This file is indexed.

/usr/share/autopsy/lib/Print.pm is in autopsy 2.24-3.

This file is owned by root:root, with mode 0o644.

The actual contents of the file can be viewed below.

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
package Print;

#
# Utilities to print information
#
# Brian Carrier [carrier@sleuthkit.org]
# Copyright (c) 2001-2005 by Brian Carrier.  All rights reserved
#
# This file is part of the Autopsy Forensic Browser (Autopsy)
#
# Autopsy is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# Autopsy is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Autopsy; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
#
# THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
# WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
# MERCHANTABILITY AND FITNESS FOR ANY PARTICULAR PURPOSE.
# IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
# INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
# (INCLUDING, BUT NOT LIMITED TO, LOSS OF USE, DATA, OR PROFITS OR
# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

# Escape HTML entities
# Converts \n to <br>\n
sub html_encode {
    my $text = shift;
    $text =~ s/&/&amp;/gs;
    $text =~ s/</&lt;/gs;
    $text =~ s/>/&gt;/gs;
    $text =~ s/\"/&quot;/gs;
    $text =~ s/\n/<br>\n/gs;

    # @@@ LEADING SPACES and TABS
    # while ($text =~ s/^(&nbsp;)*\t/"$1&nbsp;&nbsp;&nbsp;&nbsp;"/eig) {}
    # while ($text =~ s/^(&nbsp;)* /"$1&nbsp;"/eig) {}
    return $text;
}

# remove control chars from printout
# this does not escape HTML entities, so you can pass this HTML code
sub print_output {
    my $out = shift;
    print "$out";

    while (my $out = shift) {
        foreach $_ (split(//, $out)) {
            if (   ($_ eq "\n")
                || ($_ eq "\r")
                || ($_ eq "\f")
                || ($_ eq "\t"))
            {
                print "$_";
            }
            elsif ((ord($_) < 0x20) && (ord($_) >= 0x00)) {
                print "^" . ord($_);
            }
            else {
                print "$_";
            }
        }
    }
}

# Added to provide output in hexdump format
# function gets called on a per-icat basis,
# The offset value is the byte offset that this data
# starts at, since the File.pm code calls it in 1024
# byte chunks)
sub print_hexdump {
    my $out    = shift;    # data to output
    my $offset = shift;    # starting byte offset in file
    my $buf    = "";

    foreach $i (split(//, $out)) {
        my $idx = $offset % 16;

        if ($idx == 0) {
            printf("%08X:  ", $offset);
        }

        printf("%02X", ord($i));
        if (($idx % 2) == 1) {
            printf(" ");
        }

        $buf[$idx] = $i;

        if ($idx == 15) {
            print "   ";
            for (my $j = 0; $j < 16; $j++) {
                if ($buf[$j] =~ m/[ -~]/) {
                    print $buf[$j];
                }
                else {
                    print ".";
                }
                $buf[$j] = 0;
            }
            print "\n";
        }
        $offset++;
    }

    # print out last line if < 16 bytes long
    my $l = $offset % 16;

    if ($l) {
        my $t = (16 - $l) * 2 + (16 - $l) / 2;
        for (my $j = 0; $j < $t; $j++) {
            print " ";
        }
        print "   ";
        for (my $j = 0; $j < $l; $j++) {
            if ($buf[$j] =~ m/[ -~]/) {
                print $buf[$j];
            }
            else {
                print ".";
            }
        }
        print "\n";
    }
}

############################################
#
# HTTP/HTML Headers and Footers

# The page that makes the frameset does not have a body statement
# This routine is used to make the minimum required header statements
sub print_html_header_frameset {
    my $text = shift;
    print "Content-Type: text/html; charset=utf-8$::HTTP_NL$::HTTP_NL";

    my $time = localtime();

    print <<EOF;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<!-- Autopsy ver. $::VER Forensic Browser -->
<!-- Page created at: $time -->
<head>
  <title>$text</title>
  <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  <link rel="stylesheet" href="global.css">
</head>

EOF
}

sub print_html_footer_frameset {
    print "\n</html>\n" . "$::HTTP_NL$::HTTP_NL";
}

# Create the header information with the body tag
sub print_html_header {
    print_html_header_frameset(shift);
    print "<body bgcolor=\"$::BACK_COLOR\">\n\n";
    print "<link rel=\"SHORTCUT ICON\" href=\"pict/favicon.ico\">\n";
}

sub print_html_footer {
    print "\n</body>\n</html>\n" . "$::HTTP_NL$::HTTP_NL";
}

# Print the header with the margins set to 0 so that the tab buttons
# are flush with the edges of the frame
sub print_html_header_tabs {
    print_html_header_frameset(shift);
    print "<body marginheight=0 marginwidth=0 topmargin=0 "
      . "leftmargin=0 rightmargin=0 botmargin=0 bgcolor=\"$::BACK_COLOR\">\n\n";
    print "<link rel=\"SHORTCUT ICON\" href=\"pict/favicon.ico\">\n";
    $is_body = 1;
}

sub print_html_footer_tabs {
    print "\n</body>\n</html>\n" . "$::HTTP_NL$::HTTP_NL";
}

# Header for front page to warn about java script
sub print_html_header_javascript {
    my $text = shift;
    print "Content-Type: text/html; charset=utf-8$::HTTP_NL$::HTTP_NL";

    my $time = localtime();

