sleuthkit-users — List to discuss Autopsy and The Sleuth Kit.

[sleuthkit-users] Java bindings: ClassNotFoundException TskDataException

[<zah...@gm...>]

Hey everyone,
I just started using Tsk. To get a feeling I wanted to try out the sample (Sample.java, see below). I build it with Ant (build.xl, see below). While the build itself is successful I can't get the program to run (java -jar Sample.jar). I am working on a Linux Machine, the JNI libs are in /usr/lib. The file Tsk_DataModel.jar I copied to projectdir/lib.
This is the message I get:
'Exception in thread "main" java.lang.NoClassDefFoundError: org/sleuthkit/datamodel/TskDataException
	at java.lang.Class.getDeclaredMethods0(Native Method)
	at java.lang.Class.privateGetDeclaredMethods(Class.java:2625)
	at java.lang.Class.getMethod0(Class.java:2866)
	at java.lang.Class.getMethod(Class.java:1676)
	at sun.launcher.LauncherHelper.getMainMethod(LauncherHelper.java:494)
	at sun.launcher.LauncherHelper.checkAndLoadMain(LauncherHelper.java:486)
Caused by: java.lang.ClassNotFoundException: org.sleuthkit.datamodel.TskDataException

So could anyone help me on that? Thanks.

Sample.java:
package main;

import java.lang.reflect.Array;
import java.util.ArrayList;
import java.util.List;
import java.util.logging.Level;
import java.util.logging.Logger;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.Content;
import org.sleuthkit.datamodel.Image;
import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.SleuthkitJNI.CaseDbHandle.AddImageProcess;
import org.sleuthkit.datamodel.TskCoreException;
import org.sleuthkit.datamodel.TskDataException;
  
public class Sample {
  
    public static void run(String imagePath) {
        try {
            SleuthkitCase sk = SleuthkitCase.newCase(imagePath + ".db");
  
            // initialize the case with an image
            String timezone = "";
            AddImageProcess process = sk.makeAddImageProcess(timezone, true, false);
            ArrayList<String> paths = new ArrayList<String>();
            paths.add(imagePath);
            try {
                process.run(paths.toArray(new String[paths.size()]));
            } catch (TskDataException ex) {
                Logger.getLogger(Sample.class.getName()).log(Level.SEVERE, null, ex);
            }
            process.commit();
  
            // print out all the images found, and their children
            List<Image> images = sk.getImages();
            for (Image image : images) {
                System.out.println("Found image: " + image.getName());
                System.out.println("There are " + image.getChildren().size() + " children.");
                for (Content content : image.getChildren()) {
                    System.out.println('"' + content.getName() + '"' + " is a child of " + image.getName());
                }
            }
  
            // print out all .txt files found
            List<AbstractFile> files = sk.findAllFilesWhere("name like '%.txt'");
            for (AbstractFile file : files) {
                System.out.println("Found text file: " + file.getName());
            }
  
        } catch (TskCoreException e) {
            System.out.println("Exception caught: " + e.getMessage());
            Sample.usage(e.getMessage());
        }
    }
  
    public static void usage(String error) {
        System.out.println("Usage: ant -Dimage:{image string} run-sample");
        if (error.contains("deleted first")) {
            System.out.println("A database for the image already exists. Delete it to run this sample again.");
        } else if (error.contains("unable to open database")) {
            System.out.println("Image must be encapsulated by double quotes. Ex: ant -Dimage=\"C:\\Users\\You\\image.E01\" run-sample");
        }
    }
  
    public static void main(String[] args) {
        Sample.run(args[0]);
    }
}


build.xml:
<project name="Sample" basedir="." default="main">

    <property name="src.dir"     value="src"/>

    <property name="build.dir"   value="build"/>
    <property name="classes.dir" value="${build.dir}/classes"/>
    <property name="jar.dir"     value="${build.dir}/jar"/>

    <property name="main-class"  value="main.Sample"/>

    <property name="lib.dir"     value="lib"/>

    <path id="master-classpath">
        <fileset dir="${lib.dir}">
            <include name="*.jar"/>
        </fileset>

        <pathelement path="${build.dir}"/>
    </path>


    <target name="clean">
        <delete dir="${build.dir}"/>
    </target>

    <target name="compile">
        <mkdir dir="${classes.dir}"/>
        <javac includeantruntime="false" destdir="${classes.dir}">
            <src path="${src.dir}"/>
            <classpath refid="master-classpath"/>
        </javac>
    </target>

    <target name="jar" depends="compile">
        <mkdir dir="${jar.dir}"/>
        <jar destfile="${jar.dir}/${ant.project.name}.jar" basedir="${classes.dir}">
            <manifest>
                <attribute name="Main-Class" value="${main-class}"/>
            </manifest>
        </jar>
    </target>

    <target name="run" depends="jar">
        <java fork="true" classname="${main-class}">
            <classpath>
                <path refid="master-classpath"/>
                <path location="${jar.dir}/${ant.project.name}.jar"/>
            </classpath>
        </java>

    </target>

    <target name="clean-build" depends="clean,jar"/>

    <target name="main" depends="clean,run"/>

</project>

Re: [sleuthkit-users] Autopsy Python Tutorial #2: Data Source Ingest Modules

[Justin G. <jus...@gm...>]

Brian,

Here is my current complete process() function.  I've stripped out
everything else. My variable numFiles reports "0" when run against my
logical directory of five JPGs (on my desktop).  When I run it against an
image, it reports correctly (e.g., on an image I have, it reports 2331 JPGs
found).

    def process(self, dataSource, progressBar):

        progressBar.switchToIndeterminate()
        fileManager = Case.getCurrentCase().getServices().getFileManager()
        files = fileManager.findFiles(dataSource, "%jpg")
        numFiles = len(files)
        self.log(Level.INFO, "NumFiles:"+str(numFiles))

-Justin

On Thu, Aug 20, 2015 at 9:23 AM, Justin Grover <jus...@gm...>
wrote:

