Custom Processing

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68

function CustomProcessor(casePath, caseName, processThis) {
  this.casePath = casePath;
  this.caseName = caseName;
  this.processThis = processThis;
  this.items = [];
  this.exceptions = [];
  this.out = {};
}

CustomProcessor.prototype.process = function() {
  try {
    var caseSettings = {};
    caseSettings['compound'] = false;
    caseSettings['name'] = this.caseName;
    caseSettings['description'] = 'Simple Case';
    caseSettings['investigator'] = 'Inspector Gadget';

    var currentCase = utilities.getCaseFactory().create(this.casePath + '/' + this.caseName, caseSettings);
    var processor = currentCase.createProcessor();

    var processingSettings = {};
    processingSettings['report_processing_status'] = 'physical_files';
    processingSettings['enable_custom_processing'] = ["text", "properties", "binary"];

    var parallelProcessingSettings = {};
    parallelProcessingSettings['worker_count'] = 2;
    parallelProcessingSettings['worker_memory'] = 2000;

    processor.setProcessingSettings(processingSettings);
    processor.setParallelProcessingSettings(parallelProcessingSettings);

    var self = this;
    processor.whenItemProcessed(function(callback) {
      try {
        var item = {};
        item['mimtype'] = callback.getMimeType();

        if(callback.getBinaryFile()) {
          item['path_to_binary'] = callback.getBinaryFile().toString();
        }

        item['properties'] = callback.getProperties();
        item['text'] = callback.getText();
        item['path'] = callback.getPath();
        self.items.push(item);
      } catch (err) {
        self.exceptions.push(err.message);
      }
    });

    var startTime = new Date().getTime().toString();
    var container = processor.newEvidenceContainer('Evidence-' + startTime);
    container.addFile(this.processThis);
    container.save();
    this.out['processing_started'] = startTime;
    processor.process();
    this.out['final_item_count'] = this.items.length;
    currentCase.close();
  } catch (err) {
    this.exceptions.push(err.message);
  }
  this.out['exceptions'] = this.exceptions;
  this.out['items'] = this.items;
  this.out['processing_finished'] = new Date().getTime().toString();
  return this.out;
}

$response.setBody(new CustomProcessor("/Cases", "CustomProcessing", "/Engines/9.0.0.171/doc/api").process())

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58

import time
import os

class CustomProcessor:

  def __init__(self, case_path, case_name, process_this):
    self.case_path = case_path
    self.case_name = case_name
    self.process_this = process_this
    self.out = {}
    self.exceptions = []
    self.items = []

  def when_item_processed(self, callback):
    try:
      item = {}
      item['mimetype'] = callback.getMimeType();

      if callback.getBinaryFile() is not None:
        item['path_to_binary'] = callback.getBinaryFile().toString()

      item['properties'] = callback.getProperties()
      item['text'] = callback.getText()
      item['path'] = callback.getPath()
      self.items.append(item)
    except Exception, e:
      self.exceptions.append(str(e))


  def process(self):
    try:
      case_settings = {"compound": False, "name": self.case_name, "description": "Simple Case", "investigator": "Inspector Gadget"}
      current_case = utilities.getCaseFactory().create(os.path.join(self.case_path, self.case_name), case_settings)
      processor = current_case.createProcessor()
      processing_settings = {"report_processing_status": "physical_files", "enable_custom_processing": ["text", "properties", "binary"]}
      parallel_processing_settings = {"worker_count": 2, "worker_memory": 2000}

      processor.setProcessingSettings(processing_settings)
      processor.setParallelProcessingSettings(parallel_processing_settings)
      processor.whenItemProcessed(self.when_item_processed)
      started = int(round(time.time() * 1000))
      container = processor.newEvidenceContainer("Evidence-" + str(started))
      container.addFile(self.process_this)
      container.save()
      self.out['processing_started'] = started
      processor.process()
      self.out['final_item_count'] = len(self.items)
      current_case.close()
    except Exception, e:
      self.exceptions.append(str(e))

    self.out['finished'] = int(round(time.time() * 1000))
    self.out['exceptions'] = self.exceptions
    self.out['items'] = self.items
    return self.out

processor = CustomProcessor("/Cases", "CustomProcessing", "/Engines/9.0.0.171/doc/api")
response.setBody(processor.process())