mirror of
https://github.com/overcuriousity/autopsy-flatpak.git
synced 2025-07-17 10:17:41 +00:00
Updates for new carved files API
This commit is contained in:
parent
c7b38e6a28
commit
00425c47d8
@ -99,7 +99,7 @@ class AddImageTask implements Runnable {
|
|||||||
List<String> errorMessages = new ArrayList<>();
|
List<String> errorMessages = new ArrayList<>();
|
||||||
List<Content> newDataSources = new ArrayList<>();
|
List<Content> newDataSources = new ArrayList<>();
|
||||||
try {
|
try {
|
||||||
currentCase.getSleuthkitCase().acquireExclusiveLock();
|
currentCase.getSleuthkitCase().acquireExclusiveLockForSQLite();
|
||||||
synchronized (tskAddImageProcessLock) {
|
synchronized (tskAddImageProcessLock) {
|
||||||
tskAddImageProcess = currentCase.makeAddImageProcess(timeZone, true, ignoreFatOrphanFiles);
|
tskAddImageProcess = currentCase.makeAddImageProcess(timeZone, true, ignoreFatOrphanFiles);
|
||||||
}
|
}
|
||||||
@ -112,7 +112,7 @@ class AddImageTask implements Runnable {
|
|||||||
commitOrRevertAddImageProcess(currentCase, errorMessages, newDataSources);
|
commitOrRevertAddImageProcess(currentCase, errorMessages, newDataSources);
|
||||||
progressMonitor.setProgress(100);
|
progressMonitor.setProgress(100);
|
||||||
} finally {
|
} finally {
|
||||||
currentCase.getSleuthkitCase().releaseExclusiveLock();
|
currentCase.getSleuthkitCase().releaseExclusiveLockForSQLite();
|
||||||
DataSourceProcessorCallback.DataSourceProcessorResult result;
|
DataSourceProcessorCallback.DataSourceProcessorResult result;
|
||||||
if (criticalErrorOccurred) {
|
if (criticalErrorOccurred) {
|
||||||
result = DataSourceProcessorResult.CRITICAL_ERRORS;
|
result = DataSourceProcessorResult.CRITICAL_ERRORS;
|
||||||
|
@ -40,10 +40,10 @@ import org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction;
|
|||||||
import org.sleuthkit.datamodel.TskCoreException;
|
import org.sleuthkit.datamodel.TskCoreException;
|
||||||
import org.sleuthkit.datamodel.TskFileRange;
|
import org.sleuthkit.datamodel.TskFileRange;
|
||||||
import org.sleuthkit.datamodel.VirtualDirectory;
|
import org.sleuthkit.datamodel.VirtualDirectory;
|
||||||
import org.sleuthkit.datamodel.CarvedFileContainer;
|
|
||||||
import org.sleuthkit.datamodel.LocalFilesDataSource;
|
import org.sleuthkit.datamodel.LocalFilesDataSource;
|
||||||
import org.sleuthkit.datamodel.TskDataException;
|
import org.sleuthkit.datamodel.TskDataException;
|
||||||
import org.apache.commons.lang3.StringUtils;
|
import org.apache.commons.lang3.StringUtils;
|
||||||
|
import org.sleuthkit.datamodel.CarvingResult;
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* A manager that provides methods for retrieving files from the current case
|
* A manager that provides methods for retrieving files from the current case
|
||||||
@ -53,7 +53,7 @@ import org.apache.commons.lang3.StringUtils;
|
|||||||
public class FileManager implements Closeable {
|
public class FileManager implements Closeable {
|
||||||
|
|
||||||
private SleuthkitCase caseDb;
|
private SleuthkitCase caseDb;
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Constructs a manager that provides methods for retrieving files from the
|
* Constructs a manager that provides methods for retrieving files from the
|
||||||
* current case and for adding local files, carved files, and derived files
|
* current case and for adding local files, carved files, and derived files
|
||||||
@ -112,7 +112,7 @@ public class FileManager implements Closeable {
|
|||||||
String types = StringUtils.join(mimeTypes, "', '");
|
String types = StringUtils.join(mimeTypes, "', '");
|
||||||
return "mime_type IN ('" + types + "')";
|
return "mime_type IN ('" + types + "')";
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Finds all files and directories with a given file name. The name search
|
* Finds all files and directories with a given file name. The name search
|
||||||
* is for full or partial matches and is case insensitive (a case
|
* is for full or partial matches and is case insensitive (a case
|
||||||
@ -324,47 +324,23 @@ public class FileManager implements Closeable {
|
|||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Adds a carved file to the '$CarvedFiles' virtual directory of a data
|
* Adds a carving result to the case database.
|
||||||
* source, volume or file system.