> Hmmmm.  Weird. Thanks for checking. My folder structure is really simple.
> Single folder contains 5 jpg's: a.jpg, b.jpg, c.jpg, d.jpg, e.jpg.
>
> I'll provide a larger code snippet when I get a chance later today.
> On Aug 20, 2015 9:19 AM, "Brian Carrier" <ca...@sl...> wrote:
>
>> Never mind.  I was using an older version of the sample database.  Both
>> the tutorial and %jpg work for me. What does your input data look like
>> (folders, file names, etc.).
>>
>>
>>
>> > On Aug 19, 2015, at 5:40 PM, Brian Carrier <ca...@sl...>
>> wrote:
>> >
>> > Hi Justin,
>> >
>> > Interestingly, I can get the %jpg to work, but I found that the
>> tutorial stopped working for me (it is not finding contacts.db - or at
>> least not making artifacts for it).  let me debug this to see if I checked
>> in the wrong final code / sample data.
>> >
>> > brian
>> >
>> >> On Aug 19, 2015, at 12:26 PM, Justin Grover <jus...@gm...>
>> wrote:
>> >>
>> >> Note...I found what I think is a bug while following Tutorial #2.  If
>> you run a python Data Source Ingest Module against a LogicalFileSet, the
>> following will not work from the Tutorial:
>> >>
>> >> files = fileManager.findFiles(dataSource, "contacts.db")
>> >>
>> >> I've been trying to point Autopsy against a logical directory of JPGs
>> and using "%jpg" as my search string and it won't find any of them.
>> However, when I switch my Data Source to be an image (instead of a
>> LogicalFileSet), it works just fine.
>> >>
>> >> -Justin
>> >>
>> >> On Mon, Aug 17, 2015 at 6:38 PM, <
>> sle...@li...> wrote:
>> >> Send sleuthkit-users mailing list submissions to
>> >>        sle...@li...
>> >>
>> >> To subscribe or unsubscribe via the World Wide Web, visit
>> >>        https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> >> or, via email, send a message with subject or body 'help' to
>> >>        sle...@li...
>> >>
>> >> You can reach the person managing the list at
>> >>        sle...@li...
>> >>
>> >> When replying, please edit your Subject line so it is more specific
>> >> than "Re: Contents of sleuthkit-users digest..."
>> >>
>> >>
>> >> Today's Topics:
>> >>
>> >>   1. Autopsy Python Tutorial #2: Data Source Ingest    Modules
>> >>      (Brian Carrier)
>> >>   2. Timeline Survey Question (Brian Carrier)
>> >>
>> >>
>> >> ----------------------------------------------------------------------
>> >>
>> >> Message: 1
>> >> Date: Mon, 17 Aug 2015 18:01:05 -0400
>> >> From: Brian Carrier <ca...@sl...>
>> >> Subject: [sleuthkit-users] Autopsy Python Tutorial #2: Data Source
>> >>        Ingest  Modules
>> >> To: sleuthkit-users <sle...@li...>
>> >> Message-ID: <889...@sl...>
>> >> Content-Type: text/plain; charset=utf-8
>> >>
>> >> To help you put $1000 in your pocket as part of the OSDFCon Autopsy
>> Module challenge (
>> http://www.osdfcon.org/2015-event/2015-module-development-contest/),
>> Basis Technology released another Python tutorial.
>> >>
>> >>
>> http://www.basistech.com/python-autopsy-module-tutorial-2-the-data-source-ingest-module/
>> >>
>> >> This one is on writing Python-based data source ingest modules and it
>> covers two topics:
>> >> 1) Finding a SQLite database, parsing it, and making blackboard
>> artifacts
>> >> 2) Writing a wrapper around a command line tool that takes a disk
>> image as input
>> >>
>> >> Final source code is included (which can be used as part of a
>> challenge submission with a little copy and pasting?.).
>> >>
>> >> We also uploaded final source code for the first tutorial (on finding
>> big and round files) for those who followed that one:
>> >>
>> >>
>> https://github.com/sleuthkit/autopsy/tree/develop/pythonExamples/July2015FileTutorial_BigRound
>> >>
>> >> Enjoy!
>> >>
>> >> brian
>> >>
>> >>
>> >>
>> >>
>> >>
>> >> ------------------------------
>> >>
>> >> Message: 2
>> >> Date: Mon, 17 Aug 2015 18:38:13 -0400
>> >> From: Brian Carrier <ca...@sl...>
>> >> Subject: [sleuthkit-users] Timeline Survey Question
>> >> To: sleuthkit-users <sle...@li...>
>> >> Message-ID: <902...@sl...>
>> >> Content-Type: text/plain; charset="utf-8"
>> >>
>> >> We?re reviewing some changes to the timeline module and wanted some
>> feedback.
>> >>
>> >> Background: In the ?details? view, we currently cluster together
>> events if they happen close to each other.  But, once there is a gap in
>> events in a certain folder (or URL), then we break the cluster in the UI.
>> This means that you could  have clusters for the same folder (Program Files
>> in the below example) that span multiple clusters.  Notice in this image
>> below, there are three ?Program Files? clusters (two in the top row and one
>> in the fifth row).   The motivation for this was that it would be useful to
>> know that there was a gap in between the clusters of events.
>> >>
>> >>
>> >>
>> >>
>> >>
>> >>
>> >> We are looking at an alternative, which is to have a single cluster
>> for the entire view (regardless of it there is a gap). This means that even
>> if there are only events at left of the screen and right then it would be a
>> solid band. It would look something like this:
>> >>
>> >>
>> >>
>> >>
>> >> The benefit of this would be that it would be obvious of all of the
>> events in the given description (folder name, for example) and we would
>> waste less space rewriting the name so often.  It comes at the potential
>> downside though that it may take more vertical space because we could have
>> lots of sparse bands.
>> >>
>> >> Opinions?
>> >>
>> >>
>> >> -------------- next part --------------
>> >> An HTML attachment was scrubbed...
>> >> -------------- next part --------------
>> >> A non-text attachment was scrubbed...
>> >> Name: events_current.png
>> >> Type: image/png
>> >> Size: 76116 bytes
>> >> Desc: not available
>> >> -------------- next part --------------
>> >> A non-text attachment was scrubbed...
>> >> Name: events_spans.png
>> >> Type: image/png
>> >> Size: 44972 bytes
>> >> Desc: not available
>> >>
>> >> ------------------------------
>> >>
>> >>
>> ------------------------------------------------------------------------------
>> >>
>> >>
>> >> ------------------------------
>> >>
>> >> _______________________________________________
>> >> sleuthkit-users mailing list
>> >> sle...@li...
>> >> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> >>
>> >>
>> >> End of sleuthkit-users Digest, Vol 110, Issue 2
>> >> ***********************************************
>> >>
>> >>
>> ------------------------------------------------------------------------------
>> >> _______________________________________________
>> >> sleuthkit-users mailing list
>> >> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> >> http://www.sleuthkit.org
>> >
>> >
>> >
>> ------------------------------------------------------------------------------
>> > _______________________________________________
>> > sleuthkit-users mailing list
>> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> > http://www.sleuthkit.org
>>
>>

Re: [sleuthkit-users] [sleuthkit-developers] Java Bindings Update

[Stuart M. <st...@ap...>]

Hi Brian, yes my effort is just Java and C.

Stuart


On 08/20/2015 06:22 AM, Brian Carrier wrote:
> Thanks Stuart.  Just to be clear, the main difference between your bindings and the one that ships with TSK is that the “official” one relies on SQLite and JNI while yours is 100% JNI, right?
>
> thanks,
> brian
>
>

Re: [sleuthkit-users] Autopsy Python Tutorial #2: Data Source Ingest Modules

[Justin G. <jus...@gm...>]

Hmmmm.  Weird. Thanks for checking. My folder structure is really simple.
Single folder contains 5 jpg's: a.jpg, b.jpg, c.jpg, d.jpg, e.jpg.

I'll provide a larger code snippet when I get a chance later today.
On Aug 20, 2015 9:19 AM, "Brian Carrier" <ca...@sl...> wrote:

