (String s : FileTypeExtensions.getVideoExtensions()) { for (String s : FileTypeExtensions.getVideoExtensions()) {
if (ext.equals(s)) { if (ext.equals(s)) {
return "org/sleuthkit/autopsy/images/video-file.png"; return "org/sleuthkit/autopsy/images/video-file.png";
} }
} }
// Audio Files // Audio Files
for (String s : FileTypeExtensions.getAudioExtensions()) { for (String s : FileTypeExtensions.getAudioExtensions()) {
if (ext.equals(s)) { if (ext.equals(s)) {
return "org/sleuthkit/autopsy/images/audio-file.png"; return "org/sleuthkit/autopsy/images/audio-file.png";
} }
} }
// Documents // Documents
for (String s : FileTypeExtensions.getDocumentExtensions()) { for (String s : FileTypeExtensions.getDocumentExtensions()) {
if (ext.equals(s)) { if (ext.equals(s)) {
return "org/sleuthkit/autopsy/images/doc-file.png"; return "org/sleuthkit/autopsy/images/doc-file.png";
} }
} }
// Executables / System Files // Executables / System Files
for (String s : FileTypeExtensions.getExecutableExtensions()) { for (String s : FileTypeExtensions.getExecutableExtensions()) {
if (ext.equals(s)) { if (ext.equals(s)) {
return "org/sleuthkit/autopsy/images/exe-file.png"; return "org/sleuthkit/autopsy/images/exe-file.png";
} }
} }
// Text Files // Text Files
for (String s : FileTypeExtensions.getTextExtensions()) { for (String s : FileTypeExtensions.getTextExtensions()) {
if (ext.equals(s)) { if (ext.equals(s)) {
return "org/sleuthkit/autopsy/images/text-file.png"; return "org/sleuthkit/autopsy/images/text-file.png";
} }
} }
// Web Files // Web Files
for (String s : FileTypeExtensions.getWebExtensions()) { for (String s : FileTypeExtensions.getWebExtensions()) {
if (ext.equals(s)) { if (ext.equals(s)) {
return "org/sleuthkit/autopsy/images/web-file.png"; return "org/sleuthkit/autopsy/images/web-file.png";
} }
} }
// PDFs // PDFs
for (String s : FileTypeExtensions.getPDFExtensions()) { for (String s : FileTypeExtensions.getPDFExtensions()) {
if (ext.equals(s)) { if (ext.equals(s)) {
return "org/sleuthkit/autopsy/images/pdf-file.png"; return "org/sleuthkit/autopsy/images/pdf-file.png";
} }
} }
// Archives // Archives
for (String s : FileTypeExtensions.getArchiveExtensions()) { for (String s : FileTypeExtensions.getArchiveExtensions()) {
if (ext.equals(s)) { if (ext.equals(s)) {
return "org/sleuthkit/autopsy/images/archive-file.png"; return "org/sleuthkit/autopsy/images/archive-file.png";
} }
} }
// Else return the default // Else return the default
return "org/sleuthkit/autopsy/images/file-icon.png"; return "org/sleuthkit/autopsy/images/file-icon.png";
} }
@Override @Override
public TYPE getDisplayableItemNodeType() { public TYPE getDisplayableItemNodeType() {
return TYPE.CONTENT; return TYPE.CONTENT;
} }
@Override @Override
public boolean isLeafTypeNode() { public boolean isLeafTypeNode() {
return true; //false; return true; //false;
} }
} }
/* /*
* Autopsy Forensic Browser * Autopsy Forensic Browser
* *
* Copyright 2013 Basis Technology Corp. * Copyright 2013 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org * Contact: carrier <at> sleuthkit <dot> org
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
* You may obtain a copy of the License at * You may obtain a copy of the License at
* *
* http://www.apache.org/licenses/LICENSE-2.0 * http://www.apache.org/licenses/LICENSE-2.0
* *
* Unless required by applicable law or agreed to in writing, software * Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, * distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and * See the License for the specific language governing permissions and
* limitations under the License. * limitations under the License.
*/ */
package org.sleuthkit.autopsy.directorytree; package org.sleuthkit.autopsy.directorytree;
import java.awt.event.ActionEvent; import java.awt.event.ActionEvent;
import java.util.Collection; import java.util.Collection;
import javax.swing.AbstractAction; import javax.swing.AbstractAction;
import javax.swing.JMenuItem; import javax.swing.JMenuItem;
import org.openide.util.Utilities; import org.openide.util.Utilities;
import org.openide.util.actions.Presenter; import org.openide.util.actions.Presenter;
import org.sleuthkit.autopsy.datamodel.Tags; import org.sleuthkit.autopsy.datamodel.Tags;
import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.AbstractFile;
public class TagAbstractFileAction extends AbstractAction implements Presenter.Popup { public class TagAbstractFileAction extends AbstractAction implements Presenter.Popup {
// This class is a singleton to support multi-selection of nodes, since // This class is a singleton to support multi-selection of nodes, since
// org.openide.nodes.NodeOp.findActions(Node[] nodes) will only pick up an Action if every // org.openide.nodes.NodeOp.findActions(Node[] nodes) will only pick up an Action if every
// node in the array returns a reference to the same action object from Node.getActions(boolean). // node in the array returns a reference to the same action object from Node.getActions(boolean).
private static TagAbstractFileAction instance; private static TagAbstractFileAction instance;
public static synchronized TagAbstractFileAction getInstance() { public static synchronized TagAbstractFileAction getInstance() {
if (null == instance) { if (null == instance) {
instance = new TagAbstractFileAction(); instance = new TagAbstractFileAction();
} }
return instance; return instance;
} }
private TagAbstractFileAction() { private TagAbstractFileAction() {
} }
@Override @Override
public JMenuItem getPopupPresenter() { public JMenuItem getPopupPresenter() {
return new TagAbstractFileMenu(); return new TagAbstractFileMenu();
} }
@Override @Override
public void actionPerformed(ActionEvent e) { public void actionPerformed(ActionEvent e) {
// Do nothing - this action should never be performed. // Do nothing - this action should never be performed.
// Submenu actions are invoked instead. // Submenu actions are invoked instead.
} }
private static class TagAbstractFileMenu extends TagMenu { private static class TagAbstractFileMenu extends TagMenu {
public TagAbstractFileMenu() { public TagAbstractFileMenu() {
super(Utilities.actionsGlobalContext().lookupAll(AbstractFile.class).size() > 1 ? "Tag Files" : "Tag File"); super(Utilities.actionsGlobalContext().lookupAll(AbstractFile.class).size() > 1 ? "Tag Files" : "Tag File");
} }
@Override @Override
protected void applyTag(String tagName, String comment) { protected void applyTag(String tagName, String comment) {
Collection<? extends AbstractFile> selectedFiles = Utilities.actionsGlobalContext().lookupAll(AbstractFile.class); Collection<? extends AbstractFile> selectedFiles = Utilities.actionsGlobalContext().lookupAll(AbstractFile.class);
for (AbstractFile file : selectedFiles) { for (AbstractFile file : selectedFiles) {
Tags.createTag(file, tagName, comment); Tags.createTag(file, tagName, comment);
} }
} }
} }
} }
/* /*
* Autopsy Forensic Browser * Autopsy Forensic Browser
* *
* Copyright 2013 Basis Technology Corp. * Copyright 2013 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org * Contact: carrier <at> sleuthkit <dot> org
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
* You may obtain a copy of the License at * You may obtain a copy of the License at
* *
* http://www.apache.org/licenses/LICENSE-2.0 * http://www.apache.org/licenses/LICENSE-2.0
* *
* Unless required by applicable law or agreed to in writing, software * Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, * distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and * See the License for the specific language governing permissions and
* limitations under the License. * limitations under the License.
