From 00425c47d8143b9497a00a824d10ec3cec0fd70f Mon Sep 17 00:00:00 2001 From: Richard Cordovano Date: Thu, 9 Jun 2016 09:43:20 -0400 Subject: [PATCH] Updates for new carved files API --- .../autopsy/casemodule/AddImageTask.java | 4 +- .../casemodule/services/FileManager.java | 110 +++++++++++------- .../PhotoRecCarverFileIngestModule.java | 10 +- .../PhotoRecCarverOutputParser.java | 13 +-- 4 files changed, 79 insertions(+), 58 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/AddImageTask.java b/Core/src/org/sleuthkit/autopsy/casemodule/AddImageTask.java index dc9774ed72..c18440d08d 100644 --- a/Core/src/org/sleuthkit/autopsy/casemodule/AddImageTask.java +++ b/Core/src/org/sleuthkit/autopsy/casemodule/AddImageTask.java @@ -99,7 +99,7 @@ class AddImageTask implements Runnable { List errorMessages = new ArrayList<>(); List newDataSources = new ArrayList<>(); try { - currentCase.getSleuthkitCase().acquireExclusiveLock(); + currentCase.getSleuthkitCase().acquireExclusiveLockForSQLite(); synchronized (tskAddImageProcessLock) { tskAddImageProcess = currentCase.makeAddImageProcess(timeZone, true, ignoreFatOrphanFiles); } @@ -112,7 +112,7 @@ class AddImageTask implements Runnable { commitOrRevertAddImageProcess(currentCase, errorMessages, newDataSources); progressMonitor.setProgress(100); } finally { - currentCase.getSleuthkitCase().releaseExclusiveLock(); + currentCase.getSleuthkitCase().releaseExclusiveLockForSQLite(); DataSourceProcessorCallback.DataSourceProcessorResult result; if (criticalErrorOccurred) { result = DataSourceProcessorResult.CRITICAL_ERRORS; diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/services/FileManager.java b/Core/src/org/sleuthkit/autopsy/casemodule/services/FileManager.java index 380adef01e..2787924d93 100644 --- a/Core/src/org/sleuthkit/autopsy/casemodule/services/FileManager.java +++ b/Core/src/org/sleuthkit/autopsy/casemodule/services/FileManager.java @@ -40,10 +40,10 @@ import org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction; import org.sleuthkit.datamodel.TskCoreException; import org.sleuthkit.datamodel.TskFileRange; import org.sleuthkit.datamodel.VirtualDirectory; -import org.sleuthkit.datamodel.CarvedFileContainer; import org.sleuthkit.datamodel.LocalFilesDataSource; import org.sleuthkit.datamodel.TskDataException; import org.apache.commons.lang3.StringUtils; +import org.sleuthkit.datamodel.CarvingResult; /** * A manager that provides methods for retrieving files from the current case @@ -53,7 +53,7 @@ import org.apache.commons.lang3.StringUtils; public class FileManager implements Closeable { private SleuthkitCase caseDb; - + /** * Constructs a manager that provides methods for retrieving files from the * current case and for adding local files, carved files, and derived files @@ -112,7 +112,7 @@ public class FileManager implements Closeable { String types = StringUtils.join(mimeTypes, "', '"); return "mime_type IN ('" + types + "')"; } - + /** * Finds all files and directories with a given file name. The name search * is for full or partial matches and is case insensitive (a case @@ -324,47 +324,23 @@ public class FileManager implements Closeable { } /** - * Adds a carved file to the '$CarvedFiles' virtual directory of a data - * source, volume or file system. + * Adds a carving result to the case database. * - * @param fileName The name of the file. - * @param fileSize The size of the file. - * @param parentObjId The object id of the parent data source, volume or - * file system. - * @param layout A list of the offsets and sizes that gives the layout - * of the file within its parent. + * @param carvingResult The carving result (a set of carved files and their + * parent) to be added. * - * @return A LayoutFile object representing the carved file. + * @return A list of LayoutFile representations of the carved files. * - * @throws TskCoreException if there is a problem adding the file to the - * case database. + * @throws TskCoreException If there is a problem completing a case database + * operation. */ - public synchronized LayoutFile addCarvedFile(String