> Never mind.  I was using an older version of the sample database.  Both
> the tutorial and %jpg work for me. What does your input data look like
> (folders, file names, etc.).
>
>
>
> > On Aug 19, 2015, at 5:40 PM, Brian Carrier <ca...@sl...>
> wrote:
> >
> > Hi Justin,
> >
> > Interestingly, I can get the %jpg to work, but I found that the tutorial
> stopped working for me (it is not finding contacts.db - or at least not
> making artifacts for it).  let me debug this to see if I checked in the
> wrong final code / sample data.
> >
> > brian
> >
> >> On Aug 19, 2015, at 12:26 PM, Justin Grover <jus...@gm...>
> wrote:
> >>
> >> Note...I found what I think is a bug while following Tutorial #2.  If
> you run a python Data Source Ingest Module against a LogicalFileSet, the
> following will not work from the Tutorial:
> >>
> >> files = fileManager.findFiles(dataSource, "contacts.db")
> >>
> >> I've been trying to point Autopsy against a logical directory of JPGs
> and using "%jpg" as my search string and it won't find any of them.
> However, when I switch my Data Source to be an image (instead of a
> LogicalFileSet), it works just fine.
> >>
> >> -Justin
> >>
> >> On Mon, Aug 17, 2015 at 6:38 PM, <
> sle...@li...> wrote:
> >> Send sleuthkit-users mailing list submissions to
> >>        sle...@li...
> >>
> >> To subscribe or unsubscribe via the World Wide Web, visit
> >>        https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> >> or, via email, send a message with subject or body 'help' to
> >>        sle...@li...
> >>
> >> You can reach the person managing the list at
> >>        sle...@li...
> >>
> >> When replying, please edit your Subject line so it is more specific
> >> than "Re: Contents of sleuthkit-users digest..."
> >>
> >>
> >> Today's Topics:
> >>
> >>   1. Autopsy Python Tutorial #2: Data Source Ingest    Modules
> >>      (Brian Carrier)
> >>   2. Timeline Survey Question (Brian Carrier)
> >>
> >>
> >> ----------------------------------------------------------------------
> >>
> >> Message: 1
> >> Date: Mon, 17 Aug 2015 18:01:05 -0400
> >> From: Brian Carrier <ca...@sl...>
> >> Subject: [sleuthkit-users] Autopsy Python Tutorial #2: Data Source
> >>        Ingest  Modules
> >> To: sleuthkit-users <sle...@li...>
> >> Message-ID: <889...@sl...>
> >> Content-Type: text/plain; charset=utf-8
> >>
> >> To help you put $1000 in your pocket as part of the OSDFCon Autopsy
> Module challenge (
> http://www.osdfcon.org/2015-event/2015-module-development-contest/),
> Basis Technology released another Python tutorial.
> >>
> >>
> http://www.basistech.com/python-autopsy-module-tutorial-2-the-data-source-ingest-module/
> >>
> >> This one is on writing Python-based data source ingest modules and it
> covers two topics:
> >> 1) Finding a SQLite database, parsing it, and making blackboard
> artifacts
> >> 2) Writing a wrapper around a command line tool that takes a disk image
> as input
> >>
> >> Final source code is included (which can be used as part of a challenge
> submission with a little copy and pasting?.).
> >>
> >> We also uploaded final source code for the first tutorial (on finding
> big and round files) for those who followed that one:
> >>
> >>
> https://github.com/sleuthkit/autopsy/tree/develop/pythonExamples/July2015FileTutorial_BigRound
> >>
> >> Enjoy!
> >>
> >> brian
> >>
> >>
> >>
> >>
> >>
> >> ------------------------------
> >>
> >> Message: 2
> >> Date: Mon, 17 Aug 2015 18:38:13 -0400
> >> From: Brian Carrier <ca...@sl...>
> >> Subject: [sleuthkit-users] Timeline Survey Question
> >> To: sleuthkit-users <sle...@li...>
> >> Message-ID: <902...@sl...>
> >> Content-Type: text/plain; charset="utf-8"
> >>
> >> We?re reviewing some changes to the timeline module and wanted some
> feedback.
> >>
> >> Background: In the ?details? view, we currently cluster together events
> if they happen close to each other.  But, once there is a gap in events in
> a certain folder (or URL), then we break the cluster in the UI.  This means
> that you could  have clusters for the same folder (Program Files in the
> below example) that span multiple clusters.  Notice in this image below,
> there are three ?Program Files? clusters (two in the top row and one in the
> fifth row).   The motivation for this was that it would be useful to know
> that there was a gap in between the clusters of events.
> >>
> >>
> >>
> >>
> >>
> >>
> >> We are looking at an alternative, which is to have a single cluster for
> the entire view (regardless of it there is a gap). This means that even if
> there are only events at left of the screen and right then it would be a
> solid band. It would look something like this:
> >>
> >>
> >>
> >>
> >> The benefit of this would be that it would be obvious of all of the
> events in the given description (folder name, for example) and we would
> waste less space rewriting the name so often.  It comes at the potential
> downside though that it may take more vertical space because we could have
> lots of sparse bands.
> >>
> >> Opinions?
> >>
> >>
> >> -------------- next part --------------
> >> An HTML attachment was scrubbed...
> >> -------------- next part --------------
> >> A non-text attachment was scrubbed...
> >> Name: events_current.png
> >> Type: image/png
> >> Size: 76116 bytes
> >> Desc: not available
> >> -------------- next part --------------
> >> A non-text attachment was scrubbed...
> >> Name: events_spans.png
> >> Type: image/png
> >> Size: 44972 bytes
> >> Desc: not available
> >>
> >> ------------------------------
> >>
> >>
> ------------------------------------------------------------------------------
> >>
> >>
> >> ------------------------------
> >>
> >> _______________________________________________
> >> sleuthkit-users mailing list
> >> sle...@li...
> >> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> >>
> >>
> >> End of sleuthkit-users Digest, Vol 110, Issue 2
> >> ***********************************************
> >>
> >>
> ------------------------------------------------------------------------------
> >> _______________________________________________
> >> sleuthkit-users mailing list
> >> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> >> http://www.sleuthkit.org
> >
> >
> >
> ------------------------------------------------------------------------------
> > _______________________________________________
> > sleuthkit-users mailing list
> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > http://www.sleuthkit.org
>
>

Re: [sleuthkit-users] [sleuthkit-developers] Java Bindings Update

[Brian C. <ca...@sl...>]

Thanks Stuart.  Just to be clear, the main difference between your bindings and the one that ships with TSK is that the “official” one relies on SQLite and JNI while yours is 100% JNI, right?

thanks,
brian



> On Aug 20, 2015, at 3:12 AM, Stuart Maclean <st...@ap...> wrote:
> 
> I have been working on some Java bindings to Sleuthkit for a good while,
> and have finally found time to upload to github.  As of today I finished the README and converted the develop branch into master and tagged.
> 
> https://github.com/uw-dims/tsk4j/
> 
> Feedback welcomed.
> 
> Stuart
> 
> 
> ------------------------------------------------------------------------------
> _______________________________________________
> sleuthkit-developers mailing list
> sle...@li...
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-developers

Re: [sleuthkit-users] Autopsy Python Tutorial #2: Data Source Ingest Modules

[Brian C. <ca...@sl...>]

Never mind.  I was using an older version of the sample database.  Both the tutorial and %jpg work for me. What does your input data look like (folders, file names, etc.).