*/ */
package org.sleuthkit.autopsy.directorytree; package org.sleuthkit.autopsy.directorytree;
import java.awt.event.ActionEvent; import java.awt.event.ActionEvent;
import java.util.Collection; import java.util.Collection;
import javax.swing.AbstractAction; import javax.swing.AbstractAction;
import javax.swing.JMenuItem; import javax.swing.JMenuItem;
import org.openide.util.Utilities; import org.openide.util.Utilities;
import org.openide.util.actions.Presenter; import org.openide.util.actions.Presenter;
import org.sleuthkit.autopsy.datamodel.Tags; import org.sleuthkit.autopsy.datamodel.Tags;
import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.BlackboardArtifact;
public class TagBlackboardArtifactAction extends AbstractAction implements Presenter.Popup { public class TagBlackboardArtifactAction extends AbstractAction implements Presenter.Popup {
// This class is a singleton to support multi-selection of nodes, since // This class is a singleton to support multi-selection of nodes, since
// org.openide.nodes.NodeOp.findActions(Node[] nodes) will only pick up an Action if every // org.openide.nodes.NodeOp.findActions(Node[] nodes) will only pick up an Action if every
// node in the array returns a reference to the same action object from Node.getActions(boolean). // node in the array returns a reference to the same action object from Node.getActions(boolean).
private static TagBlackboardArtifactAction instance; private static TagBlackboardArtifactAction instance;
public static synchronized TagBlackboardArtifactAction getInstance() { public static synchronized TagBlackboardArtifactAction getInstance() {
if (null == instance) { if (null == instance) {
instance = new TagBlackboardArtifactAction(); instance = new TagBlackboardArtifactAction();
} }
return instance; return instance;
} }
private TagBlackboardArtifactAction() { private TagBlackboardArtifactAction() {
} }
@Override @Override
public JMenuItem getPopupPresenter() { public JMenuItem getPopupPresenter() {
return new TagBlackboardArtifactMenu(); return new TagBlackboardArtifactMenu();
} }
@Override @Override
public void actionPerformed(ActionEvent e) { public void actionPerformed(ActionEvent e) {
// Do nothing - this action should never be performed. // Do nothing - this action should never be performed.
// Submenu actions are invoked instead. // Submenu actions are invoked instead.
} }
private static class TagBlackboardArtifactMenu extends TagMenu { private static class TagBlackboardArtifactMenu extends TagMenu {
public TagBlackboardArtifactMenu() { public TagBlackboardArtifactMenu() {
super(Utilities.actionsGlobalContext().lookupAll(BlackboardArtifact.class).size() > 1 ? "Tag Results" : "Tag Result"); super(Utilities.actionsGlobalContext().lookupAll(BlackboardArtifact.class).size() > 1 ? "Tag Results" : "Tag Result");
} }
@Override @Override
protected void applyTag(String tagName, String comment) { protected void applyTag(String tagName, String comment) {
Collection<? extends BlackboardArtifact> selectedArtifacts = Utilities.actionsGlobalContext().lookupAll(BlackboardArtifact.class); Collection<? extends BlackboardArtifact> selectedArtifacts = Utilities.actionsGlobalContext().lookupAll(BlackboardArtifact.class);
for (BlackboardArtifact artifact : selectedArtifacts) { for (BlackboardArtifact artifact : selectedArtifacts) {
Tags.createTag(artifact, tagName, comment); Tags.createTag(artifact, tagName, comment);
} }
} }
} }
} }
Manifest-Version: 1.0 Manifest-Version: 1.0
AutoUpdate-Show-In-Client: true AutoUpdate-Show-In-Client: true
OpenIDE-Module: org.sleuthkit.autopsy.exifparser/3 OpenIDE-Module: org.sleuthkit.autopsy.exifparser/3
OpenIDE-Module-Implementation-Version: 9 OpenIDE-Module-Implementation-Version: 9
OpenIDE-Module-Layer: org/sleuthkit/autopsy/exifparser/layer.xml OpenIDE-Module-Layer: org/sleuthkit/autopsy/exifparser/layer.xml
OpenIDE-Module-Localizing-Bundle: org/sleuthkit/autopsy/exifparser/Bundle.properties OpenIDE-Module-Localizing-Bundle: org/sleuthkit/autopsy/exifparser/Bundle.properties
Manifest-Version: 1.0 Manifest-Version: 1.0
AutoUpdate-Show-In-Client: true AutoUpdate-Show-In-Client: true
OpenIDE-Module: org.sleuthkit.autopsy.hashdatabase/3 OpenIDE-Module: org.sleuthkit.autopsy.hashdatabase/3
OpenIDE-Module-Implementation-Version: 9 OpenIDE-Module-Implementation-Version: 9
OpenIDE-Module-Layer: org/sleuthkit/autopsy/hashdatabase/layer.xml OpenIDE-Module-Layer: org/sleuthkit/autopsy/hashdatabase/layer.xml
OpenIDE-Module-Localizing-Bundle: org/sleuthkit/autopsy/hashdatabase/Bundle.properties OpenIDE-Module-Localizing-Bundle: org/sleuthkit/autopsy/hashdatabase/Bundle.properties
javac.source=1.7 javac.source=1.7
javac.compilerargs=-Xlint -Xlint:-serial javac.compilerargs=-Xlint -Xlint:-serial
license.file=../LICENSE-2.0.txt license.file=../LICENSE-2.0.txt
nbm.homepage=http://www.sleuthkit.org/autopsy/ nbm.homepage=http://www.sleuthkit.org/autopsy/
nbm.needs.restart=true nbm.needs.restart=true
spec.version.base=1.3 spec.version.base=1.3
OpenIDE-Module-Display-Category=Ingest Module OpenIDE-Module-Display-Category=Ingest Module
OpenIDE-Module-Long-Description=\ OpenIDE-Module-Long-Description=\
Hash Database ingest module. \n\n\ Hash Database ingest module. \n\n\
The ingest module analyzes files in the disk image and marks them as "known" (based on NSRL database lookup for "known" files) and "bad / interesting" (based on one or more databases supplied by the user).\n\n\ The ingest module analyzes files in the disk image and marks them as "known" (based on NSRL database lookup for "known" files) and "bad / interesting" (based on one or more databases supplied by the user).\n\n\
The module also contains additional non-ingest tools that are integrated in the GUI, such as file lookup by hash and hash database configuration. The module also contains additional non-ingest tools that are integrated in the GUI, such as file lookup by hash and hash database configuration.
