mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-12 16:06:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

4241 Restore IngestFileFiltersTest

Browse Source
This commit is contained in:
Richard Cordovano 2018-11-30 18:35:52 -05:00
parent 1e73fbd0a1
commit 0f35c0aff9
1 changed files with 278 additions and 278 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

556
Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java
View File

@ -78,295 +78,295 @@ public class IngestFileFiltersTest extends NbTestCase {
@Override
public void tearDown() {
// CaseUtils.closeCurrentCase(testSucceeded);
CaseUtils.closeCurrentCase(testSucceeded);
}
public void testBasicDir() {
// Case currentCase = CaseUtils.createAsCurrentCase("testBasicDir");
// ImageDSProcessor dataSourceProcessor = new ImageDSProcessor();
// IngestUtils.addDataSource(dataSourceProcessor, IMAGE_PATH);
//
// HashMap<String, Rule> rule = new HashMap<>();
// rule.put("Rule", new Rule("testFileType", null, new MetaTypeCondition(MetaTypeCondition.Type.FILES), new ParentPathCondition("dir1"), null, null, null));
// //Filter for dir1 and no unallocated space
// FilesSet dirFilter = new FilesSet("Filter", "Filter to find all files in dir1.", false, true, rule);
//
// try {
// ArrayList<IngestModuleTemplate> templates = new ArrayList<>();
// templates.add(IngestUtils.getIngestModuleTemplate(new FileTypeIdModuleFactory()));
// IngestJobSettings ingestJobSettings = new IngestJobSettings(IngestFileFiltersTest.class.getCanonicalName(), IngestJobSettings.IngestType.FILES_ONLY, templates, dirFilter);
// IngestUtils.runIngestJob(currentCase.getDataSources(), ingestJobSettings);
// FileManager fileManager = currentCase.getServices().getFileManager();
// List<AbstractFile> results = fileManager.findFiles("file.jpg", "dir1");
// String mimeType = results.get(0).getMIMEType();
// assertEquals("image/jpeg", mimeType);
//
// results = fileManager.findFiles("%%");
//
// for (AbstractFile file : results) {
// //All files in dir1 should have MIME type, except '.' '..' and slack files
// if (file.getParentPath().equalsIgnoreCase("/dir1/")) {
// if (!(file.getName().equals(".") || file.getName().equals("..") || file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.SLACK)) {
// String errMsg = String.format("File %s (objId=%d) unexpectedly passed by the file filter.", file.getName(), file.getId());
// assertTrue(errMsg, file.getMIMEType() != null && !file.getMIMEType().isEmpty());
// }
// } else { //All files not in dir1 shouldn't have MIME type
// String errMsg = String.format("File %s (objId=%d) unexpectedly passed by the file filter.", file.getName(), file.getId());
// assertTrue(errMsg, file.getMIMEType() == null);
// }
// }
// } catch (TskCoreException ex) {
// Exceptions.printStackTrace(ex);
// Assert.fail(ex.getMessage());
// }
//
// testSucceeded = true;
// }
//
// public void testExtAndDirWithOneRule() {
// Case currentCase = CaseUtils.createAsCurrentCase("testExtAndDirWithOneRule");
// ImageDSProcessor dataSourceProcessor = new ImageDSProcessor();
// IngestUtils.addDataSource(dataSourceProcessor, IMAGE_PATH);
//
// HashMap<String, Rule> rules = new HashMap<>();
// rules.put("Rule", new Rule("testExtAndDirWithOneRule", new ExtensionCondition("jpg"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), new ParentPathCondition("dir1"), null, null, null));
// //Build the filter that ignore unallocated space and with one rule
// FilesSet filesExtDirsFilter = new FilesSet("Filter", "Filter to find all jpg files in dir1.", false, true, rules);
//
// try {
// ArrayList<IngestModuleTemplate> templates = new ArrayList<>();
// templates.add(IngestUtils.getIngestModuleTemplate(new FileTypeIdModuleFactory()));
// IngestJobSettings ingestJobSettings = new IngestJobSettings(IngestFileFiltersTest.class.getCanonicalName(), IngestJobSettings.IngestType.FILES_ONLY, templates, filesExtDirsFilter);