> On Aug 19, 2015, at 5:40 PM, Brian Carrier <ca...@sl...> wrote:
> 
> Hi Justin,
> 
> Interestingly, I can get the %jpg to work, but I found that the tutorial stopped working for me (it is not finding contacts.db - or at least not making artifacts for it).  let me debug this to see if I checked in the wrong final code / sample data.
> 
> brian
> 
>> On Aug 19, 2015, at 12:26 PM, Justin Grover <jus...@gm...> wrote:
>> 
>> Note...I found what I think is a bug while following Tutorial #2.  If you run a python Data Source Ingest Module against a LogicalFileSet, the following will not work from the Tutorial:
>> 
>> files = fileManager.findFiles(dataSource, "contacts.db")
>> 
>> I've been trying to point Autopsy against a logical directory of JPGs and using "%jpg" as my search string and it won't find any of them.  However, when I switch my Data Source to be an image (instead of a LogicalFileSet), it works just fine.
>> 
>> -Justin
>> 
>> On Mon, Aug 17, 2015 at 6:38 PM, <sle...@li...> wrote:
>> Send sleuthkit-users mailing list submissions to
>>        sle...@li...
>> 
>> To subscribe or unsubscribe via the World Wide Web, visit
>>        https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> or, via email, send a message with subject or body 'help' to
>>        sle...@li...
>> 
>> You can reach the person managing the list at
>>        sle...@li...
>> 
>> When replying, please edit your Subject line so it is more specific
>> than "Re: Contents of sleuthkit-users digest..."
>> 
>> 
>> Today's Topics:
>> 
>>   1. Autopsy Python Tutorial #2: Data Source Ingest    Modules
>>      (Brian Carrier)
>>   2. Timeline Survey Question (Brian Carrier)
>> 
>> 
>> ----------------------------------------------------------------------
>> 
>> Message: 1
>> Date: Mon, 17 Aug 2015 18:01:05 -0400
>> From: Brian Carrier <ca...@sl...>
>> Subject: [sleuthkit-users] Autopsy Python Tutorial #2: Data Source
>>        Ingest  Modules
>> To: sleuthkit-users <sle...@li...>
>> Message-ID: <889...@sl...>
>> Content-Type: text/plain; charset=utf-8
>> 
>> To help you put $1000 in your pocket as part of the OSDFCon Autopsy Module challenge (http://www.osdfcon.org/2015-event/2015-module-development-contest/), Basis Technology released another Python tutorial.
>> 
>>    http://www.basistech.com/python-autopsy-module-tutorial-2-the-data-source-ingest-module/
>> 
>> This one is on writing Python-based data source ingest modules and it covers two topics:
>> 1) Finding a SQLite database, parsing it, and making blackboard artifacts
>> 2) Writing a wrapper around a command line tool that takes a disk image as input
>> 
>> Final source code is included (which can be used as part of a challenge submission with a little copy and pasting?.).
>> 
>> We also uploaded final source code for the first tutorial (on finding big and round files) for those who followed that one:
>> 
>>    https://github.com/sleuthkit/autopsy/tree/develop/pythonExamples/July2015FileTutorial_BigRound
>> 
>> Enjoy!
>> 
>> brian
>> 
>> 
>> 
>> 
>> 
>> ------------------------------
>> 
>> Message: 2
>> Date: Mon, 17 Aug 2015 18:38:13 -0400
>> From: Brian Carrier <ca...@sl...>
>> Subject: [sleuthkit-users] Timeline Survey Question
>> To: sleuthkit-users <sle...@li...>
>> Message-ID: <902...@sl...>
>> Content-Type: text/plain; charset="utf-8"
>> 
>> We?re reviewing some changes to the timeline module and wanted some feedback.
>> 
>> Background: In the ?details? view, we currently cluster together events if they happen close to each other.  But, once there is a gap in events in a certain folder (or URL), then we break the cluster in the UI.  This means that you could  have clusters for the same folder (Program Files in the below example) that span multiple clusters.  Notice in this image below, there are three ?Program Files? clusters (two in the top row and one in the fifth row).   The motivation for this was that it would be useful to know that there was a gap in between the clusters of events.
>> 
>> 
>> 
>> 
>> 
>> 
>> We are looking at an alternative, which is to have a single cluster for the entire view (regardless of it there is a gap). This means that even if there are only events at left of the screen and right then it would be a solid band. It would look something like this:
>> 
>> 
>> 
>> 
>> The benefit of this would be that it would be obvious of all of the events in the given description (folder name, for example) and we would waste less space rewriting the name so often.  It comes at the potential downside though that it may take more vertical space because we could have lots of sparse bands.
>> 
>> Opinions?
>> 
>> 
>> -------------- next part --------------
>> An HTML attachment was scrubbed...
>> -------------- next part --------------
>> A non-text attachment was scrubbed...
>> Name: events_current.png
>> Type: image/png
>> Size: 76116 bytes
>> Desc: not available
>> -------------- next part --------------
>> A non-text attachment was scrubbed...
>> Name: events_spans.png
>> Type: image/png
>> Size: 44972 bytes
>> Desc: not available
>> 
>> ------------------------------
>> 
>> ------------------------------------------------------------------------------
>> 
>> 
>> ------------------------------
>> 
>> _______________________________________________
>> sleuthkit-users mailing list
>> sle...@li...
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> 
>> 
>> End of sleuthkit-users Digest, Vol 110, Issue 2
>> ***********************************************
>> 
>> ------------------------------------------------------------------------------
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
> 
> 
> ------------------------------------------------------------------------------
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

[sleuthkit-users] Java Bindings Update

[Stuart M. <st...@ap...>]

I have been working on some Java bindings to Sleuthkit for a good while,
and have finally found time to upload to github.  As of today I finished the README and converted the develop branch into master and tagged.

https://github.com/uw-dims/tsk4j/

Feedback welcomed.

Stuart

Re: [sleuthkit-users] Timeline Survey Question

[Nanni B. <dig...@gm...>]

Maybe is OT,  I would like to have a button to export the timeline report ;)

Re: [sleuthkit-users] Timeline Survey Question

[Brian C. <ca...@sl...>]

Thanks Derrick.  We could do both, but I don’t want too many options if we don’t need to because then it just makes it more complex and busy.

We aren’t sure about rendering times yet. 


> On Aug 19, 2015, at 10:56 AM, Derrick Karpo <dk...@gm...> wrote:
> 
> I can see applications and different preferences for both!  Is having
> both visualization options an option?
> 
> With the multiple cluster view I like being able to scan vertically
> and only see events which had hits in that time frame.  That said, my
> preference would be to only colour the matching event in that time
> frame and leave the rest of the event type name white.
> 
> With the single cluster view I like that I don't have to hunt around
> to see multiple events.  If I want to see just facebook.com events,
> they are all there in a single event.  Even though I think this view
> will take up a lot more vertical space I also like how the events are
> grouped.  ie. All NTFS $* are grouped horizontally which I think makes
> ignoring specific events easier.  Again, I'm not a fan of the colours
> and would like to see it be coloured (event hit) and white (non-hit)
> both for viewing purposes (colour blind people) and printing purposes
> (disclosure).
> 
> As an aside, Is either view significantly faster to render?
> 
> Derrick
> 
> 
> On Mon, Aug 17, 2015 at 5:06 PM, Alex Nelson <ajn...@cs...> wrote:
>> They’re interesting visualizations.  The examples may be better with some examples of longer names (/deeper hierarchies/longer URLs) to get a better feel of cuts taken for horizontal clutter.
>> 
>> —Alex
>> 
>> 
>>> On Aug 17, 2015, at 18:38 , Brian Carrier <ca...@sl...> wrote:
>>> 
>>> We’re reviewing some changes to the timeline module and wanted some feedback.
>>> 
>>> Background: In the “details” view, we currently cluster together events if they happen close to each other.  But, once there is a gap in events in a certain folder (or URL), then we break the cluster in the UI.  This means that you could  have clusters for the same folder (Program Files in the below example) that span multiple clusters.  Notice in this image below, there are three “Program Files” clusters (two in the top row and one in the fifth row).   The motivation for this was that it would be useful to know that there was a gap in between the clusters of events.
>>> 
>>> 
>>> 
>>> <events_current.png>
>>> 
>>> 
>>> We are looking at an alternative, which is to have a single cluster for the entire view (regardless of it there is a gap). This means that even if there are only events at left of the screen and right then it would be a solid band. It would look something like this:
>>> 
>>> <events_spans.png>
>>> 
>>> 
>>> The benefit of this would be that it would be obvious of all of the events in the given description (folder name, for example) and we would waste less space rewriting the name so often.  It comes at the potential downside though that it may take more vertical space because we could have lots of sparse bands.
>>> 
>>> Opinions?
>>> 
>>> 
>>> ------------------------------------------------------------------------------
>>> _______________________________________________
>>> sleuthkit-users mailing list
>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>> http://www.sleuthkit.org
>> 
>> 
>> ------------------------------------------------------------------------------
>> 
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>> 
> 
> ------------------------------------------------------------------------------
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] Timeline Survey Question

[Brian C. <ca...@sl...>]

Thanks Alex.  I’m not sure there is an easy way to get realistic data w/out just building it.  We were more curious if there ere strong opinions for or against it before we spent the time doing it. 