OpenIDE-Module-Name=HashDatabase OpenIDE-Module-Name=HashDatabase
HashDbSimplePanel.knownLabel.text=NSRL Database: HashDbSimplePanel.knownLabel.text=NSRL Database:
HashDbSimplePanel.notableLabel.text=Known Bad Database(s): HashDbSimplePanel.notableLabel.text=Known Bad Database(s):
HashDbSimplePanel.knownValLabel.text=- HashDbSimplePanel.knownValLabel.text=-
HashDbSimplePanel.notableValLabel.text=- HashDbSimplePanel.notableValLabel.text=-
HashDbSimplePanel.jLabel1.text=Enable known bad databases for ingest: HashDbSimplePanel.jLabel1.text=Enable known bad databases for ingest:
HashDbAddDatabaseDialog.cancelButton.text=Cancel HashDbAddDatabaseDialog.cancelButton.text=Cancel
HashDbAddDatabaseDialog.okButton.text=OK HashDbAddDatabaseDialog.okButton.text=OK
HashDbAddDatabaseDialog.nsrlRadioButton.text=NSRL HashDbAddDatabaseDialog.nsrlRadioButton.text=NSRL
HashDbAddDatabaseDialog.knownBadRadioButton.text=Known Bad HashDbAddDatabaseDialog.knownBadRadioButton.text=Known Bad
HashDbAddDatabaseDialog.databasePathTextField.text= HashDbAddDatabaseDialog.databasePathTextField.text=
HashDbAddDatabaseDialog.browseButton.text=Browse HashDbAddDatabaseDialog.browseButton.text=Browse
HashDbAddDatabaseDialog.jLabel1.text=Enter the name of the database: HashDbAddDatabaseDialog.jLabel1.text=Enter the name of the database:
HashDbAddDatabaseDialog.databaseNameTextField.text= HashDbAddDatabaseDialog.databaseNameTextField.text=
HashDbAddDatabaseDialog.jLabel2.text=Select the type of database: HashDbAddDatabaseDialog.jLabel2.text=Select the type of database:
HashDbAddDatabaseDialog.useForIngestCheckbox.text=Enable for ingest HashDbAddDatabaseDialog.useForIngestCheckbox.text=Enable for ingest
HashDbAddDatabaseDialog.sendInboxMessagesCheckbox.text=Enable sending messages to inbox during ingest HashDbAddDatabaseDialog.sendInboxMessagesCheckbox.text=Enable sending messages to inbox during ingest
HashDbSearchPanel.hashTable.columnModel.title0=MD5 Hashes HashDbSearchPanel.hashTable.columnModel.title0=MD5 Hashes
HashDbSearchPanel.hashTable.columnModel.title3=Title 4 HashDbSearchPanel.hashTable.columnModel.title3=Title 4
HashDbSearchPanel.hashTable.columnModel.title2=Title 3 HashDbSearchPanel.hashTable.columnModel.title2=Title 3
HashDbSearchPanel.hashTable.columnModel.title1=Title 2 HashDbSearchPanel.hashTable.columnModel.title1=Title 2
HashDbSearchPanel.addButton.text=Add Hash HashDbSearchPanel.addButton.text=Add Hash
HashDbSearchPanel.hashField.text= HashDbSearchPanel.hashField.text=
HashDbSearchPanel.hashLabel.text=MD5 hash: HashDbSearchPanel.hashLabel.text=MD5 hash:
HashDbSearchPanel.searchButton.text=Search HashDbSearchPanel.searchButton.text=Search
HashDbSearchPanel.removeButton.text=Remove Selected HashDbSearchPanel.removeButton.text=Remove Selected
HashDbSearchPanel.titleLabel.text=Search for files with the following MD5 hash(es): HashDbSearchPanel.titleLabel.text=Search for files with the following MD5 hash(es):
HashDbSearchPanel.errorField.text=Error: Not all files have been hashed. HashDbSearchPanel.errorField.text=Error: Not all files have been hashed.
HashDbSearchPanel.saveBox.text=Remember Hashes HashDbSearchPanel.saveBox.text=Remember Hashes
HashDbSearchPanel.cancelButton.text=Cancel HashDbSearchPanel.cancelButton.text=Cancel
HashDbSimplePanel.calcHashesButton.text=Calculate hashes even if no hash database is selected HashDbSimplePanel.calcHashesButton.text=Calculate hashes even if no hash database is selected
HashDbSimplePanel.nsrlDbLabel.text=NSRL Database: HashDbSimplePanel.nsrlDbLabel.text=NSRL Database:
HashDbSimplePanel.nsrlDbLabelVal.text=- HashDbSimplePanel.nsrlDbLabelVal.text=-
HashDbManagementPanel.hashDbIndexStatusLabel.text=No database selected HashDbManagementPanel.hashDbIndexStatusLabel.text=No database selected
HashDbManagementPanel.jLabel2.text=Name: HashDbManagementPanel.jLabel2.text=Name:
HashDbManagementPanel.showInboxMessagesCheckBox.text=Enable sending messages to inbox during ingest HashDbManagementPanel.showInboxMessagesCheckBox.text=Enable sending messages to inbox during ingest
HashDbManagementPanel.useForIngestCheckbox.text=Enable for ingest HashDbManagementPanel.useForIngestCheckbox.text=Enable for ingest
HashDbManagementPanel.indexButton.text=Index HashDbManagementPanel.indexButton.text=Index
HashDbManagementPanel.indexLabel.text=Index Status: HashDbManagementPanel.indexLabel.text=Index Status:
HashDbManagementPanel.optionsLabel.text=Options HashDbManagementPanel.optionsLabel.text=Options
HashDbManagementPanel.jLabel4.text=Location: HashDbManagementPanel.jLabel4.text=Location:
HashDbManagementPanel.jLabel6.text=Type: HashDbManagementPanel.jLabel6.text=Type:
HashDbManagementPanel.ingestWarningLabel.text=Ingest is ongoing, some settings will be unavailable until it finishes. HashDbManagementPanel.ingestWarningLabel.text=Ingest is ongoing, some settings will be unavailable until it finishes.
HashDbManagementPanel.hashDbTypeLabel.text=No database selected HashDbManagementPanel.hashDbTypeLabel.text=No database selected
HashDbManagementPanel.typeLabel.text=Type: HashDbManagementPanel.typeLabel.text=Type:
HashDbManagementPanel.deleteButton.text=Delete Database HashDbManagementPanel.deleteButton.text=Delete Database
HashDbManagementPanel.importButton.text=Import Database HashDbManagementPanel.importButton.text=Import Database
HashDbManagementPanel.hashDbNameLabel.text=No database selected HashDbManagementPanel.hashDbNameLabel.text=No database selected
HashDbManagementPanel.nameLabel.text=Name: HashDbManagementPanel.nameLabel.text=Name:
HashDbManagementPanel.jButton3.text=Import Database HashDbManagementPanel.jButton3.text=Import Database
HashDbManagementPanel.locationLabel.text=Location: HashDbManagementPanel.locationLabel.text=Location:
HashDbManagementPanel.hashDbLocationLabel.text=No database selected HashDbManagementPanel.hashDbLocationLabel.text=No database selected
HashDbManagementPanel.informationLabel.text=Information HashDbManagementPanel.informationLabel.text=Information
HashDbManagementPanel.hashDatabasesLabel.text=Hash Databases: HashDbManagementPanel.hashDatabasesLabel.text=Hash Databases:
OpenIDE-Module-Short-Description=Hash Database Ingest Module and hash db tools OpenIDE-Module-Short-Description=Hash Database Ingest Module and hash db tools
ModalNoButtons.CURRENTLYON_LABEL.text=Currently Indexing x of y ModalNoButtons.CURRENTLYON_LABEL.text=Currently Indexing x of y
ModalNoButtons.GO_GET_COFFEE_LABEL.text=Hash databases are currently being indexed, this may take some time. ModalNoButtons.GO_GET_COFFEE_LABEL.text=Hash databases are currently being indexed, this may take some time.
ModalNoButtons.CURRENTDB_LABEL.text=(CurrentDb) ModalNoButtons.CURRENTDB_LABEL.text=(CurrentDb)
ModalNoButtons.CANCEL_BUTTON.text=Cancel ModalNoButtons.CANCEL_BUTTON.text=Cancel
/* /*
* Autopsy Forensic Browser * Autopsy Forensic Browser
* *
* Copyright 2011 Basis Technology Corp. * Copyright 2011 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org * Contact: carrier <at> sleuthkit <dot> org
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
* You may obtain a copy of the License at * You may obtain a copy of the License at
* *
* http://www.apache.org/licenses/LICENSE-2.0 * http://www.apache.org/licenses/LICENSE-2.0
* *
* Unless required by applicable law or agreed to in writing, software * Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, * distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and * See the License for the specific language governing permissions and
* limitations under the License. * limitations under the License.
