Package me.mthw.forge.ingest

Class ForgeIngestFactory

java.lang.Object
me.mthw.forge.ingest.ForgeIngestFactory
All Implemented Interfaces:
org.sleuthkit.autopsy.ingest.IngestModuleFactory
public class ForgeIngestFactory extends Object implements org.sleuthkit.autopsy.ingest.IngestModuleFactory

  • Constructor Summary

    Constructors
    Constructor
    Description
    ForgeIngestFactory()
     

  • Method Summary

    Modifier and Type
    Method
    Description
    static void
    addMainFlag(List<org.sleuthkit.datamodel.Content> files, org.sleuthkit.datamodel.BlackboardAttribute.Type mainAttribute)
    Adds a main flag to a list of content files based on the specified main attribute.
    static void
    addMainFlag(org.sleuthkit.datamodel.Content file, org.sleuthkit.datamodel.BlackboardAttribute.Type mainAttribute)
    Adds a main flag attribute to the general information artifact of the given content file.
    static org.sleuthkit.datamodel.BlackboardAttribute.Type
    createBlackboardArtifacts(org.sleuthkit.datamodel.Blackboard blackboard)
    Creates or retrieves a blackboard attribute type with the main type name, value type, and display name.
    org.sleuthkit.autopsy.ingest.DataSourceIngestModule
    createDataSourceIngestModule(org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettings settings)
    Creates a data source ingest module instance.
    org.sleuthkit.autopsy.ingest.FileIngestModule
    createFileIngestModule(org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettings settings)
    Creates a new instance of a file ingest module.
    org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettings
    getDefaultIngestJobSettings()
    Gets the default per ingest job settings for instances of the family of ingest modules the factory creates.
    org.sleuthkit.autopsy.ingest.IngestModuleGlobalSettingsPanel
    getGlobalSettingsPanel()
    Gets a user interface panel that allows a user to change settings that are used by all instances of the family of ingest modules the factory creates.
    org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettingsPanel
    getIngestJobSettingsPanel(org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettings settings)
    Gets a user interface panel that can be used to set per ingest job settings for instances of the family of ingest modules the factory creates.
    String
    getModuleDescription()
    Gets a brief, user-friendly description of the family of ingest modules the factory creates.
    String
    getModuleDisplayName()
    Gets the display name that identifies the family of ingest modules the factory creates.
    static String
    getModuleName()
     
    String
    getModuleVersionNumber()
    Gets the version number of the family of ingest modules the factory creates.
    boolean
    hasGlobalSettingsPanel()
    Queries the factory to determine if it provides a user interface panel to allow a user to change settings that are used by all instances of the family of ingest modules the factory creates.
    boolean
    hasIngestJobSettingsPanel()
    Queries the factory to determine if it provides user a interface panel to allow a user to make per ingest job settings for instances of the family of ingest modules the factory creates.
    boolean
    isDataSourceIngestModuleFactory()
    Queries the factory to determine if it is capable of creating data source ingest modules.
    boolean
    isFileIngestModuleFactory()
    Queries the factory to determine if it is capable of creating file ingest modules.

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    Methods inherited from interface org.sleuthkit.autopsy.ingest.IngestModuleFactory

    createAnalysisResultIngestModule, createDataArtifactIngestModule, isAnalysisResultIngestModuleFactory, isDataArtifactIngestModuleFactory

  • Constructor Details

    • ForgeIngestFactory

      public ForgeIngestFactory()

  • Method Details

    • getModuleName

      public static String getModuleName()

    • getModuleDisplayName

      public String getModuleDisplayName()
      Gets the display name that identifies the family of ingest modules the factory creates. Autopsy uses this string to identify the module in user interface components and log messages. The module name must be unique. so a brief but distinctive name is recommended.
      Specified by:
      getModuleDisplayName in interface org.sleuthkit.autopsy.ingest.IngestModuleFactory
      Returns:
      The module family display name.

    • getModuleDescription

      public String getModuleDescription()
      Gets a brief, user-friendly description of the family of ingest modules the factory creates. Autopsy uses this string to describe the module in user interface components.
      Specified by:
      getModuleDescription in interface org.sleuthkit.autopsy.ingest.IngestModuleFactory
      Returns:
      The module family description.