> On Aug 17, 2015, at 7:06 PM, Alex Nelson <ajn...@cs...> wrote:
> 
> They’re interesting visualizations.  The examples may be better with some examples of longer names (/deeper hierarchies/longer URLs) to get a better feel of cuts taken for horizontal clutter.
> 
> —Alex
> 
> 
>> On Aug 17, 2015, at 18:38 , Brian Carrier <ca...@sl...> wrote:
>> 
>> We’re reviewing some changes to the timeline module and wanted some feedback. 
>> 
>> Background: In the “details” view, we currently cluster together events if they happen close to each other.  But, once there is a gap in events in a certain folder (or URL), then we break the cluster in the UI.  This means that you could  have clusters for the same folder (Program Files in the below example) that span multiple clusters.  Notice in this image below, there are three “Program Files” clusters (two in the top row and one in the fifth row).   The motivation for this was that it would be useful to know that there was a gap in between the clusters of events.  
>> 
>> 
>> 
>> <events_current.png>
>> 
>> 
>> We are looking at an alternative, which is to have a single cluster for the entire view (regardless of it there is a gap). This means that even if there are only events at left of the screen and right then it would be a solid band. It would look something like this:
>> 
>> <events_spans.png>
>> 
>> 
>> The benefit of this would be that it would be obvious of all of the events in the given description (folder name, for example) and we would waste less space rewriting the name so often.  It comes at the potential downside though that it may take more vertical space because we could have lots of sparse bands. 
>> 
>> Opinions?
>> 
>> 
>> ------------------------------------------------------------------------------
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
> 
> ------------------------------------------------------------------------------
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] Autopsy Python Tutorial #2: Data Source Ingest Modules

[Brian C. <ca...@sl...>]

Hi Justin,

Interestingly, I can get the %jpg to work, but I found that the tutorial stopped working for me (it is not finding contacts.db - or at least not making artifacts for it).  let me debug this to see if I checked in the wrong final code / sample data.

brian

> On Aug 19, 2015, at 12:26 PM, Justin Grover <jus...@gm...> wrote:
> 
> Note...I found what I think is a bug while following Tutorial #2.  If you run a python Data Source Ingest Module against a LogicalFileSet, the following will not work from the Tutorial:
> 
> files = fileManager.findFiles(dataSource, "contacts.db")
> 
> I've been trying to point Autopsy against a logical directory of JPGs and using "%jpg" as my search string and it won't find any of them.  However, when I switch my Data Source to be an image (instead of a LogicalFileSet), it works just fine.
> 
> -Justin
> 
> On Mon, Aug 17, 2015 at 6:38 PM, <sle...@li...> wrote:
> Send sleuthkit-users mailing list submissions to
>         sle...@li...
> 
> To subscribe or unsubscribe via the World Wide Web, visit
>         https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> or, via email, send a message with subject or body 'help' to
>         sle...@li...
> 
> You can reach the person managing the list at
>         sle...@li...
> 
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of sleuthkit-users digest..."
> 
> 
> Today's Topics:
> 
>    1. Autopsy Python Tutorial #2: Data Source Ingest    Modules
>       (Brian Carrier)
>    2. Timeline Survey Question (Brian Carrier)
> 
> 
> ----------------------------------------------------------------------
> 
> Message: 1
> Date: Mon, 17 Aug 2015 18:01:05 -0400
> From: Brian Carrier <ca...@sl...>
> Subject: [sleuthkit-users] Autopsy Python Tutorial #2: Data Source
>         Ingest  Modules
> To: sleuthkit-users <sle...@li...>
> Message-ID: <889...@sl...>
> Content-Type: text/plain; charset=utf-8
> 
> To help you put $1000 in your pocket as part of the OSDFCon Autopsy Module challenge (http://www.osdfcon.org/2015-event/2015-module-development-contest/), Basis Technology released another Python tutorial.
> 
>     http://www.basistech.com/python-autopsy-module-tutorial-2-the-data-source-ingest-module/
> 
> This one is on writing Python-based data source ingest modules and it covers two topics:
> 1) Finding a SQLite database, parsing it, and making blackboard artifacts
> 2) Writing a wrapper around a command line tool that takes a disk image as input
> 
> Final source code is included (which can be used as part of a challenge submission with a little copy and pasting?.).
> 
> We also uploaded final source code for the first tutorial (on finding big and round files) for those who followed that one:
> 
>     https://github.com/sleuthkit/autopsy/tree/develop/pythonExamples/July2015FileTutorial_BigRound
> 
> Enjoy!
> 
> brian
> 
> 
> 
> 
> 
> ------------------------------
> 
> Message: 2
> Date: Mon, 17 Aug 2015 18:38:13 -0400
> From: Brian Carrier <ca...@sl...>
> Subject: [sleuthkit-users] Timeline Survey Question
> To: sleuthkit-users <sle...@li...>
> Message-ID: <902...@sl...>
> Content-Type: text/plain; charset="utf-8"
> 
> We?re reviewing some changes to the timeline module and wanted some feedback.
> 
> Background: In the ?details? view, we currently cluster together events if they happen close to each other.  But, once there is a gap in events in a certain folder (or URL), then we break the cluster in the UI.  This means that you could  have clusters for the same folder (Program Files in the below example) that span multiple clusters.  Notice in this image below, there are three ?Program Files? clusters (two in the top row and one in the fifth row).   The motivation for this was that it would be useful to know that there was a gap in between the clusters of events.
> 
> 
> 
> 
> 
> 
> We are looking at an alternative, which is to have a single cluster for the entire view (regardless of it there is a gap). This means that even if there are only events at left of the screen and right then it would be a solid band. It would look something like this:
> 
> 
> 
> 
> The benefit of this would be that it would be obvious of all of the events in the given description (folder name, for example) and we would waste less space rewriting the name so often.  It comes at the potential downside though that it may take more vertical space because we could have lots of sparse bands.
> 
> Opinions?
> 
> 
> -------------- next part --------------
> An HTML attachment was scrubbed...
> -------------- next part --------------
> A non-text attachment was scrubbed...
> Name: events_current.png
> Type: image/png
> Size: 76116 bytes
> Desc: not available
> -------------- next part --------------
> A non-text attachment was scrubbed...
> Name: events_spans.png
> Type: image/png
> Size: 44972 bytes
> Desc: not available
> 
> ------------------------------
> 
> ------------------------------------------------------------------------------
> 
> 
> ------------------------------
> 
> _______________________________________________
> sleuthkit-users mailing list
> sle...@li...
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> 
> 
> End of sleuthkit-users Digest, Vol 110, Issue 2
> ***********************************************
> 
> ------------------------------------------------------------------------------
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

[sleuthkit-users] Autopsy Python Tutorial #2: Data Source Ingest Modules

[Justin G. <jus...@gm...>]

Note...I found what I think is a bug while following Tutorial #2.  If you
run a python Data Source Ingest Module against a *LogicalFileSet*, the
following will not work from the Tutorial:

files = fileManager.findFiles(dataSource, "contacts.db")


I've been trying to point Autopsy against a logical directory of JPGs and
using "%jpg" as my search string and it won't find any of them.  However,
when I switch my Data Source to be an image (instead of a LogicalFileSet),
it works just fine.