// IngestUtils.runIngestJob(currentCase.getDataSources(), ingestJobSettings);
// FileManager fileManager = currentCase.getServices().getFileManager();
// List<AbstractFile> results = fileManager.findFiles("%%");
// assertEquals(62, results.size());
// for (AbstractFile file : results) {
// //Files with jpg extension in dir1 should have MIME Type
// if (file.getParentPath().equalsIgnoreCase("/dir1/") && file.getNameExtension().equalsIgnoreCase("jpg")) {
// String errMsg = String.format("File %s (objId=%d) unexpectedly blocked by the file filter.", file.getName(), file.getId());
// assertTrue(errMsg, file.getMIMEType() != null && !file.getMIMEType().isEmpty());
// } else { //All others shouldn't have MIME Type
// String errMsg = String.format("File %s (objId=%d) unexpectedly passed by the file filter.", file.getName(), file.getId());
// assertTrue(errMsg, file.getMIMEType() == null);
// }
// }
// } catch (TskCoreException ex) {
// Exceptions.printStackTrace(ex);
// Assert.fail(ex.getMessage());
// }
//
// testSucceeded = true;
// }
//
// public void testExtAndDirWithTwoRules() {
// Case currentCase = CaseUtils.createAsCurrentCase("testExtAndDirWithTwoRules");
// ImageDSProcessor dataSourceProcessor = new ImageDSProcessor();
// IngestUtils.addDataSource(dataSourceProcessor, IMAGE_PATH);
//
// HashMap<String, Rule> rules = new HashMap<>();
// rules.put("rule1", new Rule("FindJpgExtention", new ExtensionCondition("jpg"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null));
// rules.put("rule2", new Rule("FindDir1Directory", null, new MetaTypeCondition(MetaTypeCondition.Type.FILES), new ParentPathCondition("dir1"), null, null, null));
// //Build the filter that ingnore unallocated space and with 2 rules
// FilesSet filesExtDirsFilter = new FilesSet("Filter", "Filter to find all files in dir1 and all files with jpg extention.", false, true, rules);
//
// try {
// ArrayList<IngestModuleTemplate> templates = new ArrayList<>();
// templates.add(IngestUtils.getIngestModuleTemplate(new FileTypeIdModuleFactory()));
// IngestJobSettings ingestJobSettings = new IngestJobSettings(IngestFileFiltersTest.class.getCanonicalName(), IngestJobSettings.IngestType.FILES_ONLY, templates, filesExtDirsFilter);
// IngestUtils.runIngestJob(currentCase.getDataSources(), ingestJobSettings);
// FileManager fileManager = currentCase.getServices().getFileManager();
// List<AbstractFile> results = fileManager.findFiles("%%");
// assertEquals(62, results.size());
// for (AbstractFile file : results) {
// if (file.getNameExtension().equalsIgnoreCase("jpg")) { //All files with .jpg extension should have MIME type
// String errMsg = String.format("File %s (objId=%d) unexpectedly blocked by the file filter.", file.getName(), file.getId());
// assertTrue(errMsg, file.getMIMEType() != null && !file.getMIMEType().isEmpty());
// } else if (file.getParentPath().equalsIgnoreCase("/dir1/")) {
// //All files in dir1 should have MIME type except '.' '..' slack files
// if (file.getName().equals(".") || file.getName().equals("..") || file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.SLACK) {
// String errMsg = String.format("File %s (objId=%d) unexpectedly passed by the file filter.", file.getName(), file.getId());
// assertTrue(errMsg, file.getMIMEType() == null);
// } else {
// String errMsg = String.format("File %s (objId=%d) unexpectedly blocked by the file filter.", file.getName(), file.getId());
// assertTrue(errMsg, file.getMIMEType() != null && !file.getMIMEType().isEmpty());
// }
// } else { //All files that are not in dir1 or not with .jpg extension should not have MIME type
// String errMsg = String.format("File %s (objId=%d) unexpectedly passed by the file filter.", file.getName(), file.getId());
// assertTrue(errMsg, file.getMIMEType() == null);
// }
// }
// } catch (TskCoreException ex) {
// Exceptions.printStackTrace(ex);
// Assert.fail(ex.getMessage());