    # The write line has to stay on one line
    print <<EOF;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<!-- Autopsy ver. $::VER Forensic Browser -->
<!-- Page created at: $time -->
<head>
  <title>$text</title>
  <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  <link rel="stylesheet" href="global.css">
  <script language=\"JavaScript\">
  <!-- hide script from old browsers
  document.write(\'<center><font color=\"red\"><p>WARNING: Your browser currently has Java Script enabled.</font><p>You do not need Java Script to use Autopsy and it is recommended that it be turned off for security reasons.<hr></center>\');
  //-->
  </script>
</head>

<body bgcolor=\"$::BACK_COLOR\">
<link rel=\"SHORTCUT ICON\" href=\"pict/favicon.ico\">

EOF
}

sub print_html_footer_javascript {
    print "\n</body>\n</html>\n" . "$::HTTP_NL$::HTTP_NL";
}

# For raw text outputs (Pass the name of a file if it is being saved)
sub print_text_header {
    print "Content-Type: text/plain; charset=utf-8$::HTTP_NL";
    if (scalar @_ > 0) {
        my $fname = shift();
        print "Content-Disposition: inline; " . "filename=$fname;$::HTTP_NL";
    }
    print "$::HTTP_NL";
}

sub print_text_footer {
    print "$::HTTP_NL$::HTTP_NL";
}

# For forced save outputs
sub print_oct_header {
    print "Content-Type: application/octet-stream$::HTTP_NL";
    if (scalar @_ > 0) {
        my $fname = shift();
        print "Content-Disposition: inline; " . "filename=$fname;$::HTTP_NL";
    }
    print "$::HTTP_NL";
}

sub print_oct_footer {
}

# Error message that is used when an HTTP/HTML header is needed
# This escapes the characters that chould be HTML entities.
# it will also replace \n with <br> and other things that html_encode()
# can do. Do not send arbitrary HTML to this function.
sub print_check_err {
    print_html_header("");
    print html_encode(shift()) . "<br>\n";
    print_html_footer();
    sleep(1);
    exit 1;
}

# Error message when header already exists
# This escapes the characters that chould be HTML entities.
# it will also replace \n with <br> and other things that html_encode()
# can do. Do not send arbitrary HTML to this function.
sub print_err {
    print html_encode(shift()) . "<br>\n";
    sleep(1);
    print_html_footer();
    exit 1;
}

##################################################################
#
# Logging
#
#

sub investig_log_fname {
    return "" unless (defined $::host_dir       && $::host_dir        ne "");
    return "" unless (exists $Args::args{'inv'} && $Args::args{'inv'} ne "");

    return "$::host_dir" . "$::LOGDIR/$Args::args{'inv'}.log";
}

sub investig_exec_log_fname {
    return "" unless (defined $::host_dir       && $::host_dir        ne "");
    return "" unless (exists $Args::args{'inv'} && $Args::args{'inv'} ne "");

    return "$::host_dir" . "$::LOGDIR/$Args::args{'inv'}.exec.log";
}

sub host_log_fname {
    return "" unless (defined $::host_dir && $::host_dir ne "");

    return "$::host_dir" . "$::LOGDIR/host.log";
}

sub case_log_fname {
    return "" unless (defined $::case_dir && $::case_dir ne "");

    return "$::case_dir" . "case.log";
}

# Log data to the investigators specific log file
sub log_host_inv {
    return unless ($::USE_LOG == 1);

    my $str = shift;
    chomp $str;

    my $date  = localtime;
    my $fname = investig_log_fname();
    return if ($fname eq "");

    open HOSTLOG, ">>$fname" or die "Can't open log: $fname";
    print HOSTLOG "$date: $str\n";
    close(HOSTLOG);

    return;
}

sub log_host_inv_exec {
    return unless ($::USE_LOG == 1);
    my $str = shift;
    chomp $str;

    my $date  = localtime;
    my $fname = investig_exec_log_fname();
    return if ($fname eq "");

    open HOSTLOG, ">>$fname" or die "Can't open log: $fname";
    print HOSTLOG "$date: $str\n";
    close(HOSTLOG);

    return;
}

# log data to the general log file for the host
sub log_host_info {
    return unless ($::USE_LOG == 1);

    my $str = shift;
    chomp $str;

    my $date  = localtime;
    my $fname = host_log_fname();
    return if ($fname eq "");

    open HOSTLOG, ">>$fname" or die "Can't open log: $fname";
    print HOSTLOG "$date: $str\n";
    close(HOSTLOG);

    return;
}

sub log_case_info {
    return unless ($::USE_LOG == 1);
    my $str = shift;
    chomp $str;
    my $date  = localtime;
    my $fname = case_log_fname();
    return if ($fname eq "");

    open CASELOG, ">>$fname" or die "Can't open log: $fname";
    print CASELOG "$date: $str\n";
    close(CASELOG);

    return;
}

sub log_session_info {
    return unless ($::USE_LOG == 1);
    my $str = shift;
    chomp $str;
    my $date = localtime;

    my $lname = "autopsy.log";
    open AUTLOG, ">>$::LOCKDIR/$lname" or die "Can't open log: $lname";
    print AUTLOG "$date: $str\n";
    close(AUTLOG);

    return;
}

1;