-Justin

On Mon, Aug 17, 2015 at 6:38 PM, <
sle...@li...> wrote:

> Send sleuthkit-users mailing list submissions to
>         sle...@li...
>
> To subscribe or unsubscribe via the World Wide Web, visit
>         https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> or, via email, send a message with subject or body 'help' to
>         sle...@li...
>
> You can reach the person managing the list at
>         sle...@li...
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of sleuthkit-users digest..."
>
>
> Today's Topics:
>
>    1. Autopsy Python Tutorial #2: Data Source Ingest    Modules
>       (Brian Carrier)
>    2. Timeline Survey Question (Brian Carrier)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Mon, 17 Aug 2015 18:01:05 -0400
> From: Brian Carrier <ca...@sl...>
> Subject: [sleuthkit-users] Autopsy Python Tutorial #2: Data Source
>         Ingest  Modules
> To: sleuthkit-users <sle...@li...>
> Message-ID: <889...@sl...>
> Content-Type: text/plain; charset=utf-8
>
> To help you put $1000 in your pocket as part of the OSDFCon Autopsy Module
> challenge (
> http://www.osdfcon.org/2015-event/2015-module-development-contest/),
> Basis Technology released another Python tutorial.
>
>
> http://www.basistech.com/python-autopsy-module-tutorial-2-the-data-source-ingest-module/
>
> This one is on writing Python-based data source ingest modules and it
> covers two topics:
> 1) Finding a SQLite database, parsing it, and making blackboard artifacts
> 2) Writing a wrapper around a command line tool that takes a disk image as
> input
>
> Final source code is included (which can be used as part of a challenge
> submission with a little copy and pasting?.).
>
> We also uploaded final source code for the first tutorial (on finding big
> and round files) for those who followed that one:
>
>
> https://github.com/sleuthkit/autopsy/tree/develop/pythonExamples/July2015FileTutorial_BigRound
>
> Enjoy!
>
> brian
>
>
>
>
>
> ------------------------------
>
> Message: 2
> Date: Mon, 17 Aug 2015 18:38:13 -0400
> From: Brian Carrier <ca...@sl...>
> Subject: [sleuthkit-users] Timeline Survey Question
> To: sleuthkit-users <sle...@li...>
> Message-ID: <902...@sl...>
> Content-Type: text/plain; charset="utf-8"
>
> We?re reviewing some changes to the timeline module and wanted some
> feedback.
>
> Background: In the ?details? view, we currently cluster together events if
> they happen close to each other.  But, once there is a gap in events in a
> certain folder (or URL), then we break the cluster in the UI.  This means
> that you could  have clusters for the same folder (Program Files in the
> below example) that span multiple clusters.  Notice in this image below,
> there are three ?Program Files? clusters (two in the top row and one in the
> fifth row).   The motivation for this was that it would be useful to know
> that there was a gap in between the clusters of events.
>
>
>
>
>
>
> We are looking at an alternative, which is to have a single cluster for
> the entire view (regardless of it there is a gap). This means that even if
> there are only events at left of the screen and right then it would be a
> solid band. It would look something like this:
>
>
>
>
> The benefit of this would be that it would be obvious of all of the events
> in the given description (folder name, for example) and we would waste less
> space rewriting the name so often.  It comes at the potential downside
> though that it may take more vertical space because we could have lots of
> sparse bands.
>
> Opinions?
>
>
> -------------- next part --------------
> An HTML attachment was scrubbed...
> -------------- next part --------------
> A non-text attachment was scrubbed...
> Name: events_current.png
> Type: image/png
> Size: 76116 bytes
> Desc: not available
> -------------- next part --------------
> A non-text attachment was scrubbed...
> Name: events_spans.png
> Type: image/png
> Size: 44972 bytes
> Desc: not available
>
> ------------------------------
>
>
> ------------------------------------------------------------------------------
>
>
> ------------------------------
>
> _______________________________________________
> sleuthkit-users mailing list
> sle...@li...
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>
>
> End of sleuthkit-users Digest, Vol 110, Issue 2
> ***********************************************
>

Re: [sleuthkit-users] Timeline Survey Question

[Derrick K. <dk...@gm...>]

I can see applications and different preferences for both!  Is having
both visualization options an option?

With the multiple cluster view I like being able to scan vertically
and only see events which had hits in that time frame.  That said, my
preference would be to only colour the matching event in that time
frame and leave the rest of the event type name white.

With the single cluster view I like that I don't have to hunt around
to see multiple events.  If I want to see just facebook.com events,
they are all there in a single event.  Even though I think this view
will take up a lot more vertical space I also like how the events are
grouped.  ie. All NTFS $* are grouped horizontally which I think makes
ignoring specific events easier.  Again, I'm not a fan of the colours
and would like to see it be coloured (event hit) and white (non-hit)
both for viewing purposes (colour blind people) and printing purposes
(disclosure).

As an aside, Is either view significantly faster to render?

Derrick


On Mon, Aug 17, 2015 at 5:06 PM, Alex Nelson <ajn...@cs...> wrote:
> They’re interesting visualizations.  The examples may be better with some examples of longer names (/deeper hierarchies/longer URLs) to get a better feel of cuts taken for horizontal clutter.
>
> —Alex
>
>
>> On Aug 17, 2015, at 18:38 , Brian Carrier <ca...@sl...> wrote:
>>
>> We’re reviewing some changes to the timeline module and wanted some feedback.
>>
>> Background: In the “details” view, we currently cluster together events if they happen close to each other.  But, once there is a gap in events in a certain folder (or URL), then we break the cluster in the UI.  This means that you could  have clusters for the same folder (Program Files in the below example) that span multiple clusters.  Notice in this image below, there are three “Program Files” clusters (two in the top row and one in the fifth row).   The motivation for this was that it would be useful to know that there was a gap in between the clusters of events.
>>
>>
>>
>> <events_current.png>
>>
>>
>> We are looking at an alternative, which is to have a single cluster for the entire view (regardless of it there is a gap). This means that even if there are only events at left of the screen and right then it would be a solid band. It would look something like this:
>>
>> <events_spans.png>
>>
>>
>> The benefit of this would be that it would be obvious of all of the events in the given description (folder name, for example) and we would waste less space rewriting the name so often.  It comes at the potential downside though that it may take more vertical space because we could have lots of sparse bands.
>>
>> Opinions?
>>
>>
>> ------------------------------------------------------------------------------
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>
>
> ------------------------------------------------------------------------------
>
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>

[sleuthkit-users] Java Bindings to Sleuthkit

[Stuart M. <st...@ap...>]

I have been working on some Java bindings to Sleuthkit for a good while, 
and have finally found time to upload to github. Currently it's all on 
the 'develop' branch, as you can see from the url. Master release to follow.

https://github.com/uw-dims/tsk4j/tree/develop

Feedback welcomed.

Stuart

Re: [sleuthkit-users] Timeline Survey Question

[Alex N. <ajn...@cs...>]

They’re interesting visualizations.  The examples may be better with some examples of longer names (/deeper hierarchies/longer URLs) to get a better feel of cuts taken for horizontal clutter.