// }
//
// testSucceeded = true;
Case currentCase = CaseUtils.createAsCurrentCase("testBasicDir");
ImageDSProcessor dataSourceProcessor = new ImageDSProcessor();
IngestUtils.addDataSource(dataSourceProcessor, IMAGE_PATH);
HashMap<String, Rule> rule = new HashMap<>();
rule.put("Rule", new Rule("testFileType", null, new MetaTypeCondition(MetaTypeCondition.Type.FILES), new ParentPathCondition("dir1"), null, null, null));
//Filter for dir1 and no unallocated space
FilesSet dirFilter = new FilesSet("Filter", "Filter to find all files in dir1.", false, true, rule);
try {
ArrayList<IngestModuleTemplate> templates = new ArrayList<>();
templates.add(IngestUtils.getIngestModuleTemplate(new FileTypeIdModuleFactory()));
IngestJobSettings ingestJobSettings = new IngestJobSettings(IngestFileFiltersTest.class.getCanonicalName(), IngestJobSettings.IngestType.FILES_ONLY, templates, dirFilter);
IngestUtils.runIngestJob(currentCase.getDataSources(), ingestJobSettings);
FileManager fileManager = currentCase.getServices().getFileManager();
List<AbstractFile> results = fileManager.findFiles("file.jpg", "dir1");
String mimeType = results.get(0).getMIMEType();
assertEquals("image/jpeg", mimeType);
results = fileManager.findFiles("%%");
for (AbstractFile file : results) {
//All files in dir1 should have MIME type, except '.' '..' and slack files
if (file.getParentPath().equalsIgnoreCase("/dir1/")) {
if (!(file.getName().equals(".") || file.getName().equals("..") || file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.SLACK)) {
String errMsg = String.format("File %s (objId=%d) unexpectedly passed by the file filter.", file.getName(), file.getId());
assertTrue(errMsg, file.getMIMEType() != null && !file.getMIMEType().isEmpty());
}
} else { //All files not in dir1 shouldn't have MIME type
String errMsg = String.format("File %s (objId=%d) unexpectedly passed by the file filter.", file.getName(), file.getId());
assertTrue(errMsg, file.getMIMEType() == null);
}
}
} catch (TskCoreException ex) {
Exceptions.printStackTrace(ex);
Assert.fail(ex.getMessage());
}
testSucceeded = true;
}
public void testExtAndDirWithOneRule() {
Case currentCase = CaseUtils.createAsCurrentCase("testExtAndDirWithOneRule");
ImageDSProcessor dataSourceProcessor = new ImageDSProcessor();
IngestUtils.addDataSource(dataSourceProcessor, IMAGE_PATH);
HashMap<String, Rule> rules = new HashMap<>();
rules.put("Rule", new Rule("testExtAndDirWithOneRule", new ExtensionCondition("jpg"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), new ParentPathCondition("dir1"), null, null, null));
//Build the filter that ignore unallocated space and with one rule
FilesSet filesExtDirsFilter = new FilesSet("Filter", "Filter to find all jpg files in dir1.", false, true, rules);
try {
ArrayList<IngestModuleTemplate> templates = new ArrayList<>();
templates.add(IngestUtils.getIngestModuleTemplate(new FileTypeIdModuleFactory()));
IngestJobSettings ingestJobSettings = new IngestJobSettings(IngestFileFiltersTest.class.getCanonicalName(), IngestJobSettings.IngestType.FILES_ONLY, templates, filesExtDirsFilter);
IngestUtils.runIngestJob(currentCase.getDataSources(), ingestJobSettings);
FileManager fileManager = currentCase.getServices().getFileManager();
List<AbstractFile> results = fileManager.findFiles("%%");
assertEquals(62, results.size());
for (AbstractFile file : results) {
//Files with jpg extension in dir1 should have MIME Type
if (file.getParentPath().equalsIgnoreCase("/dir1/") && file.getNameExtension().equalsIgnoreCase("jpg")) {
String errMsg = String.format("File %s (objId=%d) unexpectedly blocked by the file filter.", file.getName(), file.getId());
assertTrue(errMsg, file.getMIMEType() != null && !file.getMIMEType().isEmpty());
} else { //All others shouldn't have MIME Type
String errMsg = String.format("File %s (objId=%d) unexpectedly passed by the file filter.", file.getName(), file.getId());