*/ */
package org.sleuthkit.autopsy.hashdatabase; package org.sleuthkit.autopsy.hashdatabase;
import java.beans.PropertyChangeListener; import java.beans.PropertyChangeListener;
import java.beans.PropertyChangeSupport; import java.beans.PropertyChangeSupport;
import java.io.File; import java.io.File;
import java.util.List; import java.util.List;
import java.util.logging.Level; import java.util.logging.Level;
import javax.swing.SwingWorker; import javax.swing.SwingWorker;
import org.netbeans.api.progress.ProgressHandle; import org.netbeans.api.progress.ProgressHandle;
import org.netbeans.api.progress.ProgressHandleFactory; import org.netbeans.api.progress.ProgressHandleFactory;
import org.openide.util.Cancellable; import org.openide.util.Cancellable;
import org.sleuthkit.autopsy.coreutils.Logger; import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.datamodel.SleuthkitJNI; import org.sleuthkit.datamodel.SleuthkitJNI;
import org.sleuthkit.datamodel.TskException; import org.sleuthkit.datamodel.TskException;
/** /**
* Hash database representation of NSRL and Known Bad hash databases * Hash database representation of NSRL and Known Bad hash databases
* with indexing capability * with indexing capability
* *
*/ */
public class HashDb implements Comparable<HashDb> { public class HashDb implements Comparable<HashDb> {
enum EVENT {INDEXING_DONE }; enum EVENT {INDEXING_DONE };
private final PropertyChangeSupport pcs = new PropertyChangeSupport(this); private final PropertyChangeSupport pcs = new PropertyChangeSupport(this);
public enum DBType{ public enum DBType{
NSRL("NSRL"), KNOWN_BAD("Known Bad"); NSRL("NSRL"), KNOWN_BAD("Known Bad");
private String displayName; private String displayName;
private DBType(String displayName) { private DBType(String displayName) {
this.displayName = displayName; this.displayName = displayName;
} }
public String getDisplayName() { public String getDisplayName() {
return this.displayName; return this.displayName;
} }
} }
// Suffix added to the end of a database name to get its index file // Suffix added to the end of a database name to get its index file
private static final String INDEX_SUFFIX = "-md5.idx"; private static final String INDEX_SUFFIX = "-md5.idx";
private String name; private String name;
private List<String> databasePaths; // TODO: Length limited to one for now... private List<String> databasePaths; // TODO: Length limited to one for now...
private boolean useForIngest; private boolean useForIngest;
private boolean showInboxMessages; private boolean showInboxMessages;
private boolean indexing; private boolean indexing;
private DBType type; private DBType type;
public HashDb(String name, List<String> databasePaths, boolean useForIngest, boolean showInboxMessages, DBType type) { public HashDb(String name, List<String> databasePaths, boolean useForIngest, boolean showInboxMessages, DBType type) {
this.name = name; this.name = name;
this.databasePaths = databasePaths; this.databasePaths = databasePaths;
this.useForIngest = useForIngest; this.useForIngest = useForIngest;
this.showInboxMessages = showInboxMessages; this.showInboxMessages = showInboxMessages;
this.type = type; this.type = type;
this.indexing = false; this.indexing = false;
} }
void addPropertyChangeListener(PropertyChangeListener pcl) { void addPropertyChangeListener(PropertyChangeListener pcl) {
pcs.addPropertyChangeListener(pcl); pcs.addPropertyChangeListener(pcl);
} }
void removePropertyChangeListener(PropertyChangeListener pcl) { void removePropertyChangeListener(PropertyChangeListener pcl) {
pcs.removePropertyChangeListener(pcl); pcs.removePropertyChangeListener(pcl);
} }
boolean getUseForIngest() { boolean getUseForIngest() {
return useForIngest; return useForIngest;
} }
boolean getShowInboxMessages() { boolean getShowInboxMessages() {
return showInboxMessages; return showInboxMessages;
} }
DBType getDbType() { DBType getDbType() {
return type; return type;
} }
String getName() { String getName() {
return name; return name;
} }
List<String> getDatabasePaths() { List<String> getDatabasePaths() {
return databasePaths; return databasePaths;
} }
void setUseForIngest(boolean useForIngest) { void setUseForIngest(boolean useForIngest) {
this.useForIngest = useForIngest; this.useForIngest = useForIngest;
} }
void setShowInboxMessages(boolean showInboxMessages) { void setShowInboxMessages(boolean showInboxMessages) {
this.showInboxMessages = showInboxMessages; this.showInboxMessages = showInboxMessages;
} }
void setName(String name) { void setName(String name) {
this.name = name; this.name = name;
} }
void setDatabasePaths(List<String> databasePaths) { void setDatabasePaths(List<String> databasePaths) {
this.databasePaths = databasePaths; this.databasePaths = databasePaths;
} }
void setDbType(DBType type) { void setDbType(DBType type) {
this.type = type; this.type = type;
} }
/** /**
* Checks if the database exists. * Checks if the database exists.
* @return true if a file exists at the database path, else false * @return true if a file exists at the database path, else false
*/ */
boolean databaseExists() { boolean databaseExists() {
return databaseFile().exists(); return databaseFile().exists();
} }
/** /**
* Checks if Sleuth Kit can open the index for the database path. * Checks if Sleuth Kit can open the index for the database path.
* @return true if the index was found and opened successfully, else false * @return true if the index was found and opened successfully, else false
*/ */
boolean indexExists() { boolean indexExists() {
try { try {
return hasIndex(databasePaths.get(0)); // TODO: support multiple paths return hasIndex(databasePaths.get(0)); // TODO: support multiple paths
} catch (TskException ex) { } catch (TskException ex) {
Logger.getLogger(this.getClass().getName()).log(Level.WARNING, "Error checking if index exists.", ex); Logger.getLogger(this.getClass().getName()).log(Level.WARNING, "Error checking if index exists.", ex);
return false; return false;
} }
} }
/** /**
* Gets the database file. * Gets the database file.
* @return a File initialized with the database path * @return a File initialized with the database path
*/ */
File databaseFile() { File databaseFile() {
return new File(databasePaths.get(0)); // TODO: support multiple paths return new File(databasePaths.get(0)); // TODO: support multiple paths
} }
/** /**
* Gets the index file * Gets the index file
* @return a File initialized with an index path derived from the database * @return a File initialized with an index path derived from the database
* path * path
*/ */
File indexFile() { File indexFile() {
return new File(toIndexPath(databasePaths.get(0))); // TODO: support multiple paths return new File(toIndexPath(databasePaths.get(0))); // TODO: support multiple paths
} }
/** /**
* Checks if the index file is older than the database file * Checks if the index file is older than the database file
* @return true if there is are files at the index path and the database * @return true if there is are files at the index path and the database
* path, and the index file has an older modified-time than the database * path, and the index file has an older modified-time than the database
* file, else false * file, else false
*/ */
boolean isOutdated() { boolean isOutdated() {
File i = indexFile(); File i = indexFile();
File db = databaseFile(); File db = databaseFile();
return i.exists() && db.exists() && isOlderThan(i, db); return i.exists() && db.exists() && isOlderThan(i, db);
} }
/** /**
* Checks if the database is being indexed * Checks if the database is being indexed
*/ */
boolean isIndexing() { boolean isIndexing() {
return indexing; return indexing;
} }
/** /**
* Returns the status of the HashDb as determined from indexExists(), * Returns the status of the HashDb as determined from indexExists(),
* databaseExists(), and isOutdated() * databaseExists(), and isOutdated()
* @return IndexStatus enum according to their definitions * @return IndexStatus enum according to their definitions
*/ */
IndexStatus status() { IndexStatus status() {
boolean i = this.indexExists(); boolean i = this.indexExists();
boolean db = this.databaseExists(); boolean db = this.databaseExists();
if(indexing) if(indexing)
return IndexStatus.INDEXING; return IndexStatus.INDEXING;
if (i) { if (i) {
if (db) { if (db) {
return this.isOutdated() ? IndexStatus.INDEX_OUTDATED : IndexStatus.INDEX_CURRENT; return this.isOutdated() ? IndexStatus.INDEX_OUTDATED : IndexStatus.INDEX_CURRENT;
} else { } else {
return IndexStatus.NO_DB; return IndexStatus.NO_DB;
} }
} else { } else {
return db ? IndexStatus.NO_INDEX : IndexStatus.NONE; return db ? IndexStatus.NO_INDEX : IndexStatus.NONE;
} }
} }
/** /**
* Tries to index the database (overwrites any existing index) * Tries to index the database (overwrites any existing index)
* @throws TskException if an error occurs in the SleuthKit bindings * @throws TskException if an error occurs in the SleuthKit bindings
*/ */
void createIndex() throws TskException { void createIndex() throws TskException {
indexing = true; indexing = true;
CreateIndex creator = new CreateIndex(); CreateIndex creator = new CreateIndex();
creator.execute(); creator.execute();
} }
/** /**
* Checks if one file is older than an other * Checks if one file is older than an other
* @param a first file * @param a first file
* @param b second file * @param b second file
* @return true if the first file's last modified data is before the second * @return true if the first file's last modified data is before the second
* file's last modified date * file's last modified date
*/ */
private static boolean isOlderThan(File a, File b) { private static boolean isOlderThan(File a, File b) {
return a.lastModified() < b.lastModified(); return a.lastModified() < b.lastModified();
} }
/** /**
* Determines if a path points to an index by checking the suffix * Determines if a path points to an index by checking the suffix
* @param path * @param path
* @return true if index * @return true if index
*/ */
static boolean isIndexPath(String path) { static boolean isIndexPath(String path) {
return path.endsWith(INDEX_SUFFIX); return path.endsWith(INDEX_SUFFIX);
} }
/** /**
* Derives database path from an image path by removing the suffix. * Derives database path from an image path by removing the suffix.