—Alex


> On Aug 17, 2015, at 18:38 , Brian Carrier <ca...@sl...> wrote:
> 
> We’re reviewing some changes to the timeline module and wanted some feedback. 
> 
> Background: In the “details” view, we currently cluster together events if they happen close to each other.  But, once there is a gap in events in a certain folder (or URL), then we break the cluster in the UI.  This means that you could  have clusters for the same folder (Program Files in the below example) that span multiple clusters.  Notice in this image below, there are three “Program Files” clusters (two in the top row and one in the fifth row).   The motivation for this was that it would be useful to know that there was a gap in between the clusters of events.  
> 
> 
> 
> <events_current.png>
> 
> 
> We are looking at an alternative, which is to have a single cluster for the entire view (regardless of it there is a gap). This means that even if there are only events at left of the screen and right then it would be a solid band. It would look something like this:
> 
> <events_spans.png>
> 
> 
> The benefit of this would be that it would be obvious of all of the events in the given description (folder name, for example) and we would waste less space rewriting the name so often.  It comes at the potential downside though that it may take more vertical space because we could have lots of sparse bands. 
> 
> Opinions?
> 
> 
> ------------------------------------------------------------------------------
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

[sleuthkit-users] Timeline Survey Question

[Brian C. <ca...@sl...>]

We’re reviewing some changes to the timeline module and wanted some feedback. 

Background: In the “details” view, we currently cluster together events if they happen close to each other.  But, once there is a gap in events in a certain folder (or URL), then we break the cluster in the UI.  This means that you could  have clusters for the same folder (Program Files in the below example) that span multiple clusters.  Notice in this image below, there are three “Program Files” clusters (two in the top row and one in the fifth row).   The motivation for this was that it would be useful to know that there was a gap in between the clusters of events.  






We are looking at an alternative, which is to have a single cluster for the entire view (regardless of it there is a gap). This means that even if there are only events at left of the screen and right then it would be a solid band. It would look something like this:




The benefit of this would be that it would be obvious of all of the events in the given description (folder name, for example) and we would waste less space rewriting the name so often.  It comes at the potential downside though that it may take more vertical space because we could have lots of sparse bands. 

Opinions?

[sleuthkit-users] Autopsy Python Tutorial #2: Data Source Ingest Modules

[Brian C. <ca...@sl...>]

To help you put $1000 in your pocket as part of the OSDFCon Autopsy Module challenge (http://www.osdfcon.org/2015-event/2015-module-development-contest/), Basis Technology released another Python tutorial. 

    http://www.basistech.com/python-autopsy-module-tutorial-2-the-data-source-ingest-module/

This one is on writing Python-based data source ingest modules and it covers two topics:
1) Finding a SQLite database, parsing it, and making blackboard artifacts
2) Writing a wrapper around a command line tool that takes a disk image as input

Final source code is included (which can be used as part of a challenge submission with a little copy and pasting….).

We also uploaded final source code for the first tutorial (on finding big and round files) for those who followed that one:

    https://github.com/sleuthkit/autopsy/tree/develop/pythonExamples/July2015FileTutorial_BigRound

Enjoy!

brian

Re: [sleuthkit-users] Millions of orphan files found with sleuthkit develop branch

[Luís F. N. <lfc...@gm...>]

This error have happened again with a colleague's NTFS image, using the
develop branch compiled about 1 month ago. Thousands of huge corrupted
orphans were added by loaddb, which caused our processing application (and
probably Autopsy too) to process indefinitely the evidence.

Any help will be appreciated.

Regards,
Luis Nassif

2014-09-30 21:00 GMT-03:00 Luís Filipe Nassif <lfc...@gm...>:

> This problem still happens with 4.2.0 branch. If I can help with some more
> information, please let me know.
>
> Thanks
> Luis
>
> 2014-07-24 9:21 GMT-03:00 Luís Filipe Nassif <lfc...@gm...>:
>
>> Another information: the sum of the millions of file sizes resulted in
>> 1,1 petabyte, while the image has only 250 GB.
>>
>>
>> 2014-07-23 22:21 GMT-03:00 Luís Filipe Nassif <lfc...@gm...>:
>>
>>> We tested loaddb of both the released 4.1.3 version and the develop
>>> branch of sleuthkit on a NTFS image of a hard disk with a lot of bad
>>> blocks, many of them at the beginning of the disk.
>>>
>>> The 4.1.3 version found ~400.000 allocated files more ~100.000 orphan
>>> files, about the same found by other forensic tools. The develop branch
>>> found the same ~400.000 allocated files more ~2.500.000 orphan files! Most
>>> of these millions of orphans have corrupted names or the name
>>> OrphanFile-xxxxxxx and have lengths ranging from 0 to 4.294.967.296 bytes.
>>> We think the recent changes to NTFS code are causing this large number of
>>> corrupted orphans to be added to the case. Maybe it should be investigated
>>> before the final 4.2 release.
>>>
>>> Luis
>>>
>>
>>
>

[sleuthkit-users] OSDFCon Program is Up

[Brian C. <ca...@sl...>]

The crowd sourcing for the Open Source Digital Forensics Conference (OSDFCon) agenda finished earlier in the month and the results are now up. 

We’re going to have talks from Google, Netflix, the Volatility Foundation, Stroz Friedberg, Basis Technology and others.  Topics to include: 
* Enterprise-scale incident response
* Memory forensics using Volatility
* Correlating forensic artifacts from multiple sources using Elastic
* Timeline analysis
* Reconstruction of events using NTFS data
* Updates to Autopsy, including collaboration features, Python scripting, and third-party recovery modules 
* and more!

More details and registration information is available at: 
    
    http://www.osdfcon.org/

OSDFCon will be held on October 28, 2015 in Herndon, VA and is free for government employees.  

As in past years, there will be workshops before the conference and a 1-day Autopsy training course after it. 

The Autopsy Module competition is also still open until October 16.  Start writing some Python code for cash prizes. 

    http://www.osdfcon.org/2015-event/2015-module-development-contest/


About OSDFCon

OSDFCon is focused on providing an environment for investigators to learn about open source tools and for developers to get feedback.  Each event has over 400 people and the 1-day agenda (chosen based on crowd sourcing) is packed with short talks. Come learn about new tools that can help in your investigations. 

Re: [sleuthkit-users] USB setupapi disk image

[Sarah A. <sa...@ny...>]

Thank you for the helpful information Kalin & Greg! I apologize, I had a
bug in my ingest module that was causing the setupapi log to not be marked
as a a TSK_INTERESTING_FILE_HIT.

If anyone is interested, here are a couple of examples with setupapi logs:
http://www.cfreds.nist.gov/Hacking_Case.html
http://digitalcorpora.org/corp/nps/scenarios/2009-m57-patents/drives-redacted/jo-2009-12-11-002.E01

-Sarah


On Tue, Jul 28, 2015 at 8:23 AM, Kalin KOZHUHAROV <me....@gm...>
wrote:

>
> On Jul 29, 2015 12:03 AM, "Sarah Ash" <sa...@ny...> wrote:
> >
> > For my digital forensics course, I am developing an Autopsy Python
> plugin that analyzes USB device history. I haven't yet located a sample
> forensics disk image that contains a setupapi log. The setupapi log would
> tell you when a USB device history was first installed. Any help locating a
> disk image would be greatly appreciated!
> >
> Why not create one ? Just a fresh install is fine, plug some USB storage
> devices and you are done.
>
> Since you will be focusing on file contents, AFAU, you can create a new
> small filesystem and copy only the files your module operates on.
>
> Kalin.
>

Re: [sleuthkit-users] USB setupapi disk image

[Kalin K. <me....@gm...>]

On Jul 29, 2015 12:03 AM, "Sarah Ash" <sa...@ny...> wrote:
>
> For my digital forensics course, I am developing an Autopsy Python plugin
that analyzes USB device history. I haven't yet located a sample forensics
disk image that contains a setupapi log. The setupapi log would tell you
when a USB device history was first installed. Any help locating a disk
image would be greatly appreciated!
>
Why not create one ? Just a fresh install is fine, plug some USB storage
devices and you are done.