assertTrue(errMsg, file.getMIMEType() == null);
}
}
} catch (TskCoreException ex) {
Exceptions.printStackTrace(ex);
Assert.fail(ex.getMessage());
}
testSucceeded = true;
}
public void testExtAndDirWithTwoRules() {
Case currentCase = CaseUtils.createAsCurrentCase("testExtAndDirWithTwoRules");
ImageDSProcessor dataSourceProcessor = new ImageDSProcessor();
IngestUtils.addDataSource(dataSourceProcessor, IMAGE_PATH);
HashMap<String, Rule> rules = new HashMap<>();
rules.put("rule1", new Rule("FindJpgExtention", new ExtensionCondition("jpg"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null));
rules.put("rule2", new Rule("FindDir1Directory", null, new MetaTypeCondition(MetaTypeCondition.Type.FILES), new ParentPathCondition("dir1"), null, null, null));
//Build the filter that ingnore unallocated space and with 2 rules
FilesSet filesExtDirsFilter = new FilesSet("Filter", "Filter to find all files in dir1 and all files with jpg extention.", false, true, rules);
try {
ArrayList<IngestModuleTemplate> templates = new ArrayList<>();
templates.add(IngestUtils.getIngestModuleTemplate(new FileTypeIdModuleFactory()));
IngestJobSettings ingestJobSettings = new IngestJobSettings(IngestFileFiltersTest.class.getCanonicalName(), IngestJobSettings.IngestType.FILES_ONLY, templates, filesExtDirsFilter);
IngestUtils.runIngestJob(currentCase.getDataSources(), ingestJobSettings);
FileManager fileManager = currentCase.getServices().getFileManager();
List<AbstractFile> results = fileManager.findFiles("%%");
assertEquals(62, results.size());
for (AbstractFile file : results) {
if (file.getNameExtension().equalsIgnoreCase("jpg")) { //All files with .jpg extension should have MIME type
String errMsg = String.format("File %s (objId=%d) unexpectedly blocked by the file filter.", file.getName(), file.getId());
assertTrue(errMsg, file.getMIMEType() != null && !file.getMIMEType().isEmpty());
} else if (file.getParentPath().equalsIgnoreCase("/dir1/")) {
//All files in dir1 should have MIME type except '.' '..' slack files
if (file.getName().equals(".") || file.getName().equals("..") || file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.SLACK) {
String errMsg = String.format("File %s (objId=%d) unexpectedly passed by the file filter.", file.getName(), file.getId());
assertTrue(errMsg, file.getMIMEType() == null);
} else {
String errMsg = String.format("File %s (objId=%d) unexpectedly blocked by the file filter.", file.getName(), file.getId());
assertTrue(errMsg, file.getMIMEType() != null && !file.getMIMEType().isEmpty());
}
} else { //All files that are not in dir1 or not with .jpg extension should not have MIME type
String errMsg = String.format("File %s (objId=%d) unexpectedly passed by the file filter.", file.getName(), file.getId());
assertTrue(errMsg, file.getMIMEType() == null);
}
}
} catch (TskCoreException ex) {
Exceptions.printStackTrace(ex);
Assert.fail(ex.getMessage());
}
testSucceeded = true;
}
public void testFullFileNameRule() {
// Case currentCase = CaseUtils.createAsCurrentCase("testFullFileNameRule");
// ImageDSProcessor dataSourceProcessor = new ImageDSProcessor();
// IngestUtils.addDataSource(dataSourceProcessor, IMAGE_PATH);
//
// HashMap<String, Rule> rules = new HashMap<>();
// rules.put("rule", new Rule("FindFileWithFullName", new FullNameCondition("file.docx"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null));
// //Build the filter to find file: file.docx
// FilesSet fullNameFilter = new FilesSet("Filter", "Filter to find file.docx.", false, true, rules);
//
// try {
// ArrayList<IngestModuleTemplate> templates = new ArrayList<>();
// templates.add(IngestUtils.getIngestModuleTemplate(new FileTypeIdModuleFactory()));
// IngestJobSettings ingestJobSettings = new IngestJobSettings(IngestFileFiltersTest.class.getCanonicalName(), IngestJobSettings.IngestType.FILES_ONLY, templates, fullNameFilter);
