Skip to content

Commit 1c682a3

Browse files
rcordovanorcordovano
authored
Merge pull request #3429 from rishwanth1995/photorec2
Modified photorec and regripper modules in autopsy to work on linux
2 parents 43bde93 + 62f7063 commit 1c682a3

File tree

32 files changed

+11622
-27
lines changed

32 files changed

+11622
-27
lines changed

‎Core/src/org/sleuthkit/autopsy/modules/photoreccarver/PhotoRecCarverFileIngestModule.java‎

Lines changed: 29 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@
3737
import java.util.concurrent.atomic.AtomicLong;
3838
import java.util.logging.Level;
3939
import org.openide.modules.InstalledFileLocator;
40+
import org.openide.util.Exceptions;
4041
import org.openide.util.NbBundle;
4142
import org.sleuthkit.autopsy.casemodule.Case;
4243
import org.sleuthkit.autopsy.coreutils.ExecUtil;
@@ -78,6 +79,7 @@ final class PhotoRecCarverFileIngestModule implements FileIngestModule {
7879

7980
private static final String PHOTOREC_DIRECTORY = "photorec_exec"; //NON-NLS
8081
private static final String PHOTOREC_EXECUTABLE = "photorec_win.exe"; //NON-NLS
82+
private static final String PHOTOREC_LINUX_EXECUTABLE = "photorec";
8183
private static final String PHOTOREC_RESULTS_BASE = "results"; //NON-NLS
8284
private static final String PHOTOREC_RESULTS_EXTENDED = "results.1"; //NON-NLS
8385
private static final String PHOTOREC_REPORT = "report.xml"; //NON-NLS
@@ -136,8 +138,8 @@ public void startUp(IngestJobContext context) throws IngestModule.IngestModuleEx
136138

137139
this.rootOutputDirPath = createModuleOutputDirectoryForCase();
138140

139-
Path execName = Paths.get(PHOTOREC_DIRECTORY, PHOTOREC_EXECUTABLE);
140-
executableFile = locateExecutable(execName.toString());
141+
//Set photorec executable directory based on operating system.
142+
executableFile = locateExecutable();
141143

142144
if (PhotoRecCarverFileIngestModule.refCounter.incrementAndGet(this.jobId) == 1) {
143145
try {
@@ -222,13 +224,13 @@ public IngestModule.ProcessResult process(AbstractFile file) {
222224

223225
// Scan the file with Unallocated Carver.
224226
ProcessBuilder processAndSettings = new ProcessBuilder(
225-
"\"" + executableFile + "\"",
227+
executableFile.toString(),
226228
"/d", // NON-NLS
227-
"\"" + outputDirPath.toAbsolutePath() + File.separator + PHOTOREC_RESULTS_BASE + "\"",
229+
outputDirPath.toAbsolutePath().toString() + File.separator + PHOTOREC_RESULTS_BASE,
228230
"/cmd", // NON-NLS
229-
"\"" + tempFilePath.toFile() + "\"",
231+
tempFilePath.toFile().toString(),
230232
"search"); // NON-NLS
231-
233+
232234
// Add environment variable to force PhotoRec to run with the same permissions Autopsy uses
233235
processAndSettings.environment().put("__COMPAT_LAYER", "RunAsInvoker"); //NON-NLS
234236
processAndSettings.redirectErrorStream(true);
@@ -435,17 +437,32 @@ synchronized Path createModuleOutputDirectoryForCase() throws IngestModule.Inges
435437
*
436438
* @throws IngestModuleException
437439
*/
438-
public static File locateExecutable(String executableToFindName) throws IngestModule.IngestModuleException {
439-
// Must be running under a Windows operating system.
440-
if (!PlatformUtil.isWindowsOS()) {
441-
throw new IngestModule.IngestModuleException(Bundle.unsupportedOS_message());
440+
public static File locateExecutable() throws IngestModule.IngestModuleException {
441+
File exeFile = null;
442+
Path execName = null;
443+
String photorec_linux_directory = "/usr/bin";
444+
if (PlatformUtil.isWindowsOS()) {
445+
execName = Paths.get(PHOTOREC_DIRECTORY, PHOTOREC_EXECUTABLE);
446+
exeFile = InstalledFileLocator.getDefault().locate(execName.toString(), PhotoRecCarverFileIngestModule.class.getPackage().getName(), false);
447+
} else {
448+
File usrBin = new File("/usr/bin/photorec");
449+
File usrLocalBin = new File("/usr/local/bin/photorec");
450+
if (usrBin.canExecute() && usrBin.exists() && !usrBin.isDirectory()) {
451+
photorec_linux_directory = "/usr/bin";
452+
}else if(usrLocalBin.canExecute() && usrLocalBin.exists() && !usrLocalBin.isDirectory()){
453+
photorec_linux_directory = "/usr/local/bin";
454+
}else{
455+
throw new IngestModule.IngestModuleException("Photorec not found");
456+
}
457+
execName = Paths.get(photorec_linux_directory, PHOTOREC_LINUX_EXECUTABLE);
458+
exeFile = new File(execName.toString());
442459
}
443460