|
|
||||||
*
|
*
|
||||||
* @param fileName The name of the file.
|
* @param carvingResult The carving result (a set of carved files and their
|
||||||
* @param fileSize The size of the file.
|
* parent) to be added.
|
||||||
* @param parentObjId The object id of the parent data source, volume or
|
|
||||||
* file system.
|
|
||||||
* @param layout A list of the offsets and sizes that gives the layout
|
|
||||||
* of the file within its parent.
|
|
||||||
*
|
*
|
||||||
* @return A LayoutFile object representing the carved file.
|
* @return A list of LayoutFile representations of the carved files.
|
||||||
*
|
*
|
||||||
* @throws TskCoreException if there is a problem adding the file to the
|
* @throws TskCoreException If there is a problem completing a case database
|
||||||
* case database.
|
* operation.
|
||||||
*/
|
*/
|
||||||
public synchronized LayoutFile addCarvedFile(String fileName, long fileSize, long parentObjId, List<TskFileRange> layout) throws TskCoreException {
|
public synchronized List<LayoutFile> addCarvedFiles(CarvingResult carvingResult) throws TskCoreException {
|
||||||
if (null == caseDb) {
|
if (null == caseDb) {
|
||||||
throw new TskCoreException("File manager has been closed");
|
throw new TskCoreException("File manager has been closed");
|
||||||
}
|
}
|
||||||
return caseDb.addCarvedFile(fileName, fileSize, parentObjId, layout);
|
return caseDb.addCarvedFiles(carvingResult);
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
|
||||||
* Adds a collection of carved files to the '$CarvedFiles' virtual directory
|
|
||||||
* of a data source, volume or file system.
|
|
||||||
*
|
|
||||||
* @param A collection of CarvedFileContainer objects, one per carved file,
|
|
||||||
* all of which must have the same parent object id.
|
|
||||||
*
|
|
||||||
* @return A collection of LayoutFile object representing the carved files.
|
|
||||||
*
|
|
||||||
* @throws TskCoreException if there is a problem adding the files to the
|
|
||||||
* case database.
|
|
||||||
*/
|
|
||||||
public synchronized List<LayoutFile> addCarvedFiles(List<CarvedFileContainer> filesToAdd) throws TskCoreException {
|
|
||||||
if (null == caseDb) {
|
|
||||||
throw new TskCoreException("File manager has been closed");
|
|
||||||
}
|
|
||||||
return caseDb.addCarvedFiles(filesToAdd);
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Interface for receiving a notification for each file or directory added
|
* Interface for receiving a notification for each file or directory added
|
||||||
* to the case database by a FileManager add files operation.
|
* to the case database by a FileManager add files operation.
|
||||||
@ -552,6 +528,16 @@ public class FileManager implements Closeable {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Closes the file manager.
|
||||||
|
*
|
||||||
|
* @throws IOException If there is a problem closing the file manager.
|
||||||
|
*/
|
||||||
|
@Override
|
||||||
|
public synchronized void close() throws IOException {
|
||||||
|
caseDb = null;
|
||||||
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Adds a set of local/logical files and/or directories to the case database
|
* Adds a set of local/logical files and/or directories to the case database
|
||||||
* as data source.
|
* as data source.
|
||||||
@ -583,13 +569,55 @@ public class FileManager implements Closeable {
|
|||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Closes the file manager.
|
* Adds a carved file to the '$CarvedFiles' virtual directory of a data
|
||||||
|
* source, volume or file system.
|
||||||
*
|
*
|
||||||
* @throws IOException If there is a problem closing the file manager.
|
* @param fileName The name of the file.
|
||||||
|
* @param fileSize The size of the file.
|
||||||
|
* @param parentObjId The object id of the parent data source, volume or
|
||||||
|
* file system.
|
||||||
|
* @param layout A list of the offsets and sizes that gives the layout
|
||||||
|
* of the file within its parent.
|
||||||
|
*
|
||||||
|
* @return A LayoutFile object representing the carved file.
|
||||||
|
*
|
||||||
|
* @throws TskCoreException if there is a problem adding the file to the
|
||||||
|
* case database.
|
||||||
|
* @deprecated Use List<LayoutFile> addCarvedFiles(CarvingResult
|
||||||
|
* carvingResult instead.