// IngestUtils.runIngestJob(currentCase.getDataSources(), ingestJobSettings);
// FileManager fileManager = currentCase.getServices().getFileManager();
// List<AbstractFile> results = fileManager.findFiles("%%");
// assertEquals(62, results.size());
// for (AbstractFile file : results) {
// //Only file.docx has MIME Type
// if (file.getName().equalsIgnoreCase("file.docx")) {
// String errMsg = String.format("File %s (objId=%d) unexpectedly blocked by the file filter.", file.getName(), file.getId());
// assertTrue(errMsg, file.getMIMEType() != null && !file.getMIMEType().isEmpty());
// } else {
// String errMsg = String.format("File %s (objId=%d) unexpectedly passed by the file filter.", file.getName(), file.getId());
// assertTrue(errMsg, file.getMIMEType() == null);
// }
// }
// } catch (TskCoreException ex) {
// Exceptions.printStackTrace(ex);
// Assert.fail(ex.getMessage());
// }
//
// testSucceeded = true;
// }
//
// public void testCarvingWithExtRuleAndUnallocSpace() {
// Case currentCase = CaseUtils.createAsCurrentCase("testCarvingWithExtRuleAndUnallocSpace");
// ImageDSProcessor dataSourceProcessor = new ImageDSProcessor();
// IngestUtils.addDataSource(dataSourceProcessor, IMAGE_PATH);
//
// HashMap<String, Rule> rules = new HashMap<>();
// rules.put("rule1", new Rule("FindJpgExtention", new ExtensionCondition("jpg"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null));
// rules.put("rule2", new Rule("FindGifExtention", new ExtensionCondition("gif"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null));
//
// //Build the filter to find files with .jpg and .gif extension and unallocated space
// FilesSet extensionFilter = new FilesSet("Filter", "Filter to files with .jpg and .gif extension.", false, false, rules);
//
// try {
// ArrayList<IngestModuleTemplate> templates = new ArrayList<>();
// templates.add(IngestUtils.getIngestModuleTemplate(new FileTypeIdModuleFactory()));
// templates.add(IngestUtils.getIngestModuleTemplate(new PhotoRecCarverIngestModuleFactory()));
// IngestJobSettings ingestJobSettings = new IngestJobSettings(IngestFileFiltersTest.class.getCanonicalName(), IngestJobSettings.IngestType.FILES_ONLY, templates, extensionFilter);
// IngestUtils.runIngestJob(currentCase.getDataSources(), ingestJobSettings);
// FileManager fileManager = currentCase.getServices().getFileManager();
// List<AbstractFile> results = fileManager.findFiles("%%");
// assertEquals(70, results.size());
// int carvedJpgGifFiles = 0;
// for (AbstractFile file : results) {
// if (file.getNameExtension().equalsIgnoreCase("jpg") || file.getNameExtension().equalsIgnoreCase("gif")) { //Unalloc file and .jpg files in dir1, dir2, $CarvedFiles, root directory should have MIME type
// String errMsg = String.format("File %s (objId=%d) unexpectedly blocked by the file filter.", file.getName(), file.getId());
// assertTrue(errMsg, file.getMIMEType() != null && !file.getMIMEType().isEmpty());
//
// if (file.getParentPath().equalsIgnoreCase("/$CarvedFiles/")) {
// carvedJpgGifFiles++;
// }
// } else if (file.getName().startsWith("Unalloc_")) {
// String errMsg = String.format("File %s (objId=%d) unexpectedly blocked by the file filter.", file.getName(), file.getId());
// assertTrue(errMsg, file.getMIMEType() != null && !file.getMIMEType().isEmpty());
// } else { //All other files should not have MIME type.
// String errMsg = String.format("File %s (objId=%d) unexpectedly passed by the file filter.", file.getName(), file.getId());
// assertTrue(errMsg, file.getMIMEType() == null);
// }
// }
// //Make sure we have carved jpg/gif files
// assertEquals(2, carvedJpgGifFiles);
//
// } catch (TskCoreException ex) {
// Exceptions.printStackTrace(ex);
// Assert.fail(ex.getMessage());
// }
//
// testSucceeded = true;
Case currentCase = CaseUtils.createAsCurrentCase("testFullFileNameRule");
ImageDSProcessor dataSourceProcessor = new ImageDSProcessor();