fileName, long fileSize, long parentObjId, List layout) throws TskCoreException { + public synchronized List addCarvedFiles(CarvingResult carvingResult) throws TskCoreException { if (null == caseDb) { throw new TskCoreException("File manager has been closed"); } - return caseDb.addCarvedFile(fileName, fileSize, parentObjId, layout); + return caseDb.addCarvedFiles(carvingResult); } - - /** - * Adds a collection of carved files to the '$CarvedFiles' virtual directory - * of a data source, volume or file system. - * - * @param A collection of CarvedFileContainer objects, one per carved file, - * all of which must have the same parent object id. - * - * @return A collection of LayoutFile object representing the carved files. - * - * @throws TskCoreException if there is a problem adding the files to the - * case database. - */ - public synchronized List addCarvedFiles(List filesToAdd) throws TskCoreException { - if (null == caseDb) { - throw new TskCoreException("File manager has been closed"); - } - return caseDb.addCarvedFiles(filesToAdd); - } - + /** * Interface for receiving a notification for each file or directory added * to the case database by a FileManager add files operation. @@ -552,6 +528,16 @@ public class FileManager implements Closeable { } } + /** + * Closes the file manager. + * + * @throws IOException If there is a problem closing the file manager. + */ + @Override + public synchronized void close() throws IOException { + caseDb = null; + } + /** * Adds a set of local/logical files and/or directories to the case database * as data source. @@ -583,13 +569,55 @@ public class FileManager implements Closeable { } /** - * Closes the file manager. + * Adds a carved file to the '$CarvedFiles' virtual directory of a data + * source, volume or file system. * - * @throws IOException If there is a problem closing the file manager. + * @param fileName The name of the file. + * @param fileSize The size of the file. + * @param parentObjId The object id of the parent data source, volume or + * file system. + * @param layout A list of the offsets and sizes that gives the layout + * of the file within its parent. + * + * @return A LayoutFile object representing the carved file. + * + * @throws TskCoreException if there is a problem adding the file to the + * case database. + * @deprecated Use List addCarvedFiles(CarvingResult + * carvingResult instead. */ - @Override - public synchronized void close() throws IOException { - caseDb = null; + @Deprecated + public synchronized LayoutFile addCarvedFile(String fileName, long fileSize, long parentObjId, List layout) throws TskCoreException { + if (null == caseDb) { + throw new TskCoreException("File manager has been closed"); + } + Content parent = caseDb.getContentById(parentObjId); + List carvedFiles = new ArrayList<>(); + carvedFiles.add(new CarvingResult.CarvedFile(fileName, fileSize, layout)); + List layoutFiles = caseDb.addCarvedFiles(new CarvingResult(parent, carvedFiles)); + return layoutFiles.get(0); + } + + /** + * Adds a collection of carved files to the '$CarvedFiles' virtual directory + * of a data source, volume or file system. + * + * @param A collection of CarvedFileContainer objects, one per carved file, + * all of which must have the same parent object id. + * + * @return A collection of LayoutFile object representing the carved files. + * + * @throws TskCoreException if there is a problem adding the files to the + * case database. + * @deprecated Use List addCarvedFiles(CarvingResult + * carvingResult instead. + */ + @Deprecated + public synchronized List addCarvedFiles(List filesToAdd) throws TskCoreException { + if (null == caseDb) { + throw new TskCoreException("File manager has been closed"); + } + return caseDb.addCarvedFiles(filesToAdd); } } diff --git a/Core/src/org/sleuthkit/autopsy/modules/photoreccarver/PhotoRecCarverFileIngestModule.java b/Core/src/org/sleuthkit/autopsy/modules/photoreccarver/PhotoRecCarverFileIngestModule.java index 03a64220fb..b8e6fcfd5d 100755 --- a/Core/src/org/sleuthkit/autopsy/modules/photoreccarver/PhotoRecCarverFileIngestModule.java +++ b/Core/src/org/sleuthkit/autopsy/modules/photoreccarver/PhotoRecCarverFileIngestModule.java @@ -1,7 +1,7 @@ /* * Autopsy Forensic Browser * - * Copyright 2014 Basis Technology Corp. + * Copyright 2011-2016 Basis Technology Corp. * Contact: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -182,12 +182,6 @@ final class PhotoRecCarverFileIngestModule implements FileIngestModule { Path tempFilePath = null; try { - long id = getRootId(file); - // make sure we have a valid systemID - if (id == -1) { - return IngestModule.ProcessResult.ERROR; - } - // Verify initialization succeeded. if (null == this.executableFile) { logger.log(Level.SEVERE, "PhotoRec carver called after failed start up"); // NON-NLS @@ -276,7 +270,7 @@ final class PhotoRecCarverFileIngestModule implements FileIngestModule { // Now that we've cleaned up the folders and data files, parse the xml output file to add carved items into the database long calcstart = System.currentTimeMillis(); PhotoRecCarverOutputParser parser = new PhotoRecCarverOutputParser(outputDirPath); - List carvedItems = parser.parse(newAuditFile, id, file); + List carvedItems = parser.parse(newAuditFile, file); long calcdelta = (System.currentTimeMillis() - calcstart); totals.totalParsetime.addAndGet(calcdelta); if (carvedItems != null) { // if there were any results from carving, add the unallocated carving event to the reports list. diff --git a/Core/src/org/sleuthkit/autopsy/modules/photoreccarver/PhotoRecCarverOutputParser.java b/Core/src/org/sleuthkit/autopsy/modules/photoreccarver/PhotoRecCarverOutputParser.java index caff08b50c..54c8dcc126 100755 --- a/Core/src/org/sleuthkit/autopsy/modules/photoreccarver/PhotoRecCarverOutputParser.java +++ b/Core/src/org/sleuthkit/autopsy/modules/photoreccarver/PhotoRecCarverOutputParser.java @@ -32,8 +32,8 @@ import org.sleuthkit.autopsy.casemodule.services.FileManager; import org.sleuthkit.autopsy.coreutils.Logger; import org.sleuthkit.autopsy.coreutils.XMLUtil; import org.sleuthkit.datamodel.AbstractFile; +import org.sleuthkit.datamodel.CarvingResult; import org.sleuthkit.datamodel.LayoutFile; -import org.sleuthkit.datamodel.CarvedFileContainer; import org.sleuthkit.datamodel.TskCoreException; import org.sleuthkit.datamodel.TskFileRange; import org.w3c.dom.Document; @@ -70,7 +70,7 @@ class PhotoRecCarverOutputParser { * @throws FileNotFoundException * @throws IOException */ - List parse(File xmlInputFile, long id, AbstractFile af) throws FileNotFoundException, IOException { + List parse(File xmlInputFile, AbstractFile af) throws FileNotFoundException, IOException { try { final Document doc = XMLUtil.loadDoc(PhotoRecCarverOutputParser.class, xmlInputFile.toString()); if (doc == null) { @@ -99,8 +99,7 @@ class PhotoRecCarverOutputParser { FileManager fileManager = Case.getCurrentCase().getServices().getFileManager(); // create and initialize the list to put into the database - List carvedFileContainer = new ArrayList<>(); - + List carvedFiles = new ArrayList<>(); for (int fileIndex = 0; fileIndex < numberOfFiles; ++fileIndex) { entry = (Element) fileObjects.item(fileIndex); fileNames = entry.getElementsByTagName("filename"); //NON-NLS @@ -133,7 +132,7 @@ class PhotoRecCarverOutputParser { if (fileByteEnd > af.getSize()) { long overshoot = fileByteEnd - af.getSize(); if (fileSize > overshoot) { - fileSize = fileSize - overshoot; + fileSize -= overshoot; } else { // This better never happen... Data for this file is corrupted. Skip it. continue; @@ -144,10 +143,10 @@ class PhotoRecCarverOutputParser { } if (!tskRanges.isEmpty()) { - carvedFileContainer.add(new CarvedFileContainer(fileName, fileSize, id, tskRanges)); + carvedFiles.add(new CarvingResult.CarvedFile(fileName, fileSize, tskRanges)); } } - return fileManager.addCarvedFiles(carvedFileContainer); + return fileManager.addCarvedFiles(new CarvingResult(af, carvedFiles)); } catch (NumberFormatException | TskCoreException ex) { logger.log(Level.SEVERE, "Error parsing PhotoRec output and inserting it into the database: {0}", ex); //NON-NLS }