Updates for new carved files API

This commit is contained in:
Richard Cordovano 2016-06-09 09:43:20 -04:00
parent c7b38e6a28
commit 00425c47d8
4 changed files with 79 additions and 58 deletions

View File

@ -99,7 +99,7 @@ class AddImageTask implements Runnable {
List<String> errorMessages = new ArrayList<>(); List<String> errorMessages = new ArrayList<>();
List<Content> newDataSources = new ArrayList<>(); List<Content> newDataSources = new ArrayList<>();
try { try {
currentCase.getSleuthkitCase().acquireExclusiveLock(); currentCase.getSleuthkitCase().acquireExclusiveLockForSQLite();
synchronized (tskAddImageProcessLock) { synchronized (tskAddImageProcessLock) {
tskAddImageProcess = currentCase.makeAddImageProcess(timeZone, true, ignoreFatOrphanFiles); tskAddImageProcess = currentCase.makeAddImageProcess(timeZone, true, ignoreFatOrphanFiles);
} }
@ -112,7 +112,7 @@ class AddImageTask implements Runnable {
commitOrRevertAddImageProcess(currentCase, errorMessages, newDataSources); commitOrRevertAddImageProcess(currentCase, errorMessages, newDataSources);
progressMonitor.setProgress(100); progressMonitor.setProgress(100);
} finally { } finally {
currentCase.getSleuthkitCase().releaseExclusiveLock(); currentCase.getSleuthkitCase().releaseExclusiveLockForSQLite();
DataSourceProcessorCallback.DataSourceProcessorResult result; DataSourceProcessorCallback.DataSourceProcessorResult result;
if (criticalErrorOccurred) { if (criticalErrorOccurred) {
result = DataSourceProcessorResult.CRITICAL_ERRORS; result = DataSourceProcessorResult.CRITICAL_ERRORS;