IngestUtils.addDataSource(dataSourceProcessor, IMAGE_PATH);
HashMap<String, Rule> rules = new HashMap<>();
rules.put("rule", new Rule("FindFileWithFullName", new FullNameCondition("file.docx"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null));
//Build the filter to find file: file.docx
FilesSet fullNameFilter = new FilesSet("Filter", "Filter to find file.docx.", false, true, rules);
try {
ArrayList<IngestModuleTemplate> templates = new ArrayList<>();
templates.add(IngestUtils.getIngestModuleTemplate(new FileTypeIdModuleFactory()));
IngestJobSettings ingestJobSettings = new IngestJobSettings(IngestFileFiltersTest.class.getCanonicalName(), IngestJobSettings.IngestType.FILES_ONLY, templates, fullNameFilter);
IngestUtils.runIngestJob(currentCase.getDataSources(), ingestJobSettings);
FileManager fileManager = currentCase.getServices().getFileManager();
List<AbstractFile> results = fileManager.findFiles("%%");
assertEquals(62, results.size());
for (AbstractFile file : results) {
//Only file.docx has MIME Type
if (file.getName().equalsIgnoreCase("file.docx")) {
String errMsg = String.format("File %s (objId=%d) unexpectedly blocked by the file filter.", file.getName(), file.getId());
assertTrue(errMsg, file.getMIMEType() != null && !file.getMIMEType().isEmpty());
} else {
String errMsg = String.format("File %s (objId=%d) unexpectedly passed by the file filter.", file.getName(), file.getId());
assertTrue(errMsg, file.getMIMEType() == null);
}
}
} catch (TskCoreException ex) {
Exceptions.printStackTrace(ex);
Assert.fail(ex.getMessage());
}
testSucceeded = true;
}
public void testCarvingWithExtRuleAndUnallocSpace() {
Case currentCase = CaseUtils.createAsCurrentCase("testCarvingWithExtRuleAndUnallocSpace");
ImageDSProcessor dataSourceProcessor = new ImageDSProcessor();
IngestUtils.addDataSource(dataSourceProcessor, IMAGE_PATH);
HashMap<String, Rule> rules = new HashMap<>();
rules.put("rule1", new Rule("FindJpgExtention", new ExtensionCondition("jpg"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null));
rules.put("rule2", new Rule("FindGifExtention", new ExtensionCondition("gif"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null));
//Build the filter to find files with .jpg and .gif extension and unallocated space
FilesSet extensionFilter = new FilesSet("Filter", "Filter to files with .jpg and .gif extension.", false, false, rules);
try {
ArrayList<IngestModuleTemplate> templates = new ArrayList<>();
templates.add(IngestUtils.getIngestModuleTemplate(new FileTypeIdModuleFactory()));
templates.add(IngestUtils.getIngestModuleTemplate(new PhotoRecCarverIngestModuleFactory()));
IngestJobSettings ingestJobSettings = new IngestJobSettings(IngestFileFiltersTest.class.getCanonicalName(), IngestJobSettings.IngestType.FILES_ONLY, templates, extensionFilter);
IngestUtils.runIngestJob(currentCase.getDataSources(), ingestJobSettings);
FileManager fileManager = currentCase.getServices().getFileManager();
List<AbstractFile> results = fileManager.findFiles("%%");
assertEquals(70, results.size());
int carvedJpgGifFiles = 0;
for (AbstractFile file : results) {
if (file.getNameExtension().equalsIgnoreCase("jpg") || file.getNameExtension().equalsIgnoreCase("gif")) { //Unalloc file and .jpg files in dir1, dir2, $CarvedFiles, root directory should have MIME type
String errMsg = String.format("File %s (objId=%d) unexpectedly blocked by the file filter.", file.getName(), file.getId());
assertTrue(errMsg, file.getMIMEType() != null && !file.getMIMEType().isEmpty());
if (file.getParentPath().equalsIgnoreCase("/$CarvedFiles/")) {
carvedJpgGifFiles++;
}
} else if (file.getName().startsWith("Unalloc_")) {
String errMsg = String.format("File %s (objId=%d) unexpectedly blocked by the file filter.", file.getName(), file.getId());
assertTrue(errMsg, file.getMIMEType() != null && !file.getMIMEType().isEmpty());
} else { //All other files should not have MIME type.