|
||||||
*/
|
*/
|
||||||
@Override
|
@Deprecated
|
||||||
public synchronized void close() throws IOException {
|
public synchronized LayoutFile addCarvedFile(String fileName, long fileSize, long parentObjId, List<TskFileRange> layout) throws TskCoreException {
|
||||||
caseDb = null;
|
if (null == caseDb) {
|
||||||
|
throw new TskCoreException("File manager has been closed");
|
||||||
|
}
|
||||||
|
Content parent = caseDb.getContentById(parentObjId);
|
||||||
|
List<CarvingResult.CarvedFile> carvedFiles = new ArrayList<>();
|
||||||
|
carvedFiles.add(new CarvingResult.CarvedFile(fileName, fileSize, layout));
|
||||||
|
List<LayoutFile> layoutFiles = caseDb.addCarvedFiles(new CarvingResult(parent, carvedFiles));
|
||||||
|
return layoutFiles.get(0);
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Adds a collection of carved files to the '$CarvedFiles' virtual directory
|
||||||
|
* of a data source, volume or file system.
|
||||||
|
*
|
||||||
|
* @param A collection of CarvedFileContainer objects, one per carved file,
|
||||||
|
* all of which must have the same parent object id.
|
||||||
|
*
|
||||||
|
* @return A collection of LayoutFile object representing the carved files.
|
||||||
|
*
|
||||||
|
* @throws TskCoreException if there is a problem adding the files to the
|
||||||
|
* case database.
|
||||||
|
* @deprecated Use List<LayoutFile> addCarvedFiles(CarvingResult
|
||||||
|
* carvingResult instead.
|
||||||
|
*/
|
||||||
|
@Deprecated
|
||||||
|
public synchronized List<LayoutFile> addCarvedFiles(List<org.sleuthkit.datamodel.CarvedFileContainer> filesToAdd) throws TskCoreException {
|
||||||
|
if (null == caseDb) {
|
||||||
|
throw new TskCoreException("File manager has been closed");
|
||||||
|
}
|
||||||
|
return caseDb.addCarvedFiles(filesToAdd);
|
||||||
}
|
}
|
||||||
|
|
||||||
}
|
}
|
||||||
|
@ -1,7 +1,7 @@
|
|||||||
/*
|
/*
|
||||||
* Autopsy Forensic Browser
|
* Autopsy Forensic Browser
|
||||||
*
|
*
|
||||||
* Copyright 2014 Basis Technology Corp.
|
* Copyright 2011-2016 Basis Technology Corp.
|
||||||
* Contact: carrier <at> sleuthkit <dot> org
|
* Contact: carrier <at> sleuthkit <dot> org
|
||||||
*
|
*
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
@ -182,12 +182,6 @@ final class PhotoRecCarverFileIngestModule implements FileIngestModule {
|
|||||||
|
|
||||||
Path tempFilePath = null;
|
Path tempFilePath = null;
|
||||||
try {
|
try {
|
||||||
long id = getRootId(file);
|
|
||||||
// make sure we have a valid systemID
|
|
||||||
if (id == -1) {
|
|
||||||
return IngestModule.ProcessResult.ERROR;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Verify initialization succeeded.
|
// Verify initialization succeeded.
|
||||||
if (null == this.executableFile) {
|
if (null == this.executableFile) {
|
||||||
logger.log(Level.SEVERE, "PhotoRec carver called after failed start up"); // NON-NLS
|
logger.log(Level.SEVERE, "PhotoRec carver called after failed start up"); // NON-NLS
|
||||||
@ -276,7 +270,7 @@ final class PhotoRecCarverFileIngestModule implements FileIngestModule {
|
|||||||
// Now that we've cleaned up the folders and data files, parse the xml output file to add carved items into the database
|
// Now that we've cleaned up the folders and data files, parse the xml output file to add carved items into the database
|
||||||
long calcstart = System.currentTimeMillis();
|
long calcstart = System.currentTimeMillis();
|
||||||
PhotoRecCarverOutputParser parser = new PhotoRecCarverOutputParser(outputDirPath);
|
PhotoRecCarverOutputParser parser = new PhotoRecCarverOutputParser(outputDirPath);
|
||||||
List<LayoutFile> carvedItems = parser.parse(newAuditFile, id, file);
|
List<LayoutFile> carvedItems = parser.parse(newAuditFile, file);
|
||||||
long calcdelta = (System.currentTimeMillis() - calcstart);
|
long calcdelta = (System.currentTimeMillis() - calcstart);
|
||||||
totals.totalParsetime.addAndGet(calcdelta);
|
totals.totalParsetime.addAndGet(calcdelta);
|
||||||
if (carvedItems != null) { // if there were any results from carving, add the unallocated carving event to the reports list.
|
if (carvedItems != null) { // if there were any results from carving, add the unallocated carving event to the reports list.