* @param indexPath * @param indexPath
* @return * @return
*/ */
static String toDatabasePath(String indexPath) { static String toDatabasePath(String indexPath) {
return indexPath.substring(0, indexPath.lastIndexOf(INDEX_SUFFIX)); return indexPath.substring(0, indexPath.lastIndexOf(INDEX_SUFFIX));
} }
/** /**
* Derives image path from an database path by appending the suffix. * Derives image path from an database path by appending the suffix.
* @param databasePath * @param databasePath
* @return * @return
*/ */
static String toIndexPath(String databasePath) { static String toIndexPath(String databasePath) {
return databasePath.concat(INDEX_SUFFIX); return databasePath.concat(INDEX_SUFFIX);
} }
/** /**
* Calls Sleuth Kit method via JNI to determine whether there is an * Calls Sleuth Kit method via JNI to determine whether there is an
* index for the given path * index for the given path
* @param databasePath path Path for the database the index is of * @param databasePath path Path for the database the index is of
* (database doesn't have to actually exist)' * (database doesn't have to actually exist)'
* @return true if index exists * @return true if index exists
* @throws TskException if there is an error in the JNI call * @throws TskException if there is an error in the JNI call
*/ */
static boolean hasIndex(String databasePath) throws TskException { static boolean hasIndex(String databasePath) throws TskException {
return SleuthkitJNI.lookupIndexExists(databasePath); return SleuthkitJNI.lookupIndexExists(databasePath);
} }
@Override @Override
public int compareTo(HashDb o) { public int compareTo(HashDb o) {
return this.name.compareTo(o.name); return this.name.compareTo(o.name);
} }
/* Thread that creates a database's index */ /* Thread that creates a database's index */
private class CreateIndex extends SwingWorker<Object,Void> { private class CreateIndex extends SwingWorker<Object,Void> {
private ProgressHandle progress; private ProgressHandle progress;
CreateIndex(){}; CreateIndex(){};
@Override @Override
protected Object doInBackground() throws Exception { protected Object doInBackground() throws Exception {
progress = ProgressHandleFactory.createHandle("Indexing " + name); progress = ProgressHandleFactory.createHandle("Indexing " + name);
/** We need proper cancel support in TSK to make the task cancellable /** We need proper cancel support in TSK to make the task cancellable
new Cancellable() { new Cancellable() {
Override Override
public boolean cancel() { public boolean cancel() {
return CreateIndex.this.cancel(true); return CreateIndex.this.cancel(true);
} }
}); });
*/ */
progress.start(); progress.start();
progress.switchToIndeterminate(); progress.switchToIndeterminate();
SleuthkitJNI.createLookupIndex(databasePaths.get(0)); SleuthkitJNI.createLookupIndex(databasePaths.get(0));
return null; return null;
} }
/* clean up or start the worker threads */ /* clean up or start the worker threads */
@Override @Override
protected void done() { protected void done() {
indexing = false; indexing = false;
progress.finish(); progress.finish();
pcs.firePropertyChange(EVENT.INDEXING_DONE.toString(), null, name); pcs.firePropertyChange(EVENT.INDEXING_DONE.toString(), null, name);
} }
} }
} }
\ No newline at end of file
Manifest-Version: 1.0 Manifest-Version: 1.0
AutoUpdate-Show-In-Client: true AutoUpdate-Show-In-Client: true
OpenIDE-Module: org.sleuthkit.autopsy.keywordsearch/5 OpenIDE-Module: org.sleuthkit.autopsy.keywordsearch/5
OpenIDE-Module-Implementation-Version: 9 OpenIDE-Module-Implementation-Version: 9
OpenIDE-Module-Install: org/sleuthkit/autopsy/keywordsearch/Installer.class OpenIDE-Module-Install: org/sleuthkit/autopsy/keywordsearch/Installer.class
OpenIDE-Module-Layer: org/sleuthkit/autopsy/keywordsearch/layer.xml OpenIDE-Module-Layer: org/sleuthkit/autopsy/keywordsearch/layer.xml
OpenIDE-Module-Localizing-Bundle: org/sleuthkit/autopsy/keywordsearch/Bundle.properties OpenIDE-Module-Localizing-Bundle: org/sleuthkit/autopsy/keywordsearch/Bundle.properties
OpenIDE-Module-Requires: org.openide.windows.WindowManager OpenIDE-Module-Requires: org.openide.windows.WindowManager
javac.source=1.7 javac.source=1.7
javac.compilerargs=-Xlint -Xlint:-serial javac.compilerargs=-Xlint -Xlint:-serial
license.file=../LICENSE-2.0.txt license.file=../LICENSE-2.0.txt
nbm.homepage=http://www.sleuthkit.org/autopsy/ nbm.homepage=http://www.sleuthkit.org/autopsy/
nbm.needs.restart=true nbm.needs.restart=true
spec.version.base=3.2 spec.version.base=3.2
OpenIDE-Module-Display-Category=Ingest Module OpenIDE-Module-Display-Category=Ingest Module
OpenIDE-Module-Long-Description=\ OpenIDE-Module-Long-Description=\
Keyword Search ingest module.\n\n\ Keyword Search ingest module.\n\n\
The module indexes files found in the disk image at ingest time. \ The module indexes files found in the disk image at ingest time. \
It then periodically runs the search on the indexed files using one or more keyword lists (containing pure words and/or regular expressions) and posts results.\n\n\ It then periodically runs the search on the indexed files using one or more keyword lists (containing pure words and/or regular expressions) and posts results.\n\n\
The module also contains additional tools integrated in the main GUI, such as keyword list configuration, keyword seach bar in the top-right corner, extracted text viewer and search results viewer showing highlighted keywords found. The module also contains additional tools integrated in the main GUI, such as keyword list configuration, keyword seach bar in the top-right corner, extracted text viewer and search results viewer showing highlighted keywords found.