    • getModuleVersionNumber

      public String getModuleVersionNumber()
      Gets the version number of the family of ingest modules the factory creates.
      Specified by:
      getModuleVersionNumber in interface org.sleuthkit.autopsy.ingest.IngestModuleFactory
      Returns:
      The module family version number.

    • hasGlobalSettingsPanel

      public boolean hasGlobalSettingsPanel()
      Queries the factory to determine if it provides a user interface panel to allow a user to change settings that are used by all instances of the family of ingest modules the factory creates. For example, the Autopsy core hash lookup ingest module factory provides a global settings panel to import and create hash databases. The hash databases are then enabled or disabled per ingest job using an ingest job settings panel. If the module family does not have global settings, the factory may extend IngestModuleFactoryAdapter to get an implementation of this method that returns false.
      Specified by:
      hasGlobalSettingsPanel in interface org.sleuthkit.autopsy.ingest.IngestModuleFactory
      Returns:
      True if the factory provides a global settings panel.

    • getGlobalSettingsPanel

      public org.sleuthkit.autopsy.ingest.IngestModuleGlobalSettingsPanel getGlobalSettingsPanel()
      Gets a user interface panel that allows a user to change settings that are used by all instances of the family of ingest modules the factory creates. For example, the Autopsy core hash lookup ingest module factory provides a global settings panel to import and create hash databases. The imported hash databases are then enabled or disabled per ingest job using ingest an ingest job settings panel. If the module family does not have a global settings, the factory may extend IngestModuleFactoryAdapter to get an implementation of this method that throws an UnsupportedOperationException.
      Specified by:
      getGlobalSettingsPanel in interface org.sleuthkit.autopsy.ingest.IngestModuleFactory
      Returns:
      A global settings panel.

    • getDefaultIngestJobSettings

      public org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettings getDefaultIngestJobSettings()
      Gets the default per ingest job settings for instances of the family of ingest modules the factory creates. For example, the Autopsy core hash lookup ingest modules family uses hash databases imported or created using its global settings panel. All of the hash databases are enabled by default for an ingest job. If the module family does not have per ingest job settings, the factory may extend IngestModuleFactoryAdapter to get an implementation of this method that returns an instance of the NoIngestModuleJobSettings class.
      Specified by:
      getDefaultIngestJobSettings in interface org.sleuthkit.autopsy.ingest.IngestModuleFactory
      Returns:
      The default ingest job settings.

    • hasIngestJobSettingsPanel

      public boolean hasIngestJobSettingsPanel()
      Queries the factory to determine if it provides user a interface panel to allow a user to make per ingest job settings for instances of the family of ingest modules the factory creates. For example, the Autopsy core hash lookup ingest module factory provides an ingest job settings panels to enable or disable hash databases per ingest job. If the module family does not have per ingest job settings, the factory may extend IngestModuleFactoryAdapter to get an implementation of this method that returns false.
      Specified by:
      hasIngestJobSettingsPanel in interface org.sleuthkit.autopsy.ingest.IngestModuleFactory
      Returns:
      True if the factory provides ingest job settings panels.

    • getIngestJobSettingsPanel

      public org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettingsPanel getIngestJobSettingsPanel(org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettings settings)
      Gets a user interface panel that can be used to set per ingest job settings for instances of the family of ingest modules the factory creates. For example, the core hash lookup ingest module factory provides an ingest job settings panel to enable or disable hash databases per ingest job. If the module family does not have per ingest job settings, the factory may extend IngestModuleFactoryAdapter to get an implementation of this method that throws an UnsupportedOperationException.
      Specified by:
      getIngestJobSettingsPanel in interface org.sleuthkit.autopsy.ingest.IngestModuleFactory
      Parameters:
      settings - Per ingest job settings to initialize the panel.
      Returns:
      An ingest job settings panel.

    • isDataSourceIngestModuleFactory

      public boolean isDataSourceIngestModuleFactory()
      Queries the factory to determine if it is capable of creating data source ingest modules. If the module family does not include data source ingest modules, the factory may extend IngestModuleFactoryAdapter to get an implementation of this method that returns false.
      Specified by:
      isDataSourceIngestModuleFactory in interface org.sleuthkit.autopsy.ingest.IngestModuleFactory
      Returns:
      True if the factory can create data source ingest modules.