444-
File exeFile = InstalledFileLocator.getDefault().locate(executableToFindName, PhotoRecCarverFileIngestModule.class.getPackage().getName(), false);
445461
if (null == exeFile) {
446462
throw new IngestModule.IngestModuleException(Bundle.missingExecutable_message());
447463
}
448-
464+
465+
449466
if (!exeFile.canExecute()) {
450467
throw new IngestModule.IngestModuleException(Bundle.cannotRunExecutable_message());
451468
}

‎RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java‎

Lines changed: 29 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -76,10 +76,13 @@ class ExtractRegistry extends Extract {
7676
final private static UsbDeviceIdMapper USB_MAPPER = new UsbDeviceIdMapper();
7777
final private static String RIP_EXE = "rip.exe";
7878
final private static String RIP_PL = "rip.pl";
79-
final private static String PERL = "perl ";
79+
private List<String> rrCmd = new ArrayList<>();
80+
private List<String> rrFullCmd= new ArrayList<>();
81+
8082

8183
ExtractRegistry() throws IngestModuleException {
8284
moduleName = NbBundle.getMessage(ExtractIE.class, "ExtractRegistry.moduleName.text");
85+
8386
final File rrRoot = InstalledFileLocator.getDefault().locate("rr", ExtractRegistry.class.getPackage().getName(), false); //NON-NLS
8487
if (rrRoot == null) {
8588
throw new IngestModuleException(Bundle.RegRipperNotFound());
@@ -98,20 +101,33 @@ class ExtractRegistry extends Extract {
98101
RR_PATH = rrHome.resolve(executableToRun).toString();
99102
rrFullHome = rrFullRoot.toPath();
100103
RR_FULL_PATH = rrFullHome.resolve(executableToRun).toString();
101-
104+
102105
if (!(new File(RR_PATH).exists())) {
103106
throw new IngestModuleException(Bundle.RegRipperNotFound());
104107
}
105108
if (!(new File(RR_FULL_PATH).exists())) {
106109
throw new IngestModuleException(Bundle.RegRipperFullNotFound());
107110
}
108-
109-
if (!PlatformUtil.isWindowsOS()) {
110-
RR_PATH = PERL + RR_PATH;
111-
RR_FULL_PATH = PERL + RR_FULL_PATH;
111+
if(PlatformUtil.isWindowsOS()){
112+
rrCmd.add(RR_PATH);
113+
rrFullCmd.add(RR_FULL_PATH);
114+
}else{
115+
String perl;
116+
File usrBin = new File("/usr/bin/perl");
117+
File usrLocalBin = new File("/usr/local/bin/perl");
118+
if(usrBin.canExecute() && usrBin.exists() && !usrBin.isDirectory()){
119+
perl = "/usr/bin/perl";
120+
}else if(usrLocalBin.canExecute() && usrLocalBin.exists() && !usrLocalBin.isDirectory()){
121+
perl = "/usr/local/bin/perl";
122+
}else{
123+
throw new IngestModuleException("perl not found in your system");
124+
}
125+
rrCmd.add(perl);
126+
rrCmd.add(RR_PATH);
127+
rrFullCmd.add(perl);
128+
rrFullCmd.add(RR_FULL_PATH);
112129
}
113130
}
114-
115131
/**
116132
* Search for the registry hives on the system.
117133
*/
@@ -262,7 +278,7 @@ private RegOutputFiles ripRegistryFile(String regFilePath, String outFilePathBas
262278
regOutputFiles.autopsyPlugins = outFilePathBase + "-autopsy.txt"; //NON-NLS
263279
String errFilePath = outFilePathBase + "-autopsy.err.txt"; //NON-NLS
264280
logger.log(Level.INFO, "Writing RegRipper results to: {0}", regOutputFiles.autopsyPlugins); //NON-NLS
265-
executeRegRipper(RR_PATH, rrHome, regFilePath, autopsyType, regOutputFiles.autopsyPlugins, errFilePath);
281+
executeRegRipper(rrCmd, rrHome, regFilePath, autopsyType, regOutputFiles.autopsyPlugins, errFilePath);
266282
}
267283
if (context.dataSourceIngestIsCancelled()) {
268284
return regOutputFiles;
@@ -273,15 +289,17 @@ private RegOutputFiles ripRegistryFile(String regFilePath, String outFilePathBas
273289
regOutputFiles.fullPlugins = outFilePathBase + "-full.txt"; //NON-NLS
274290
String errFilePath = outFilePathBase + "-full.err.txt"; //NON-NLS
275291
logger.log(Level.INFO, "Writing Full RegRipper results to: {0}", regOutputFiles.fullPlugins); //NON-NLS
276-
executeRegRipper(RR_FULL_PATH, rrFullHome, regFilePath, fullType, regOutputFiles.fullPlugins, errFilePath);
292+
executeRegRipper(rrFullCmd, rrFullHome, regFilePath, fullType, regOutputFiles.fullPlugins, errFilePath);
277293
}
278294
return regOutputFiles;
279295
}
280296