String errMsg = String.format("File %s (objId=%d) unexpectedly passed by the file filter.", file.getName(), file.getId());
assertTrue(errMsg, file.getMIMEType() == null);
}
}
//Make sure we have carved jpg/gif files
assertEquals(2, carvedJpgGifFiles);
} catch (TskCoreException ex) {
Exceptions.printStackTrace(ex);
Assert.fail(ex.getMessage());
}
testSucceeded = true;
}
public void testCarvingNoUnallocatedSpace() {
// Case currentCase = CaseUtils.createAsCurrentCase("testCarvingNoUnallocatedSpace");
// ImageDSProcessor dataSourceProcessor = new ImageDSProcessor();
// IngestUtils.addDataSource(dataSourceProcessor, IMAGE_PATH);
//
// HashMap<String, Rule> rules = new HashMap<>();
// rules.put("rule1", new Rule("FindJpgExtention", new ExtensionCondition("jpg"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null));
// rules.put("rule2", new Rule("FindGifExtention", new ExtensionCondition("gif"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null));
//
// //Build the filter to find files with .jpg and .gif extension
// FilesSet extensionFilter = new FilesSet("Filter", "Filter to files with .jpg and .gif extension.", false, true, rules);
//
// try {
// ArrayList<IngestModuleTemplate> templates = new ArrayList<>();
// templates.add(IngestUtils.getIngestModuleTemplate(new FileTypeIdModuleFactory()));
// templates.add(IngestUtils.getIngestModuleTemplate(new PhotoRecCarverIngestModuleFactory()));
// IngestJobSettings ingestJobSettings = new IngestJobSettings(IngestFileFiltersTest.class.getCanonicalName(), IngestType.FILES_ONLY, templates, extensionFilter);
// try {
// List<IngestModuleError> errs = IngestJobRunner.runIngestJob(currentCase.getDataSources(), ingestJobSettings);
// //Ingest fails because Carving wants unallocated space
// assertEquals(1, errs.size());
// assertEquals("PhotoRec Carver", errs.get(0).getModuleDisplayName());
// } catch (InterruptedException ex) {
// Exceptions.printStackTrace(ex);
// Assert.fail(ex.getMessage());
// }
// } catch (TskCoreException ex) {
// Exceptions.printStackTrace(ex);
// Assert.fail(ex.getMessage());
// }
//
// testSucceeded = true;
Case currentCase = CaseUtils.createAsCurrentCase("testCarvingNoUnallocatedSpace");
ImageDSProcessor dataSourceProcessor = new ImageDSProcessor();
IngestUtils.addDataSource(dataSourceProcessor, IMAGE_PATH);
HashMap<String, Rule> rules = new HashMap<>();
rules.put("rule1", new Rule("FindJpgExtention", new ExtensionCondition("jpg"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null));
rules.put("rule2", new Rule("FindGifExtention", new ExtensionCondition("gif"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null));
//Build the filter to find files with .jpg and .gif extension
FilesSet extensionFilter = new FilesSet("Filter", "Filter to files with .jpg and .gif extension.", false, true, rules);
try {
ArrayList<IngestModuleTemplate> templates = new ArrayList<>();
templates.add(IngestUtils.getIngestModuleTemplate(new FileTypeIdModuleFactory()));
templates.add(IngestUtils.getIngestModuleTemplate(new PhotoRecCarverIngestModuleFactory()));
IngestJobSettings ingestJobSettings = new IngestJobSettings(IngestFileFiltersTest.class.getCanonicalName(), IngestType.FILES_ONLY, templates, extensionFilter);
try {
List<IngestModuleError> errs = IngestJobRunner.runIngestJob(currentCase.getDataSources(), ingestJobSettings);
//Ingest fails because Carving wants unallocated space
assertEquals(1, errs.size());
assertEquals("PhotoRec Carver", errs.get(0).getModuleDisplayName());
} catch (InterruptedException ex) {
Exceptions.printStackTrace(ex);
Assert.fail(ex.getMessage());
}
} catch (TskCoreException ex) {
Exceptions.printStackTrace(ex);
Assert.fail(ex.getMessage());
}
testSucceeded = true;
}
public void testEmbeddedModule() {
// Case currentCase = CaseUtils.createAsCurrentCase("testEmbeddedModule");
// LocalFilesDSProcessor dataSourceProcessor = new LocalFilesDSProcessor();
// IngestUtils.addDataSource(dataSourceProcessor, ZIPFILE_PATH);
//
// //Build the filter to find jpg files
// HashMap<String, Rule> rules = new HashMap<>();
// //Extension condition for jpg files
// rules.put("rule1", new Rule("FindJpgExtention", new ExtensionCondition("jpg"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null));
// //Extension condition for zip files, because we want test jpg extension filter for extracted files from a zip file
// rules.put("rule2", new Rule("ZipExtention", new ExtensionCondition("zip"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null));
// FilesSet embeddedFilter = new FilesSet("Filter", "Filter to files with .jpg extension.", false, false, rules);