|
||||||
|
@ -32,8 +32,8 @@ import org.sleuthkit.autopsy.casemodule.services.FileManager;
|
|||||||
import org.sleuthkit.autopsy.coreutils.Logger;
|
import org.sleuthkit.autopsy.coreutils.Logger;
|
||||||
import org.sleuthkit.autopsy.coreutils.XMLUtil;
|
import org.sleuthkit.autopsy.coreutils.XMLUtil;
|
||||||
import org.sleuthkit.datamodel.AbstractFile;
|
import org.sleuthkit.datamodel.AbstractFile;
|
||||||
|
import org.sleuthkit.datamodel.CarvingResult;
|
||||||
import org.sleuthkit.datamodel.LayoutFile;
|
import org.sleuthkit.datamodel.LayoutFile;
|
||||||
import org.sleuthkit.datamodel.CarvedFileContainer;
|
|
||||||
import org.sleuthkit.datamodel.TskCoreException;
|
import org.sleuthkit.datamodel.TskCoreException;
|
||||||
import org.sleuthkit.datamodel.TskFileRange;
|
import org.sleuthkit.datamodel.TskFileRange;
|
||||||
import org.w3c.dom.Document;
|
import org.w3c.dom.Document;
|
||||||
@ -70,7 +70,7 @@ class PhotoRecCarverOutputParser {
|
|||||||
* @throws FileNotFoundException
|
* @throws FileNotFoundException
|
||||||
* @throws IOException
|
* @throws IOException
|
||||||
*/
|
*/
|
||||||
List<LayoutFile> parse(File xmlInputFile, long id, AbstractFile af) throws FileNotFoundException, IOException {
|
List<LayoutFile> parse(File xmlInputFile, AbstractFile af) throws FileNotFoundException, IOException {
|
||||||
try {
|
try {
|
||||||
final Document doc = XMLUtil.loadDoc(PhotoRecCarverOutputParser.class, xmlInputFile.toString());
|
final Document doc = XMLUtil.loadDoc(PhotoRecCarverOutputParser.class, xmlInputFile.toString());
|
||||||
if (doc == null) {
|
if (doc == null) {
|
||||||
@ -99,8 +99,7 @@ class PhotoRecCarverOutputParser {
|
|||||||
FileManager fileManager = Case.getCurrentCase().getServices().getFileManager();
|
FileManager fileManager = Case.getCurrentCase().getServices().getFileManager();
|
||||||
|
|
||||||
// create and initialize the list to put into the database
|
// create and initialize the list to put into the database
|
||||||
List<CarvedFileContainer> carvedFileContainer = new ArrayList<>();
|
List<CarvingResult.CarvedFile> carvedFiles = new ArrayList<>();
|
||||||
|
|
||||||
for (int fileIndex = 0; fileIndex < numberOfFiles; ++fileIndex) {
|
for (int fileIndex = 0; fileIndex < numberOfFiles; ++fileIndex) {
|
||||||
entry = (Element) fileObjects.item(fileIndex);
|
entry = (Element) fileObjects.item(fileIndex);
|
||||||
fileNames = entry.getElementsByTagName("filename"); //NON-NLS
|
fileNames = entry.getElementsByTagName("filename"); //NON-NLS
|
||||||
@ -133,7 +132,7 @@ class PhotoRecCarverOutputParser {
|
|||||||
if (fileByteEnd > af.getSize()) {
|
if (fileByteEnd > af.getSize()) {
|
||||||
long overshoot = fileByteEnd - af.getSize();
|
long overshoot = fileByteEnd - af.getSize();
|
||||||
if (fileSize > overshoot) {
|
if (fileSize > overshoot) {
|
||||||
fileSize = fileSize - overshoot;
|
fileSize -= overshoot;
|
||||||
} else {
|
} else {
|
||||||
// This better never happen... Data for this file is corrupted. Skip it.
|
// This better never happen... Data for this file is corrupted. Skip it.
|
||||||
continue;
|
continue;
|
||||||
@ -144,10 +143,10 @@ class PhotoRecCarverOutputParser {
|
|||||||
}
|
}
|
||||||
|
|
||||||
if (!tskRanges.isEmpty()) {
|
if (!tskRanges.isEmpty()) {
|
||||||
carvedFileContainer.add(new CarvedFileContainer(fileName, fileSize, id, tskRanges));
|
carvedFiles.add(new CarvingResult.CarvedFile(fileName, fileSize, tskRanges));
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
return fileManager.addCarvedFiles(carvedFileContainer);
|
return fileManager.addCarvedFiles(new CarvingResult(af, carvedFiles));
|
||||||
} catch (NumberFormatException | TskCoreException ex) {
|
} catch (NumberFormatException | TskCoreException ex) {
|
||||||
logger.log(Level.SEVERE, "Error parsing PhotoRec output and inserting it into the database: {0}", ex); //NON-NLS
|
logger.log(Level.SEVERE, "Error parsing PhotoRec output and inserting it into the database: {0}", ex); //NON-NLS
|
||||||
}
|
}
|
||||||
|
Loading…
x
Reference in New Issue
Block a user