Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Automatic destinations #2278

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Automatic destinations #2278

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
556cf55
'#2277 Adds custom signatures to AutomaticDestinations and
patrickdalla Aug 2, 2024
aaee94f
'#2277 Register categories Automatic Destinations and
patrickdalla Aug 2, 2024
b403d94
'#2277 Adds Automatic Destinations and Custom Destinations subcategories
patrickdalla Aug 2, 2024
c782c3f
'#2277 Classify automatic and custom destinations links in respective
patrickdalla Aug 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions iped-app/resources/config/conf/CategoriesConfig.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,8 @@
]}
]},
{"name": "Windows Artifacts", "categories":[
{"name": "Automatic Destinations", "mimes": ["application/x-automaticdestinations","application/x-automaticdestinations-entry"]},
{"name": "Custom Destinations", "mimes": ["application/x-customdestinations","application/x-customdestinations-entry"]},
{"name": "Event Files", "mimes": ["application/x-elf-file", "application/x-elf-log"]},
{"name": "Event Records", "mimes": ["application/x-elf-record"]},
{"name": "Event Transcript", "mimes": ["application/x-event-transcript", "application/x-event-transcript-history", "application/x-event-transcript-inventory-app", "application/x-event-transcript-app-interactivity", "application/x-event-transcript-devices", "application/x-event-transcript-census", "application/x-event-transcript-networking"]},
Expand Down
2 changes: 2 additions & 0 deletions iped-app/resources/config/conf/CategoriesToExpand.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,8 @@ OLE files
Georeferenced Files
Peer-to-peer
Chrome Cache
Automatic Destinations
Custom Destinations
#Event Files

# Generates registry reports:
Expand Down
12 changes: 11 additions & 1 deletion iped-app/resources/config/conf/CustomSignatures.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1637,10 +1637,20 @@
</magic>
<glob pattern="*.ofc"/>
</mime-type>

<mime-type type="application/x-vlc-ini">
<sub-class-of type="text/x-ini"/>
<glob pattern="vlc-qt-interface.ini"/>
</mime-type>

<mime-type type="application/x-automaticdestinations">
<glob pattern="*.automaticDestinations-ms"/>
<sub-class-of type="application/x-tika-msoffice"/>
</mime-type>

<mime-type type="application/x-customdestinations">
<glob pattern="*.customDestinations-ms"/>
<sub-class-of type="application/x-tika-msoffice"/>
</mime-type>

</mime-info>
15 changes: 14 additions & 1 deletion iped-app/resources/scripts/tasks/RefineCategoryTask.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
/*
/*
* Script of Category Specialization based on item properties.
* Uses javascript language to allow flexibility in definitions.
*/
Expand Down Expand Up @@ -180,6 +180,18 @@ function process(e){
if(length == 0)
e.addCategory("Empty Files");


if (mime.equals("application/x-lnk")){
if (path.endsWith(".customdestinations-ms>>"+e.getName())){
e.setMediaTypeStr("application/x-customdestinations-entry");
e.addCategory("Custom Destinations");
}
if (path.endsWith(".automaticdestinations-ms>>"+e.getName())){
e.setMediaTypeStr("application/x-automaticdestinations-entry");
e.addCategory("Automatic Destinations");
}
}

if(inRecycle(e)){
e.addCategory("Windows Recycle");
if(e.getName().indexOf("$I") == 0)
Expand Down Expand Up @@ -456,6 +468,7 @@ function process(e){
e.addCategory("E-Mule");
}
}


// Custom Regripper Reports

Expand Down
Loading