From 636b27b30e60a87e4b126b712f5830e2426c8de5 Mon Sep 17 00:00:00 2001 From: "U-BASIS\\zhaohui" Date: Wed, 28 Mar 2018 17:47:52 -0400 Subject: [PATCH 1/7] 3591: 2nd test for file filter --- .../autopsy/ingest/IngestFileFiltersTest.java | 30 +++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java index 258ef092c7..96e60e1d82 100644 --- a/Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java +++ b/Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java @@ -25,7 +25,9 @@ import java.nio.file.Paths; import java.util.ArrayList; import java.util.HashMap; import java.util.List; +import static junit.framework.Assert.assertEquals; import static junit.framework.Assert.assertFalse; +import static junit.framework.Assert.assertTrue; import junit.framework.TestCase; import org.netbeans.junit.NbModuleSuite; import org.sleuthkit.autopsy.casemodule.Case; @@ -156,6 +158,34 @@ public class IngestFileFiltersTest extends TestCase { } } + public void testExtAndDirWithOneRule() { + HashMap rule = new HashMap<>(); + rule.put("Rule", new Rule("testFileType", new Rule.ExtensionCondition("jpg"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), new ParentPathCondition("dir1"), null, null, null)); + //Build the filter that ignore unallocated space and with one rule + FilesSet Files_Ext_Dirs_Filter = new FilesSet("Filter", "Filter to find all jpg files in dir1.", false, false, rule); + + try { + Case openCase = Case.getOpenCase(); + runIngestJob(openCase.getDataSources(), Files_Ext_Dirs_Filter); + FileManager fileManager = Case.getOpenCase().getServices().getFileManager(); + List results = fileManager.findFiles("%.jpg%"); + assertEquals(12, results.size()); + for (AbstractFile file : results) { + //Files with jpg extension in dir1 should have MIME Type + if (file.getParentPath().equalsIgnoreCase("/dir1/") && file.getNameExtension().equalsIgnoreCase("jpg")) { + String errMsg = String.format("File %s (objId=%d) unexpectedly passed by the file filter.", file.getName(), file.getId()); + assertTrue(errMsg, file.getMIMEType() != null); + } else { //All others shouldn't have MIME Type + String errMsg = String.format("File %s (objId=%d) unexpectedly caught by the file filter.", file.getName(), file.getId()); + assertTrue(errMsg, file.getMIMEType() == null); + } + } + } catch (NoCurrentCaseException | TskCoreException ex) { + Exceptions.printStackTrace(ex); + Assert.fail(ex); + } + } + private void runIngestJob(List datasources, FilesSet filter) { FileTypeIdModuleFactory factory = new FileTypeIdModuleFactory(); IngestModuleIngestJobSettings settings = factory.getDefaultIngestJobSettings(); From c46ab10f06cba638fd02895b9d1e8411b7cc578f Mon Sep 17 00:00:00 2001 From: "U-BASIS\\zhaohui" Date: Thu, 29 Mar 2018 12:28:13 -0400 Subject: [PATCH 2/7] 3591: Rename variables and test for ignore unallocated space. --- .../org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java index 96e60e1d82..dc6ddbc059 100644 --- a/Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java +++ b/Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java @@ -159,10 +159,10 @@ public class IngestFileFiltersTest extends TestCase { } public void testExtAndDirWithOneRule() { - HashMap rule = new HashMap<>(); - rule.put("Rule", new Rule("testFileType", new Rule.ExtensionCondition("jpg"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), new ParentPathCondition("dir1"), null, null, null)); + HashMap rules = new HashMap<>(); + rules.put("Rule", new Rule("testFileType", new Rule.ExtensionCondition("jpg"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), new ParentPathCondition("dir1"), null, null, null)); //Build the filter that ignore unallocated space and with one rule - FilesSet Files_Ext_Dirs_Filter = new FilesSet("Filter", "Filter to find all jpg files in dir1.", false, false, rule); + FilesSet Files_Ext_Dirs_Filter = new FilesSet("Filter", "Filter to find all jpg files in dir1.", false, true, rules); try { Case openCase = Case.getOpenCase(); From 3c47b6a7d218e8d1be92a286992373e83c750d34 Mon Sep 17 00:00:00 2001 From: "U-BASIS\\zhaohui" Date: Fri, 30 Mar 2018 17:08:48 -0400 Subject: [PATCH 3/7] 3591: Correct the error message. --- .../sleuthkit/autopsy/ingest/IngestFileFiltersTest.java | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java index dc6ddbc059..6f56bd2654 100644 --- a/Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java +++ b/Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java @@ -160,7 +160,7 @@ public class IngestFileFiltersTest extends TestCase { public void testExtAndDirWithOneRule() { HashMap rules = new HashMap<>(); - rules.put("Rule", new Rule("testFileType", new Rule.ExtensionCondition("jpg"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), new ParentPathCondition("dir1"), null, null, null)); + rules.put("Rule", new Rule("testExtAndDirWithOneRule", new Rule.ExtensionCondition("jpg"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), new ParentPathCondition("dir1"), null, null, null)); //Build the filter that ignore unallocated space and with one rule FilesSet Files_Ext_Dirs_Filter = new FilesSet("Filter", "Filter to find all jpg files in dir1.", false, true, rules); @@ -173,10 +173,10 @@ public class IngestFileFiltersTest extends TestCase { for (AbstractFile file : results) { //Files with jpg extension in dir1 should have MIME Type if (file.getParentPath().equalsIgnoreCase("/dir1/") && file.getNameExtension().equalsIgnoreCase("jpg")) { - String errMsg = String.format("File %s (objId=%d) unexpectedly passed by the file filter.", file.getName(), file.getId()); - assertTrue(errMsg, file.getMIMEType() != null); + String errMsg = String.format("File %s (objId=%d) unexpectedly blocked by the file filter.", file.getName(), file.getId()); + assertTrue(errMsg, !(file.getMIMEType() == null || file.getMIMEType().isEmpty())); } else { //All others shouldn't have MIME Type - String errMsg = String.format("File %s (objId=%d) unexpectedly caught by the file filter.", file.getName(), file.getId()); + String errMsg = String.format("File %s (objId=%d) unexpectedly passed by the file filter.", file.getName(), file.getId()); assertTrue(errMsg, file.getMIMEType() == null); } } From 6762473866b188ce808328c6759e9c9d3c8e0423 Mon Sep 17 00:00:00 2001 From: "U-BASIS\\zhaohui" Date: Fri, 30 Mar 2018 17:17:06 -0400 Subject: [PATCH 4/7] 3591: clean up the imports. --- .../src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java | 2 -- 1 file changed, 2 deletions(-) diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java index 6f56bd2654..053cae21d0 100644 --- a/Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java +++ b/Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java @@ -25,9 +25,7 @@ import java.nio.file.Paths; import java.util.ArrayList; import java.util.HashMap; import java.util.List; -import static junit.framework.Assert.assertEquals; import static junit.framework.Assert.assertFalse; -import static junit.framework.Assert.assertTrue; import junit.framework.TestCase; import org.netbeans.junit.NbModuleSuite; import org.sleuthkit.autopsy.casemodule.Case; From cbf7637bb560bb2c573f0b1bba9555d0020cc81a Mon Sep 17 00:00:00 2001 From: "U-BASIS\\zhaohui" Date: Mon, 2 Apr 2018 14:18:23 -0400 Subject: [PATCH 5/7] 3591: Let filemanager to get all files, so that include gif file for testing. --- .../org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java index 053cae21d0..829650cbfc 100644 --- a/Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java +++ b/Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java @@ -166,8 +166,8 @@ public class IngestFileFiltersTest extends TestCase { Case openCase = Case.getOpenCase(); runIngestJob(openCase.getDataSources(), Files_Ext_Dirs_Filter); FileManager fileManager = Case.getOpenCase().getServices().getFileManager(); - List results = fileManager.findFiles("%.jpg%"); - assertEquals(12, results.size()); + List results = fileManager.findFiles("%%"); + assertEquals(62, results.size()); for (AbstractFile file : results) { //Files with jpg extension in dir1 should have MIME Type if (file.getParentPath().equalsIgnoreCase("/dir1/") && file.getNameExtension().equalsIgnoreCase("jpg")) { From 5373108e0c7a66d0a6346329a3f83aec05282edf Mon Sep 17 00:00:00 2001 From: "U-BASIS\\zhaohui" Date: Tue, 3 Apr 2018 14:49:52 -0400 Subject: [PATCH 6/7] 3591: Rename variables and rewrite the assert condition. --- .../sleuthkit/autopsy/ingest/IngestFileFiltersTest.java | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java index 829650cbfc..05cc84389f 100644 --- a/Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java +++ b/Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java @@ -143,7 +143,7 @@ public class IngestFileFiltersTest extends TestCase { if (file.getParentPath().equalsIgnoreCase("/dir1/")) { if (!(file.getName().equals(".") || file.getName().equals("..") || file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.SLACK)) { String errMsg = String.format("File %s (objId=%d) unexpectedly passed by the file filter.", file.getName(), file.getId()); - assertTrue(errMsg, !(file.getMIMEType() == null || file.getMIMEType().isEmpty())); + assertTrue(errMsg, file.getMIMEType() != null && !file.getMIMEType().isEmpty()); } } else { //All files not in dir1 shouldn't have MIME type String errMsg = String.format("File %s (objId=%d) unexpectedly caught by the file filter.", file.getName(), file.getId()); @@ -160,11 +160,11 @@ public class IngestFileFiltersTest extends TestCase { HashMap rules = new HashMap<>(); rules.put("Rule", new Rule("testExtAndDirWithOneRule", new Rule.ExtensionCondition("jpg"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), new ParentPathCondition("dir1"), null, null, null)); //Build the filter that ignore unallocated space and with one rule - FilesSet Files_Ext_Dirs_Filter = new FilesSet("Filter", "Filter to find all jpg files in dir1.", false, true, rules); + FilesSet filesExtDirsFilter = new FilesSet("Filter", "Filter to find all jpg files in dir1.", false, true, rules); try { Case openCase = Case.getOpenCase(); - runIngestJob(openCase.getDataSources(), Files_Ext_Dirs_Filter); + runIngestJob(openCase.getDataSources(), filesExtDirsFilter); FileManager fileManager = Case.getOpenCase().getServices().getFileManager(); List results = fileManager.findFiles("%%"); assertEquals(62, results.size()); @@ -172,7 +172,7 @@ public class IngestFileFiltersTest extends TestCase { //Files with jpg extension in dir1 should have MIME Type if (file.getParentPath().equalsIgnoreCase("/dir1/") && file.getNameExtension().equalsIgnoreCase("jpg")) { String errMsg = String.format("File %s (objId=%d) unexpectedly blocked by the file filter.", file.getName(), file.getId()); - assertTrue(errMsg, !(file.getMIMEType() == null || file.getMIMEType().isEmpty())); + assertTrue(errMsg, file.getMIMEType() != null && !file.getMIMEType().isEmpty()); } else { //All others shouldn't have MIME Type String errMsg = String.format("File %s (objId=%d) unexpectedly passed by the file filter.", file.getName(), file.getId()); assertTrue(errMsg, file.getMIMEType() == null); From db65143276309865e302ac328f435945f0456395 Mon Sep 17 00:00:00 2001 From: "U-BASIS\\zhaohui" Date: Tue, 3 Apr 2018 16:16:50 -0400 Subject: [PATCH 7/7] 3591: Print out the error message from running ingest job. --- .../org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java | 3 +++ 1 file changed, 3 insertions(+) diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java index 05cc84389f..869288df92 100644 --- a/Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java +++ b/Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java @@ -194,6 +194,9 @@ public class IngestFileFiltersTest extends TestCase { IngestJobSettings ingestJobSettings = new IngestJobSettings(IngestFileFiltersTest.class.getCanonicalName(), IngestType.FILES_ONLY, templates, filter); try { List errs = IngestJobRunner.runIngestJob(datasources, ingestJobSettings); + for (IngestModuleError err : errs) { + System.out.println(String.format("Error: %s: %s.", err.getModuleDisplayName(), err.toString())); + } assertEquals(0, errs.size()); } catch (InterruptedException ex) { Exceptions.printStackTrace(ex);