View File

@ -40,10 +40,10 @@ import org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction;
import org.sleuthkit.datamodel.TskCoreException; import org.sleuthkit.datamodel.TskCoreException;
import org.sleuthkit.datamodel.TskFileRange; import org.sleuthkit.datamodel.TskFileRange;
import org.sleuthkit.datamodel.VirtualDirectory; import org.sleuthkit.datamodel.VirtualDirectory;
import org.sleuthkit.datamodel.CarvedFileContainer;
import org.sleuthkit.datamodel.LocalFilesDataSource; import org.sleuthkit.datamodel.LocalFilesDataSource;
import org.sleuthkit.datamodel.TskDataException; import org.sleuthkit.datamodel.TskDataException;
import org.apache.commons.lang3.StringUtils; import org.apache.commons.lang3.StringUtils;
import org.sleuthkit.datamodel.CarvingResult;
/** /**
* A manager that provides methods for retrieving files from the current case * A manager that provides methods for retrieving files from the current case
@ -53,7 +53,7 @@ import org.apache.commons.lang3.StringUtils;
public class FileManager implements Closeable { public class FileManager implements Closeable {
private SleuthkitCase caseDb; private SleuthkitCase caseDb;
/** /**
* Constructs a manager that provides methods for retrieving files from the * Constructs a manager that provides methods for retrieving files from the
* current case and for adding local files, carved files, and derived files * current case and for adding local files, carved files, and derived files
@ -112,7 +112,7 @@ public class FileManager implements Closeable {
String types = StringUtils.join(mimeTypes, "', '"); String types = StringUtils.join(mimeTypes, "', '");
return "mime_type IN ('" + types + "')"; return "mime_type IN ('" + types + "')";
} }
/** /**
* Finds all files and directories with a given file name. The name search * Finds all files and directories with a given file name. The name search
* is for full or partial matches and is case insensitive (a case * is for full or partial matches and is case insensitive (a case
@ -324,47 +324,23 @@ public class FileManager implements Closeable {
} }
/** /**
* Adds a carved file to the '$CarvedFiles' virtual directory of a data * Adds a carving result to the case database.
* source, volume or file system.
* *
* @param fileName The name of the file. * @param carvingResult The carving result (a set of carved files and their
* @param fileSize The size of the file. * parent) to be added.
* @param parentObjId The object id of the parent data source, volume or
* file system.
* @param layout A list of the offsets and sizes that gives the layout
* of the file within its parent.
* *
* @return A LayoutFile object representing the carved file. * @return A list of LayoutFile representations of the carved files.
* *
* @throws TskCoreException if there is a problem adding the file to the * @throws TskCoreException If there is a problem completing a case database
* case database. * operation.
*/ */
public synchronized LayoutFile addCarvedFile(String fileName, long fileSize, long parentObjId, List<TskFileRange> layout) throws TskCoreException { public synchronized List<LayoutFile> addCarvedFiles(CarvingResult carvingResult) throws TskCoreException {
if (null == caseDb) { if (null == caseDb) {
throw new TskCoreException("File manager has been closed"); throw new TskCoreException("File manager has been closed");
} }
return caseDb.addCarvedFile(fileName, fileSize, parentObjId, layout); return caseDb.addCarvedFiles(carvingResult);
} }
/**
* Adds a collection of carved files to the '$CarvedFiles' virtual directory
* of a data source, volume or file system.
*
* @param A collection of CarvedFileContainer objects, one per carved file,
* all of which must have the same parent object id.
*
* @return A collection of LayoutFile object representing the carved files.
*
* @throws TskCoreException if there is a problem adding the files to the
* case database.
*/
public synchronized List<LayoutFile> addCarvedFiles(List<CarvedFileContainer> filesToAdd) throws TskCoreException {
if (null == caseDb) {
throw new TskCoreException("File manager has been closed");
}
return caseDb.addCarvedFiles(filesToAdd);
}
/** /**
* Interface for receiving a notification for each file or directory added * Interface for receiving a notification for each file or directory added
* to the case database by a FileManager add files operation. * to the case database by a FileManager add files operation.
@ -552,6 +528,16 @@ public class FileManager implements Closeable {
} }
} }
/**
* Closes the file manager.
*
* @throws IOException If there is a problem closing the file manager.
*/
@Override
public synchronized void close() throws IOException {
caseDb = null;
}
/** /**
* Adds a set of local/logical files and/or directories to the case database * Adds a set of local/logical files and/or directories to the case database
* as data source. * as data source.
@ -583,13 +569,55 @@ public class FileManager implements Closeable {
} }
/** /**
* Closes the file manager. * Adds a carved file to the '$CarvedFiles' virtual directory of a data
* source, volume or file system.
* *
* @throws IOException If there is a problem closing the file manager. * @param fileName The name of the file.
* @param fileSize The size of the file.
* @param parentObjId The object id of the parent data source, volume or
* file system.
* @param layout A list of the offsets and sizes that gives the layout
* of the file within its parent.
*
* @return A LayoutFile object representing the carved file.
*
* @throws TskCoreException if there is a problem adding the file to the
* case database.
* @deprecated Use List<LayoutFile> addCarvedFiles(CarvingResult
* carvingResult instead.
*/ */
@Override @Deprecated
public synchronized void close() throws IOException { public synchronized LayoutFile addCarvedFile(String fileName, long fileSize, long parentObjId, List<TskFileRange> layout) throws TskCoreException {
caseDb = null; if (null == caseDb) {
throw new TskCoreException("File manager has been closed");
}
Content parent = caseDb.getContentById(parentObjId);
List<CarvingResult.CarvedFile> carvedFiles = new ArrayList<>();
carvedFiles.add(new CarvingResult.CarvedFile(fileName, fileSize, layout));
List<LayoutFile> layoutFiles = caseDb.addCarvedFiles(new CarvingResult(parent, carvedFiles));
return layoutFiles.get(0);
}
/**
* Adds a collection of carved files to the '$CarvedFiles' virtual directory
* of a data source, volume or file system.
*
* @param A collection of CarvedFileContainer objects, one per carved file,
* all of which must have the same parent object id.
*
* @return A collection of LayoutFile object representing the carved files.
*
* @throws TskCoreException if there is a problem adding the files to the
* case database.
* @deprecated Use List<LayoutFile> addCarvedFiles(CarvingResult
* carvingResult instead.
*/
@Deprecated
public synchronized List<LayoutFile> addCarvedFiles(List<org.sleuthkit.datamodel.CarvedFileContainer> filesToAdd) throws TskCoreException {
if (null == caseDb) {
throw new TskCoreException("File manager has been closed");
}
return caseDb.addCarvedFiles(filesToAdd);
} }
} }

View File

@ -1,7 +1,7 @@
/* /*
* Autopsy Forensic Browser * Autopsy Forensic Browser
* *
* Copyright 2014 Basis Technology Corp. * Copyright 2011-2016 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org * Contact: carrier <at> sleuthkit <dot> org
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
@ -182,12 +182,6 @@ final class PhotoRecCarverFileIngestModule implements FileIngestModule {
Path tempFilePath = null; Path tempFilePath = null;
try { try {
long id = getRootId(file);
// make sure we have a valid systemID
if (id == -1) {
return IngestModule.ProcessResult.ERROR;
}
// Verify initialization succeeded. // Verify initialization succeeded.
if (null == this.executableFile) { if (null == this.executableFile) {
logger.log(Level.SEVERE, "PhotoRec carver called after failed start up"); // NON-NLS logger.log(Level.SEVERE, "PhotoRec carver called after failed start up"); // NON-NLS
@ -276,7 +270,7 @@ final class PhotoRecCarverFileIngestModule implements FileIngestModule {
// Now that we've cleaned up the folders and data files, parse the xml output file to add carved items into the database // Now that we've cleaned up the folders and data files, parse the xml output file to add carved items into the database
long calcstart = System.currentTimeMillis(); long calcstart = System.currentTimeMillis();
PhotoRecCarverOutputParser parser = new PhotoRecCarverOutputParser(outputDirPath); PhotoRecCarverOutputParser parser = new PhotoRecCarverOutputParser(outputDirPath);
List<LayoutFile> carvedItems = parser.parse(newAuditFile, id, file); List<LayoutFile> carvedItems = parser.parse(newAuditFile, file);
long calcdelta = (System.currentTimeMillis() - calcstart); long calcdelta = (System.currentTimeMillis() - calcstart);
totals.totalParsetime.addAndGet(calcdelta); totals.totalParsetime.addAndGet(calcdelta);
if (carvedItems != null) { // if there were any results from carving, add the unallocated carving event to the reports list. if (carvedItems != null) { // if there were any results from carving, add the unallocated carving event to the reports list.