OpenIDE-Module-Name=KeywordSearch OpenIDE-Module-Name=KeywordSearch
ListBundleName=Keyword Lists ListBundleName=Keyword Lists
ListBundleConfig=Keyword List Configuration ListBundleConfig=Keyword List Configuration
IndexProgressPanel.statusText.text=Status text IndexProgressPanel.statusText.text=Status text
IndexProgressPanel.cancelButton.text=Cancel IndexProgressPanel.cancelButton.text=Cancel
ExtractedContentPanel.hitLabel.text=Matches on page: ExtractedContentPanel.hitLabel.text=Matches on page:
ExtractedContentPanel.hitCountLabel.text=- ExtractedContentPanel.hitCountLabel.text=-
ExtractedContentPanel.hitOfLabel.text=of ExtractedContentPanel.hitOfLabel.text=of
ExtractedContentPanel.hitTotalLabel.text=- ExtractedContentPanel.hitTotalLabel.text=-
ExtractedContentPanel.hitButtonsLabel.text=Match ExtractedContentPanel.hitButtonsLabel.text=Match
ExtractedContentPanel.hitPreviousButton.text= ExtractedContentPanel.hitPreviousButton.text=
ExtractedContentPanel.hitNextButton.text= ExtractedContentPanel.hitNextButton.text=
ExtractedContentPanel.copyMenuItem.text=Copy ExtractedContentPanel.copyMenuItem.text=Copy
ExtractedContentPanel.selectAllMenuItem.text=Select All ExtractedContentPanel.selectAllMenuItem.text=Select All
KeywordSearchEditListPanel.saveListButton.text=Copy List KeywordSearchEditListPanel.saveListButton.text=Copy List
KeywordSearchEditListPanel.addWordField.text= KeywordSearchEditListPanel.addWordField.text=
KeywordSearchEditListPanel.addWordButton.text=Add KeywordSearchEditListPanel.addWordButton.text=Add
KeywordSearchEditListPanel.chRegex.text=Regular Expression KeywordSearchEditListPanel.chRegex.text=Regular Expression
KeywordSearchEditListPanel.deleteWordButton.text=Remove Selected KeywordSearchEditListPanel.deleteWordButton.text=Remove Selected
KeywordSearchEditListPanel.cutMenuItem.text=Cut KeywordSearchEditListPanel.cutMenuItem.text=Cut
KeywordSearchEditListPanel.selectAllMenuItem.text=Select All KeywordSearchEditListPanel.selectAllMenuItem.text=Select All
KeywordSearchEditListPanel.pasteMenuItem.text=Paste KeywordSearchEditListPanel.pasteMenuItem.text=Paste
KeywordSearchEditListPanel.copyMenuItem.text=Copy KeywordSearchEditListPanel.copyMenuItem.text=Copy
KeywordSearchEditListPanel.exportButton.text=Export List KeywordSearchEditListPanel.exportButton.text=Export List
KeywordSearchEditListPanel.deleteListButton.text=Delete List KeywordSearchEditListPanel.deleteListButton.text=Delete List
KeywordSearchListsManagementPanel.newListButton.text=New List KeywordSearchListsManagementPanel.newListButton.text=New List
KeywordSearchEditListPanel.useForIngestCheckbox.text=Enable for ingest KeywordSearchEditListPanel.useForIngestCheckbox.text=Enable for ingest
KeywordSearchListsManagementPanel.importButton.text=Import List KeywordSearchListsManagementPanel.importButton.text=Import List
KeywordSearchPanel.searchBox.text=Search... KeywordSearchPanel.searchBox.text=Search...
KeywordSearchPanel.regExCheckboxMenuItem.text=Use Regular Expressions KeywordSearchPanel.regExCheckboxMenuItem.text=Use Regular Expressions
KeywordSearchPanel.settingsLabel.text= KeywordSearchPanel.settingsLabel.text=
KeywordSearchListsViewerPanel.searchAddButton.text=Search KeywordSearchListsViewerPanel.searchAddButton.text=Search
KeywordSearchListsViewerPanel.manageListsButton.text=Manage Lists KeywordSearchListsViewerPanel.manageListsButton.text=Manage Lists
KeywordSearchListsViewerPanel.ingestIndexLabel.text=Files Indexed: KeywordSearchListsViewerPanel.ingestIndexLabel.text=Files Indexed:
KeywordSearchEditListPanel.selectorsCombo.toolTipText=Regular Expression selector type (optional) KeywordSearchEditListPanel.selectorsCombo.toolTipText=Regular Expression selector type (optional)
KeywordSearchPanel.searchButton.text= KeywordSearchPanel.searchButton.text=
KeywordSearchPanel.cutMenuItem.text=Cut KeywordSearchPanel.cutMenuItem.text=Cut
KeywordSearchPanel.copyMenuItem.text=Copy KeywordSearchPanel.copyMenuItem.text=Copy
KeywordSearchPanel.pasteMenuItem.text=Paste KeywordSearchPanel.pasteMenuItem.text=Paste
KeywordSearchPanel.selectAllMenuItem.text=Select All KeywordSearchPanel.selectAllMenuItem.text=Select All
ExtractedContentPanel.pageButtonsLabel.text=Page ExtractedContentPanel.pageButtonsLabel.text=Page
ExtractedContentPanel.pageNextButton.text= ExtractedContentPanel.pageNextButton.text=
ExtractedContentPanel.pagePreviousButton.actionCommand=pagePreviousButton ExtractedContentPanel.pagePreviousButton.actionCommand=pagePreviousButton
ExtractedContentPanel.pagePreviousButton.text= ExtractedContentPanel.pagePreviousButton.text=
ExtractedContentPanel.pagesLabel.text=Page: ExtractedContentPanel.pagesLabel.text=Page:
ExtractedContentPanel.pageOfLabel.text=of ExtractedContentPanel.pageOfLabel.text=of
ExtractedContentPanel.pageCurLabel.text=- ExtractedContentPanel.pageCurLabel.text=-
ExtractedContentPanel.pageTotalLabel.text=- ExtractedContentPanel.pageTotalLabel.text=-
ExtractedContentPanel.hitLabel.toolTipText= ExtractedContentPanel.hitLabel.toolTipText=
KeywordSearchEditListPanel.ingestMessagesCheckbox.text=Enable sending messages to inbox during ingest KeywordSearchEditListPanel.ingestMessagesCheckbox.text=Enable sending messages to inbox during ingest
KeywordSearchEditListPanel.ingestMessagesCheckbox.toolTipText=Send messages during triage / ingest when hits on keyword from this list occur KeywordSearchEditListPanel.ingestMessagesCheckbox.toolTipText=Send messages during triage / ingest when hits on keyword from this list occur
KeywordSearchConfigurationPanel2.skipNSRLCheckBox.text=Do not add files in NSRL (known files) to keyword index during ingest KeywordSearchConfigurationPanel2.skipNSRLCheckBox.text=Do not add files in NSRL (known files) to keyword index during ingest
KeywordSearchConfigurationPanel2.skipNSRLCheckBox.toolTipText=Requires Hash DB service to had run previously, or be selected for next ingest. KeywordSearchConfigurationPanel2.skipNSRLCheckBox.toolTipText=Requires Hash DB service to had run previously, or be selected for next ingest.
KeywordSearchConfigurationPanel2.filesIndexedValue.text=- KeywordSearchConfigurationPanel2.filesIndexedValue.text=-
KeywordSearchConfigurationPanel2.filesIndexedLabel.text=Files in keyword index: KeywordSearchConfigurationPanel2.filesIndexedLabel.text=Files in keyword index:
KeywordSearchIngestSimplePanel.languagesLabel.text=Scripts enabled for string extraction from unknown file types: KeywordSearchIngestSimplePanel.languagesLabel.text=Scripts enabled for string extraction from unknown file types:
KeywordSearchIngestSimplePanel.languagesValLabel.text=- KeywordSearchIngestSimplePanel.languagesValLabel.text=-
KeywordSearchIngestSimplePanel.languagesLabel.toolTipText=Scripts enabled for string extraction from unknown file types. Changes can be done in Advanced Settings. KeywordSearchIngestSimplePanel.languagesLabel.toolTipText=Scripts enabled for string extraction from unknown file types. Changes can be done in Advanced Settings.