//
// try {
// ArrayList<IngestModuleTemplate> templates = new ArrayList<>();
// templates.add(IngestUtils.getIngestModuleTemplate(new FileTypeIdModuleFactory()));
// templates.add(IngestUtils.getIngestModuleTemplate(new EmbeddedFileExtractorModuleFactory()));
// IngestJobSettings ingestJobSettings = new IngestJobSettings(IngestFileFiltersTest.class.getCanonicalName(), IngestJobSettings.IngestType.FILES_ONLY, templates, embeddedFilter);
// IngestUtils.runIngestJob(currentCase.getDataSources(), ingestJobSettings);
// FileManager fileManager = currentCase.getServices().getFileManager();
// //get all .jpg files in zip file
// List<AbstractFile> results = fileManager.findFiles("%%");
// assertEquals(39, results.size());
// int numTypeJpgFiles = 0;
// for (AbstractFile file : results) {
// if (file.getNameExtension().equalsIgnoreCase("jpg") || file.getNameExtension().equalsIgnoreCase("zip")) {
// String errMsg = String.format("File %s (objId=%d) unexpectedly blocked by the file filter.", file.getName(), file.getId());
// assertTrue(errMsg, file.getMIMEType() != null && !file.getMIMEType().isEmpty());
// numTypeJpgFiles++;
// } else if (file.isDir() && (file.getType() == TSK_DB_FILES_TYPE_ENUM.DERIVED || file.getType() == TSK_DB_FILES_TYPE_ENUM.LOCAL)) {
// String errMsg = String.format("File %s (objId=%d) unexpectedly blocked by the file filter.", file.getName(), file.getId());
// assertTrue(errMsg, file.getMIMEType() != null && !file.getMIMEType().isEmpty());
// } else {
// String errMsg = String.format("File %s (objId=%d) unexpectedly passed by the file filter.", file.getName(), file.getId());
// assertTrue(errMsg, file.getMIMEType() == null);
// }
// }
// //Make sure 10 jpg files and 1 zip file have been typed
// assertEquals(11, numTypeJpgFiles);
// } catch (TskCoreException ex) {
// Exceptions.printStackTrace(ex);
// Assert.fail(ex.getMessage());
// }
//
// testSucceeded = true;
Case currentCase = CaseUtils.createAsCurrentCase("testEmbeddedModule");
LocalFilesDSProcessor dataSourceProcessor = new LocalFilesDSProcessor();
IngestUtils.addDataSource(dataSourceProcessor, ZIPFILE_PATH);
//Build the filter to find jpg files
HashMap<String, Rule> rules = new HashMap<>();
//Extension condition for jpg files
rules.put("rule1", new Rule("FindJpgExtention", new ExtensionCondition("jpg"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null));
//Extension condition for zip files, because we want test jpg extension filter for extracted files from a zip file
rules.put("rule2", new Rule("ZipExtention", new ExtensionCondition("zip"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null));
FilesSet embeddedFilter = new FilesSet("Filter", "Filter to files with .jpg extension.", false, false, rules);
try {
ArrayList<IngestModuleTemplate> templates = new ArrayList<>();
templates.add(IngestUtils.getIngestModuleTemplate(new FileTypeIdModuleFactory()));
templates.add(IngestUtils.getIngestModuleTemplate(new EmbeddedFileExtractorModuleFactory()));
IngestJobSettings ingestJobSettings = new IngestJobSettings(IngestFileFiltersTest.class.getCanonicalName(), IngestJobSettings.IngestType.FILES_ONLY, templates, embeddedFilter);
IngestUtils.runIngestJob(currentCase.getDataSources(), ingestJobSettings);
FileManager fileManager = currentCase.getServices().getFileManager();
//get all .jpg files in zip file
List<AbstractFile> results = fileManager.findFiles("%%");
assertEquals(39, results.size());
int numTypeJpgFiles = 0;
for (AbstractFile file : results) {
if (file.getNameExtension().equalsIgnoreCase("jpg") || file.getNameExtension().equalsIgnoreCase("zip")) {
String errMsg = String.format("File %s (objId=%d) unexpectedly blocked by the file filter.", file.getName(), file.getId());
assertTrue(errMsg, file.getMIMEType() != null && !file.getMIMEType().isEmpty());
numTypeJpgFiles++;
} else if (file.isDir() && (file.getType() == TSK_DB_FILES_TYPE_ENUM.DERIVED || file.getType() == TSK_DB_FILES_TYPE_ENUM.LOCAL)) {
String errMsg = String.format("File %s (objId=%d) unexpectedly blocked by the file filter.", file.getName(), file.getId());
assertTrue(errMsg, file.getMIMEType() != null && !file.getMIMEType().isEmpty());
} else {
String errMsg = String.format("File %s (objId=%d) unexpectedly passed by the file filter.", file.getName(), file.getId());
assertTrue(errMsg, file.getMIMEType() == null);
}
}
//Make sure 10 jpg files and 1 zip file have been typed
assertEquals(11, numTypeJpgFiles);
} catch (TskCoreException ex) {
Exceptions.printStackTrace(ex);
Assert.fail(ex.getMessage());
}
testSucceeded = true;
}
}