View File

@ -32,8 +32,8 @@ import org.sleuthkit.autopsy.casemodule.services.FileManager;
import org.sleuthkit.autopsy.coreutils.Logger; import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.coreutils.XMLUtil; import org.sleuthkit.autopsy.coreutils.XMLUtil;
import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.CarvingResult;
import org.sleuthkit.datamodel.LayoutFile; import org.sleuthkit.datamodel.LayoutFile;
import org.sleuthkit.datamodel.CarvedFileContainer;
import org.sleuthkit.datamodel.TskCoreException; import org.sleuthkit.datamodel.TskCoreException;
import org.sleuthkit.datamodel.TskFileRange; import org.sleuthkit.datamodel.TskFileRange;
import org.w3c.dom.Document; import org.w3c.dom.Document;
@ -70,7 +70,7 @@ class PhotoRecCarverOutputParser {
* @throws FileNotFoundException * @throws FileNotFoundException
* @throws IOException * @throws IOException
*/ */
List<LayoutFile> parse(File xmlInputFile, long id, AbstractFile af) throws FileNotFoundException, IOException { List<LayoutFile> parse(File xmlInputFile, AbstractFile af) throws FileNotFoundException, IOException {
try { try {
final Document doc = XMLUtil.loadDoc(PhotoRecCarverOutputParser.class, xmlInputFile.toString()); final Document doc = XMLUtil.loadDoc(PhotoRecCarverOutputParser.class, xmlInputFile.toString());
if (doc == null) { if (doc == null) {
@ -99,8 +99,7 @@ class PhotoRecCarverOutputParser {
FileManager fileManager = Case.getCurrentCase().getServices().getFileManager(); FileManager fileManager = Case.getCurrentCase().getServices().getFileManager();
// create and initialize the list to put into the database // create and initialize the list to put into the database
List<CarvedFileContainer> carvedFileContainer = new ArrayList<>(); List<CarvingResult.CarvedFile> carvedFiles = new ArrayList<>();
for (int fileIndex = 0; fileIndex < numberOfFiles; ++fileIndex) { for (int fileIndex = 0; fileIndex < numberOfFiles; ++fileIndex) {
entry = (Element) fileObjects.item(fileIndex); entry = (Element) fileObjects.item(fileIndex);
fileNames = entry.getElementsByTagName("filename"); //NON-NLS fileNames = entry.getElementsByTagName("filename"); //NON-NLS
@ -133,7 +132,7 @@ class PhotoRecCarverOutputParser {
if (fileByteEnd > af.getSize()) { if (fileByteEnd > af.getSize()) {
long overshoot = fileByteEnd - af.getSize(); long overshoot = fileByteEnd - af.getSize();
if (fileSize > overshoot) { if (fileSize > overshoot) {
fileSize = fileSize - overshoot; fileSize -= overshoot;
} else { } else {
// This better never happen... Data for this file is corrupted. Skip it. // This better never happen... Data for this file is corrupted. Skip it.
continue; continue;
@ -144,10 +143,10 @@ class PhotoRecCarverOutputParser {
} }
if (!tskRanges.isEmpty()) { if (!tskRanges.isEmpty()) {
carvedFileContainer.add(new CarvedFileContainer(fileName, fileSize, id, tskRanges)); carvedFiles.add(new CarvingResult.CarvedFile(fileName, fileSize, tskRanges));
} }
} }
return fileManager.addCarvedFiles(carvedFileContainer); return fileManager.addCarvedFiles(new CarvingResult(af, carvedFiles));
} catch (NumberFormatException | TskCoreException ex) { } catch (NumberFormatException | TskCoreException ex) {
logger.log(Level.SEVERE, "Error parsing PhotoRec output and inserting it into the database: {0}", ex); //NON-NLS logger.log(Level.SEVERE, "Error parsing PhotoRec output and inserting it into the database: {0}", ex); //NON-NLS
} }