KeywordSearchIngestSimplePanel.languagesValLabel.toolTipText= KeywordSearchIngestSimplePanel.languagesValLabel.toolTipText=
KeywordSearchConfigurationPanel3.languagesLabel.text=Enabled scripts (languages): KeywordSearchConfigurationPanel3.languagesLabel.text=Enabled scripts (languages):
KeywordSearchConfigurationPanel2.chunksLabel.text=Chunks in keyword index: KeywordSearchConfigurationPanel2.chunksLabel.text=Chunks in keyword index:
KeywordSearchConfigurationPanel2.chunksValLabel.text=- KeywordSearchConfigurationPanel2.chunksValLabel.text=-
KeywordSearchConfigurationPanel3.enableUTF8Checkbox.text=Enable UTF8 text extraction KeywordSearchConfigurationPanel3.enableUTF8Checkbox.text=Enable UTF8 text extraction
KeywordSearchConfigurationPanel3.enableUTF16Checkbox.text=Enable UTF16LE and UTF16BE string extraction KeywordSearchConfigurationPanel3.enableUTF16Checkbox.text=Enable UTF16LE and UTF16BE string extraction
KeywordSearchEditListPanel.keywordOptionsLabel.text=Keyword Options KeywordSearchEditListPanel.keywordOptionsLabel.text=Keyword Options
KeywordSearchEditListPanel.listOptionsLabel.text=List Options KeywordSearchEditListPanel.listOptionsLabel.text=List Options
KeywordSearchConfigurationPanel3.ingestSettingsLabel.text=Ingest settings for string extraction from unknown file types (changes effective on next ingest): KeywordSearchConfigurationPanel3.ingestSettingsLabel.text=Ingest settings for string extraction from unknown file types (changes effective on next ingest):
KeywordSearchConfigurationPanel2.settingsLabel.text=Settings KeywordSearchConfigurationPanel2.settingsLabel.text=Settings
KeywordSearchConfigurationPanel2.informationLabel.text=Information KeywordSearchConfigurationPanel2.informationLabel.text=Information
KeywordSearchListsManagementPanel.keywordListsLabel.text=Keyword Lists: KeywordSearchListsManagementPanel.keywordListsLabel.text=Keyword Lists:
KeywordSearchEditListPanel.keywordsLabel.text=Keywords: KeywordSearchEditListPanel.keywordsLabel.text=Keywords:
KeywordSearchConfigurationPanel2.timeRadioButton1.toolTipText=20 mins. (fastest ingest time) KeywordSearchConfigurationPanel2.timeRadioButton1.toolTipText=20 mins. (fastest ingest time)
KeywordSearchConfigurationPanel2.timeRadioButton1.text=20 minutes (slowest feedback, fastest ingest) KeywordSearchConfigurationPanel2.timeRadioButton1.text=20 minutes (slowest feedback, fastest ingest)
KeywordSearchConfigurationPanel2.timeRadioButton2.toolTipText=10 minutes (faster overall ingest time than default) KeywordSearchConfigurationPanel2.timeRadioButton2.toolTipText=10 minutes (faster overall ingest time than default)
KeywordSearchConfigurationPanel2.timeRadioButton2.text=10 minutes (slower feedback, faster ingest) KeywordSearchConfigurationPanel2.timeRadioButton2.text=10 minutes (slower feedback, faster ingest)
KeywordSearchConfigurationPanel2.timeRadioButton3.toolTipText=5 minutes (overall ingest time will be longer) KeywordSearchConfigurationPanel2.timeRadioButton3.toolTipText=5 minutes (overall ingest time will be longer)
KeywordSearchConfigurationPanel2.timeRadioButton3.text=5 minutes (default) KeywordSearchConfigurationPanel2.timeRadioButton3.text=5 minutes (default)
KeywordSearchIngestSimplePanel.encodingsLabel.text=Encodings: KeywordSearchIngestSimplePanel.encodingsLabel.text=Encodings:
KeywordSearchIngestSimplePanel.keywordSearchEncodings.text=- KeywordSearchIngestSimplePanel.keywordSearchEncodings.text=-
KeywordSearchIngestSimplePanel.titleLabel.text=Select keyword lists to enable during ingest: KeywordSearchIngestSimplePanel.titleLabel.text=Select keyword lists to enable during ingest:
OpenIDE-Module-Short-Description=Keyword Search ingest module, extracted text viewer and keyword search tools OpenIDE-Module-Short-Description=Keyword Search ingest module, extracted text viewer and keyword search tools
KeywordSearchListsViewerPanel.manageListsButton.toolTipText=Manage keyword lists, their settings and associated keywords. The settings are shared among all cases. KeywordSearchListsViewerPanel.manageListsButton.toolTipText=Manage keyword lists, their settings and associated keywords. The settings are shared among all cases.
KeywordSearchConfigurationPanel2.frequencyLabel.text=Results update frequency during ingest: KeywordSearchConfigurationPanel2.frequencyLabel.text=Results update frequency during ingest:
KeywordSearchConfigurationPanel2.timeRadioButton4.text_1=1 minute (faster feedback, longest ingest) KeywordSearchConfigurationPanel2.timeRadioButton4.text_1=1 minute (faster feedback, longest ingest)
KeywordSearchConfigurationPanel2.timeRadioButton4.toolTipText=1 minute (overall ingest time will be longest) KeywordSearchConfigurationPanel2.timeRadioButton4.toolTipText=1 minute (overall ingest time will be longest)
<!-- <!--
Autopsy Forensic Browser Autopsy Forensic Browser
Copyright 2011 Basis Technology Corp. Copyright 2011 Basis Technology Corp.
Contact: carrier <at> sleuthkit <dot> org Contact: carrier <at> sleuthkit <dot> org
Licensed under the Apache License, Version 2.0 (the "License"); Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License. you may not use this file except in compliance with the License.
You may obtain a copy of the License at You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0 http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS, distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and See the License for the specific language governing permissions and
limitations under the License. limitations under the License.
--> -->
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html> <html>
<head> <head>
<title>Keyword Search</title> <title>Keyword Search</title>
<link rel="stylesheet" href="nbdocs:/org/sleuthkit/autopsy/core/docs/ide.css" type="text/css"> <link rel="stylesheet" href="nbdocs:/org/sleuthkit/autopsy/core/docs/ide.css" type="text/css">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head> </head>
<body> <body>
<h2>Keyword Search</h2> <h2>Keyword Search</h2>
<p> <p>
Autopsy ships a keyword search module, which provides the <a href="nbdocs:/org/sleuthkit/autopsy/ingest/docs/ingest-about.html">ingest capability</a> Autopsy ships a keyword search module, which provides the <a href="nbdocs:/org/sleuthkit/autopsy/ingest/docs/ingest-about.html">ingest capability</a>
and also supports a manual text search mode. and also supports a manual text search mode.
</p> </p>
<p>The keyword search ingest module extracts text from the files on the image being ingested and adds them to the index that can then be searched.</p> <p>The keyword search ingest module extracts text from the files on the image being ingested and adds them to the index that can then be searched.</p>
<p> <p>
Autopsy tries its best to extract maximum amount of text from the files being indexed. Autopsy tries its best to extract maximum amount of text from the files being indexed.
First, the indexing will try to extract text from supported file formats, such as pure text file format, MS Office Documents, PDF files, Email files, and many others. First, the indexing will try to extract text from supported file formats, such as pure text file format, MS Office Documents, PDF files, Email files, and many others.
If the file is not supported by the standard text extractor, Autopsy will fallback to string extraction algorithm. If the file is not supported by the standard text extractor, Autopsy will fallback to string extraction algorithm.