Since you will be focusing on file contents, AFAU, you can create a new
small filesystem and copy only the files your module operates on.

Kalin.

[sleuthkit-users] USB setupapi disk image

[Sarah A. <sa...@ny...>]

For my digital forensics course, I am developing an Autopsy Python plugin
that analyzes USB device history. I haven't yet located a sample forensics
disk image that contains a setupapi log. The setupapi log would tell you
when a USB device history was first installed. Any help locating a disk
image would be greatly appreciated!

-Sarah Ash

[sleuthkit-users] btrfs

[Brian C. <ca...@sl...>]

There is a pull request for btrfs support in TSK.  Anyone here a BTRFS user that could help test this out? 

https://github.com/sleuthkit/sleuthkit/pull/413

[sleuthkit-users] Timeline Module Feedback

[Brian C. <ca...@sl...>]

We added a new timeline feature back in Autopsy 3.1.1 as part of some work we are doing under a DHS S&T contract and want to make sure we work on as many user requests as we can. 

If you have any ideas on how it could be better and what it is missing, can you shoot me an e-mail so that we have it recorded and can schedule it?

For context, most of the feedback to date has been around: 
- More filtering options.
- Highlighting files that have hashset hits and tags associated with them.

Anything else?

thanks,
brian

Re: [sleuthkit-users] Clonezilla Multi-Disk

[Tiago F. <tia...@gm...>]

Derrick, List,

Thank you very much! That worked like a charm! Seems the way to go is
to extract the several parts of the image and then use partclone like
you mentioned! Thanks for saving my ass!

On Sat, Jul 11, 2015 at 11:08 PM, Tiago Faria
<tia...@gm...> wrote:
> Seems like it. Well, it's going. Still another 50m for the first pen
> drive to be converted. I'll make sure to post the update.
>
> Thank you again for the help and guidance!
>
> On Sat, Jul 11, 2015 at 9:44 PM, Derrick Karpo <dk...@gm...> wrote:
>> Ah.  Is it perhaps because you now also have to use partclone to restore the
>> raw image from your uncompressed file?  Something like what they did here?
>>
>>
>> http://askubuntu.com/questions/453114/restoring-clonezilla-images-cat-gzip-partclone-not-working
>>
>> Derrick
>>
>> On Jul 11, 2015 13:14, "Tiago Faria" <tia...@gm...> wrote:
>>>
>>> Just some more information ... It seems the files I'm using don't
>>> contain a valid partition table:
>>>
>>> fdisk -l sde1.vfat-ptcl-img
>>>
>>> Disk sde1.vfat-ptcl-img: 15.6 GB, 15580242944 bytes
>>> 255 heads, 63 sectors/track, 1894 cylinders, total 30430162 sectors
>>> Units = sectors of 1 * 512 = 512 bytes
>>> Sector size (logical/physical): 512 bytes / 512 bytes
>>> I/O size (minimum/optimal): 512 bytes / 512 bytes
>>> Disk identifier: 0x00000000
>>>
>>> Disk sde1.vfat-ptcl-img doesn't contain a valid partition table
>>>
>>> Maybe the partition table is stored somewhere else. Here is the full
>>> information about a certain disk from the clone:
>>>
>>> http://i.imgur.com/WqfvwbP.png
>>>
>>> On Sat, Jul 11, 2015 at 7:53 PM, Tiago Faria
>>> <tia...@gm...> wrote:
>>> > Hi Derrick,
>>> >
>>> > First of all, thank you very much for getting back to me. I thought it
>>> > could be that so I used 7zip to extract the "main" file. Tried both
>>> > USB images I gathered from the evidence PC and the end result was as
>>> > expected: two files with the USBs sizes, however, when trying to add
>>> > as data source, the error is still there:
>>> >
>>> > Errors occured while ingesting image
>>> > 1. Cannot determine file system type (Sector offset: 0)
>>> >
>>> > I would have no problem extracting all three images and using the
>>> > resulting files as source, but it seems, at least for both these two
>>> > vFAT drives, that Autopsy is having a problem with it as well.
>>> >
>>> > This is happening under v3, however, I also used v2 under GNU/Linux
>>> > and had a similar result.
>>> >
>>> > Any tips?
>>> >
>>> > Once again, thank you for your help!
>>> >
>>> > On Sat, Jul 11, 2015 at 7:25 PM, Derrick Karpo <dk...@gm...> wrote:
>>> >> Hi Tiago.
>>> >>
>>> >> I believe the issue you are seeing is that Clonezilla has created a
>>> >> split gzip image which sleuthkit does not accept.  Sleuthkit/Autopsy
>>> >> will support a split raw image, but not a split gzip image.  What you
>>> >> can do is uncompress your split image into a single raw image and that
>>> >> should work.  Something like this should work:
>>> >>
>>> >>   `cat sdd1.vfat-ptcl-img.gz.a* | gzip -d -c > sdd1.vfat-ptcl.img'
>>> >>
>>> >> Then add 'sdd1.vfat-ptcl.img' to Autopsy and see how that goes!
>>> >>
>>> >> Derrick
>>> >>
>>> >>
>>> >> On Sat, Jul 11, 2015 at 11:39 AM, Tiago Faria
>>> >> <tia...@gm...> wrote:
>>> >>> Hi list,
>>> >>>
>>> >>> I'm having quite a hard time importing a data source of a computer
>>> >>> that was clone with CloneZilla. It was a simple clone process with the
>>> >>> only different of also cloning the USB disk drives that were also
>>> >>> connected to the PC.
>>> >>>
>>> >>> The end result is something like this (only part of the content):
>>> >>>
>>> >>> http://i.imgur.com/CHiyGZr.png
>>> >>>
>>> >>> And I can't seem to add it as a data source, since I get the error:
>>> >>>
>>> >>> "Errors occured while ingesting image
>>> >>> 1. Cannot determine file system type (Sector offset: 0)"
>>> >>>
>>> >>> Any tips? I'm really worried since this is all I got and I won't have
>>> >>> access to the computer again.
>>> >>>
>>> >>> Thank you in advance!
>>> >>>
>>> >>> P.S.: Adding all parts of the archive as logical files seems to be
>>> >>> accepted, but nothing useful is gathered (not even time stamps are
>>> >>> displayed).
>>> >>>
>>> >>>
>>> >>> ------------------------------------------------------------------------------
>>> >>> Don't Limit Your Business. Reach for the Cloud.
>>> >>> GigeNET's Cloud Solutions provide you with the tools and support that
>>> >>> you need to offload your IT needs and focus on growing your business.
>>> >>> Configured For All Businesses. Start Your Cloud Today.
>>> >>> https://www.gigenetcloud.com/
>>> >>> _______________________________________________
>>> >>> sleuthkit-users mailing list
>>> >>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>> >>> http://www.sleuthkit.org