281-
private void executeRegRipper(String regRipperPath, Path regRipperHomeDir, String hiveFilePath, String hiveFileType, String outputFile, String errFile) {
297+
private void executeRegRipper(List<String> regRipperPath, Path regRipperHomeDir, String hiveFilePath, String hiveFileType, String outputFile, String errFile) {
282298
try {
283299
List<String> commandLine = new ArrayList<>();
284-
commandLine.add(regRipperPath);
300+
for(String cmd: regRipperPath){
301+
commandLine.add(cmd);
302+
}
285303
commandLine.add("-r"); //NON-NLS
286304
commandLine.add(hiveFilePath);
287305
commandLine.add("-f"); //NON-NLS

‎RecentActivity/src/org/sleuthkit/autopsy/recentactivity/RAImageIngestModule.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,9 +23,11 @@
2323
package org.sleuthkit.autopsy.recentactivity;
2424

2525
import java.io.File;
26+
import java.io.FileNotFoundException;
2627
import java.util.ArrayList;
2728
import java.util.List;
2829
import java.util.logging.Level;
30+
import org.openide.util.Exceptions;
2931
import org.openide.util.NbBundle;
3032
import org.sleuthkit.autopsy.casemodule.Case;
3133
import org.sleuthkit.autopsy.coreutils.Logger;
@@ -57,6 +59,7 @@ public final class RAImageIngestModule implements DataSourceIngestModule {
5759
public void startUp(IngestJobContext context) throws IngestModuleException {
5860
this.context = context;
5961

62+
6063
Extract registry = new ExtractRegistry();
6164
Extract iexplore = new ExtractIE();
6265
Extract recentDocuments = new RecentDocumentsByLnk();

‎build.xml‎

Lines changed: 27 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,12 @@
3232
</condition>
3333
<condition property="os.family" value="windows">
3434
<os family="windows"/>
35-
</condition>
35+
</condition>
36+
37+
<condition property="os.family" value="mac">
38+
<os family="mac"/>
39+
</condition>
40+
3641
<import file="build-${os.family}.xml"/>
3742

3843
<!-- Third party tools dependencies -->
@@ -82,7 +87,13 @@
8287
<copy file="${basedir}/LICENSE-2.0.txt" tofile="${zip-tmp}/${app.name}/LICENSE-2.0.txt"/>
8388
<copy file="${basedir}/NEWS.txt" tofile="${zip-tmp}/${app.name}/NEWS.txt"/>
8489
<copy file="${basedir}/KNOWN_ISSUES.txt" tofile="${zip-tmp}/${app.name}/KNOWN_ISSUES.txt"/>
85-
<unzip src="${thirdparty.dir}/gstreamer/${os.family}/i386/0.10.7/gstreamer.zip" dest="${zip-tmp}/${app.name}/gstreamer"/>
90+
<if>
91+
<equals arg1="${os.family}" arg2="windows"/>
92+
<then>
93+
<unzip src="${thirdparty.dir}/gstreamer/${os.family}/i386/0.10.7/gstreamer.zip" dest="${zip-tmp}/${app.name}/gstreamer"/>
94+
</then>
95+
</if>
96+
8697
<copy file="${basedir}/icons/icon.ico" tofile="${zip-tmp}/${app.name}/icon.ico" overwrite="true"/>
8798

8899
<!-- Copy the Autopsy documentation to the docs folder -->
@@ -91,8 +102,20 @@
91102
</copy>
92103

93104
<property name="app.property.file" value="${zip-tmp}/${app.name}/etc/${app.name}.conf" />
94-
<!-- for Japanese localized version add option: -Duser.language=ja -->
95-
<property name="jvm.options" value="&quot;--branding ${app.name} -J-Xms24m -J-Xmx4G -J-XX:MaxPermSize=128M -J-Xverify:none -J-XX:+UseG1GC -J-XX:+UseStringDeduplication -J-Xdock:name=${app.title}&quot;" />
105+
<var name="jvm-value" value="--branding ${app.name} -J-Xms24m -J-Xmx4G -J-Xverify:none -J-XX:+UseG1GC -J-XX:+UseStringDeduplication"/>
106+
<!-- for Japanese localized version add option: -Duser.language=ja -->
107+
108+
109+
<if>
110+
<equals arg1="${os.family}" arg2="mac"/>
111+
<then>
112+
<property name="jvm.options" value="&quot;${jvm-value} -J-Xdock:name=${app.title}&quot;"/>
113+
</then>
114+
<else>
115+
<property name="jvm.options" value="&quot;${jvm-value}&quot;"/>
116+
</else>
117+
</if>
118+
96119
<propertyfile file="${app.property.file}">
97120
<!-- Note: can be higher on 64 bit systems, should be in sync with project.properties -->
98121
<entry key="default_options" value="@JVM_OPTIONS" />

0 commit comments

Comments
 (0)