String extraction on unknown file formats or arbitrary binary files can often still extract a good amount of text from the file, often good enough to provide additional clues. String extraction on unknown file formats or arbitrary binary files can often still extract a good amount of text from the file, often good enough to provide additional clues.
However, string extraction will not be able to extract text strings from binary files that have been encrypted. However, string extraction will not be able to extract text strings from binary files that have been encrypted.
</p> </p>
<p> <p>
Autopsy ships with some built-in lists that define regular expressions and enable user to search for Phone Numbers, IP addresses, URLs and E-mail addresses. Autopsy ships with some built-in lists that define regular expressions and enable user to search for Phone Numbers, IP addresses, URLs and E-mail addresses.
However, enabling some of these very general lists can produce a very large number of hits, many of them can be false-positives. However, enabling some of these very general lists can produce a very large number of hits, many of them can be false-positives.
</p> </p>
<p> <p>
Once files are in the index, they can be searched quickly for specific keywords, regular expressions, Once files are in the index, they can be searched quickly for specific keywords, regular expressions,
or using keyword search lists that can contain a mixture of keywords and regular expressions. or using keyword search lists that can contain a mixture of keywords and regular expressions.
Search queries can be executed automatically by the ingest during the ingest run, or at the end of the ingest, depending on the current settings and the time it takes to ingest the image. Search queries can be executed automatically by the ingest during the ingest run, or at the end of the ingest, depending on the current settings and the time it takes to ingest the image.
</p> </p>
<p>Search queries can also be executed manually by the user at any time, as long as there are some files already indexed and ready to be searched.</p> <p>Search queries can also be executed manually by the user at any time, as long as there are some files already indexed and ready to be searched.</p>
<p> <p>
Keyword search module will save the search results regardless whether the search is performed by the ingest process, or manually by the user. Keyword search module will save the search results regardless whether the search is performed by the ingest process, or manually by the user.
The saved results are available in the Directory Tree in the left hand side panel. The saved results are available in the Directory Tree in the left hand side panel.
</p> </p>
<p> <p>
To see keyword search results in real-time while ingest is running, add keyword lists using the To see keyword search results in real-time while ingest is running, add keyword lists using the
<a href="nbdocs:/org/sleuthkit/autopsy/keywordsearch/docs/keywordsearch-configuration.html">Keyword Search Configuration Dialog</a> <a href="nbdocs:/org/sleuthkit/autopsy/keywordsearch/docs/keywordsearch-configuration.html">Keyword Search Configuration Dialog</a>
and select the "Use during ingest" check box. and select the "Use during ingest" check box.
You can select "Enable sending messages to inbox during ingest" per list, if the hits on that list should be reported in the Inbox, which is recommended for very specific searches. You can select "Enable sending messages to inbox during ingest" per list, if the hits on that list should be reported in the Inbox, which is recommended for very specific searches.
</p> </p>
<p> <p>
See <a href="nbdocs:/org/sleuthkit/autopsy/ingest/docs/ingest-about.html">(Ingest)</a> See <a href="nbdocs:/org/sleuthkit/autopsy/ingest/docs/ingest-about.html">(Ingest)</a>
for more information on ingest in general. for more information on ingest in general.
</p> </p>
<p> <p>
Once there are files in the index, the <a href="nbdocs:/org/sleuthkit/autopsy/keywordsearch/docs/keywordsearch-bar.html">Keyword Search Bar</a> Once there are files in the index, the <a href="nbdocs:/org/sleuthkit/autopsy/keywordsearch/docs/keywordsearch-bar.html">Keyword Search Bar</a>
will be available for use to manually search at any time. will be available for use to manually search at any time.
</p> </p>
</body> </body>
</html> </html>
<!-- <!--
Tip: to create a link which will open in an external web browser, try: Tip: to create a link which will open in an external web browser, try:
<object classid="java:org.netbeans.modules.javahelp.BrowserDisplayer"> <object classid="java:org.netbeans.modules.javahelp.BrowserDisplayer">
<param name="content" value="http://www.netbeans.org/"> <param name="content" value="http://www.netbeans.org/">
<param name="text" value="<html><u>http://www.netbeans.org/</u></html>"> <param name="text" value="<html><u>http://www.netbeans.org/</u></html>">
<param name="textFontSize" value="medium"> <param name="textFontSize" value="medium">
<param name="textColor" value="blue"> <param name="textColor" value="blue">
</object> </object>
To create a link to a help set from another module, you need to know the code name base and path, e.g.: To create a link to a help set from another module, you need to know the code name base and path, e.g.:
<a href="nbdocs://org.netbeans.modules.usersguide/org/netbeans/modules/usersguide/configure/configure_options.html">Using the Options Window</a> <a href="nbdocs://org.netbeans.modules.usersguide/org/netbeans/modules/usersguide/configure/configure_options.html">Using the Options Window</a>
(This link will behave sanely if that module is disabled or missing.) (This link will behave sanely if that module is disabled or missing.)
--> -->
Manifest-Version: 1.0 Manifest-Version: 1.0
OpenIDE-Module: org.sleuthkit.autopsy.recentactivity/5 OpenIDE-Module: org.sleuthkit.autopsy.recentactivity/5
OpenIDE-Module-Implementation-Version: 9 OpenIDE-Module-Implementation-Version: 9
OpenIDE-Module-Layer: org/sleuthkit/autopsy/recentactivity/layer.xml OpenIDE-Module-Layer: org/sleuthkit/autopsy/recentactivity/layer.xml
OpenIDE-Module-Localizing-Bundle: org/sleuthkit/autopsy/recentactivity/Bundle.properties OpenIDE-Module-Localizing-Bundle: org/sleuthkit/autopsy/recentactivity/Bundle.properties
OpenIDE-Module-Requires: OpenIDE-Module-Requires:
org.openide.modules.InstalledFileLocator, org.openide.modules.InstalledFileLocator,
org.openide.windows.TopComponent$Registry, org.openide.windows.TopComponent$Registry,
org.openide.windows.WindowManager org.openide.windows.WindowManager
file.reference.gson-2.1.jar=release/modules/ext/gson-2.1.jar file.reference.gson-2.1.jar=release/modules/ext/gson-2.1.jar
javac.source=1.7 javac.source=1.7
javac.compilerargs=-Xlint -Xlint:-serial javac.compilerargs=-Xlint -Xlint:-serial
license.file=../LICENSE-2.0.txt license.file=../LICENSE-2.0.txt
nbm.homepage=http://www.sleuthkit.org/autopsy/ nbm.homepage=http://www.sleuthkit.org/autopsy/
nbm.needs.restart=true nbm.needs.restart=true
spec.version.base=3.0 spec.version.base=3.0
Manifest-Version: 1.0 Manifest-Version: 1.0
OpenIDE-Module: org.sleuthkit.autopsy.sevenzip/1 OpenIDE-Module: org.sleuthkit.autopsy.sevenzip/1
OpenIDE-Module-Implementation-Version: 3 OpenIDE-Module-Implementation-Version: 3
OpenIDE-Module-Localizing-Bundle: org/sleuthkit/autopsy/sevenzip/Bundle.properties OpenIDE-Module-Localizing-Bundle: org/sleuthkit/autopsy/sevenzip/Bundle.properties
Manifest-Version: 1.0 Manifest-Version: 1.0
AutoUpdate-Show-In-Client: false AutoUpdate-Show-In-Client: false
OpenIDE-Module: org.sleuthkit.autopsy.testing/3 OpenIDE-Module: org.sleuthkit.autopsy.testing/3
OpenIDE-Module-Implementation-Version: 7 OpenIDE-Module-Implementation-Version: 7
OpenIDE-Module-Localizing-Bundle: org/sleuthkit/autopsy/testing/Bundle.properties OpenIDE-Module-Localizing-Bundle: org/sleuthkit/autopsy/testing/Bundle.properties
OpenIDE-Module-Name=Testing OpenIDE-Module-Name=Testing
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment