I installed the data source ingest module for python from “Autopsy: Python Tutorial #2: Writing a Data Source Ingest Module” and I edit this part, to display the data from the Account.db in artifacts. However, after I run the code on Autopsy nothing appears and there is no error. Any advice?
# Open the DB using JDBC
try:
Class.forName("org.sqlite.JDBC").newInstance()
db_conn = DriverManager.getConnection("jdbc:sqlite:%s" % lcl_db_path)
except SQLException as e:
self.log(Level.INFO, "Could not open database file (not SQLite) " + file_obj.getName() + " (" + e.getMessage() + ")")
return IngestModule.ProcessResult.OK
# Query the search table in the database and get specific columns.
try:
stmt = db_conn.createStatement()
result_set = stmt.executeQuery("SELECT id,name,type,password FROM accounts")
except SQLException as e:
self.log(Level.INFO, "Error querying database for search table (" + e.getMessage() + ")")
return IngestModule.ProcessResult.OK
while result_set.next():
try:
_id = result_set.getString("id")
name = result_set.getString("name")
typr = result_set.getString("type")
password = result_set.getString("password")
except SQLException as e:
self.log(Level.INFO, "Error getting values from contacts table (" + e.getMessage() + ")")
# Make an artifact on the blackboard and give it attributes
artId1 = blackboard.getOrAddArtifactType("TSK_ALEXA_ARTIFACT", "Extract data search")
artifact1 = fileobj.newArtifact(artId1.getTypeID())
#Create Attributes
moduleName = "Ingest Data From Alexa Search DB"
attId1 = blackboard.getOrAddAttributeType("TSK_ID_ATTRIBUTE", BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING, "Time when the user required navigation")
atribute1 = BlackboardAttribute(attId1, moduleName, _id)
attId2 = blackboard.getOrAddAttributeType("TSK_NAME_ATTRIBUTE", BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING, "Time when Mapquest provided the direction ")
atribute2 = BlackboardAttribute(attId2, moduleName, name)
attId3 = blackboard.getOrAddAttributeType("TSK_TYPE_ATTRIBUTE", BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING, "List of places")
atribute3 = BlackboardAttribute(attId3, moduleName, type)
try:
artifact1.addAttribute(atribute1)
artifact1.addAttribute(atribute2)
artifact1.addAttribute(atribute3)
except:
self.log(Level.INFO, "Error adding atribute to artifact")
try:
blackboard.postArtifact(artifact, moduleName)
except:
self.log(Level.INFO, "Error posting artifact")
# Clean up
stmt.close()
db_conn.close()
os.remove(lcl_db_path)