    • createDataSourceIngestModule

      public org.sleuthkit.autopsy.ingest.DataSourceIngestModule createDataSourceIngestModule(org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettings settings)
      Creates a data source ingest module instance. Autopsy will generally use the factory to several instances of each type of module for each ingest job it performs. Completing an ingest job entails processing a single data source (e.g., a disk image) and all of the files from the data source, including files extracted from archives and any unallocated space (made to look like a series of files). The data source is passed through one or more pipelines of data source ingest modules. The files are passed through one or more pipelines of file ingest modules. The ingest framework may use multiple threads to complete an ingest job, but it is guaranteed that there will be no more than one module instance per thread. However, if the module instances must share resources, the modules are responsible for synchronizing access to the shared resources and doing reference counting as required to release those resources correctly. Also, more than one ingest job may be in progress at any given time. This must also be taken into consideration when sharing resources between module instances. modules. If the module family does not include data source ingest modules, the factory may extend IngestModuleFactoryAdapter to get an implementation of this method that throws an UnsupportedOperationException.
      Specified by:
      createDataSourceIngestModule in interface org.sleuthkit.autopsy.ingest.IngestModuleFactory
      Parameters:
      settings - The settings for the ingest job.
      Returns:
      A data source ingest module instance.

    • isFileIngestModuleFactory

      public boolean isFileIngestModuleFactory()
      Queries the factory to determine if it is capable of creating file ingest modules. If the module family does not include file ingest modules, the factory may extend IngestModuleFactoryAdapter to get an implementation of this method that returns false.
      Specified by:
      isFileIngestModuleFactory in interface org.sleuthkit.autopsy.ingest.IngestModuleFactory
      Returns:
      True if the factory can create file ingest modules.

    • createFileIngestModule

      public org.sleuthkit.autopsy.ingest.FileIngestModule createFileIngestModule(org.sleuthkit.autopsy.ingest.IngestModuleIngestJobSettings settings)
      Creates a new instance of a file ingest module.
      Specified by:
      createFileIngestModule in interface org.sleuthkit.autopsy.ingest.IngestModuleFactory
      Parameters:
      settings - The settings for the ingest job.
      Returns:
      A new instance of ForgeFileIngest.

    • addMainFlag

      public static void addMainFlag(org.sleuthkit.datamodel.Content file, org.sleuthkit.datamodel.BlackboardAttribute.Type mainAttribute) throws org.sleuthkit.datamodel.TskCoreException, IllegalArgumentException
      Adds a main flag attribute to the general information artifact of the given content file. This method is synchronized to ensure thread safety.
      Parameters:
      file - The content file to which the main flag attribute will be added.
      mainAttribute - The type of the main flag attribute to add.
      Throws:
      org.sleuthkit.datamodel.TskCoreException - If there is an error accessing or modifying the artifact.
      IllegalArgumentException - If the provided arguments are invalid. Note: If the general information artifact of the file already contains the specified main flag attribute, this method will return without making any changes.

    • addMainFlag

      public static void addMainFlag(List<org.sleuthkit.datamodel.Content> files, org.sleuthkit.datamodel.BlackboardAttribute.Type mainAttribute) throws org.sleuthkit.datamodel.TskCoreException, IllegalArgumentException
      Adds a main flag to a list of content files based on the specified main attribute. This method is synchronized to ensure thread safety.
      Parameters:
      files - The list of content files to which the main flag will be added.
      mainAttribute - The main attribute used to determine the flag to be added.
      Throws:
      org.sleuthkit.datamodel.TskCoreException - If an error occurs while adding the main flag.
      IllegalArgumentException - If the provided arguments are invalid.

    • createBlackboardArtifacts

      public static org.sleuthkit.datamodel.BlackboardAttribute.Type createBlackboardArtifacts(org.sleuthkit.datamodel.Blackboard blackboard) throws org.sleuthkit.datamodel.Blackboard.BlackboardException, org.sleuthkit.autopsy.casemodule.NoCurrentCaseException
      Creates or retrieves a blackboard attribute type with the main type name, value type, and display name. This method ensures thread safety by being synchronized.
      Parameters:
      blackboard - The blackboard instance where the attribute type will be created or retrieved.
      Returns:
      The blackboard attribute type created or retrieved.
      Throws:
      org.sleuthkit.datamodel.Blackboard.BlackboardException - If there is an error creating or retrieving the attribute type.
      org.sleuthkit.autopsy.casemodule.NoCurrentCaseException - If there is no current case context available.