mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-20 03:24:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

improve plaso modules getAbstractFile() method to be more robust; use try-with-resources

Browse Source
This commit is contained in:
millmanorama 2018-09-12 17:51:52 +02:00
parent d3429c2c97
commit 15af1e03d0
1 changed files with 57 additions and 57 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

114
Core/src/org/sleuthkit/autopsy/modules/plaso/PlasoIngestModule.java
View File

@ -20,6 +20,7 @@ package org.sleuthkit.autopsy.modules.plaso;
import java.io.File; import java.io.File;
import java.io.IOException; import java.io.IOException;
import java.nio.file.Path;
import java.nio.file.Paths; import java.nio.file.Paths;
import java.sql.ResultSet; import java.sql.ResultSet;
import java.sql.SQLException; import java.sql.SQLException;
@ -43,6 +44,7 @@ import org.sleuthkit.autopsy.ingest.IngestJobContext;
import org.sleuthkit.autopsy.ingest.IngestMessage; import org.sleuthkit.autopsy.ingest.IngestMessage;
import org.sleuthkit.autopsy.ingest.IngestServices; import org.sleuthkit.autopsy.ingest.IngestServices;
import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.Blackboard.BlackboardException;
import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.BlackboardArtifact;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_TL_EVENT; import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_TL_EVENT;
import org.sleuthkit.datamodel.BlackboardAttribute; import org.sleuthkit.datamodel.BlackboardAttribute;
@ -270,64 +272,62 @@ public class PlasoIngestModule implements DataSourceIngestModule {
String connectionString = "jdbc:sqlite:" + plasoDb; //NON-NLS String connectionString = "jdbc:sqlite:" + plasoDb; //NON-NLS
String sqlStatement = "select substr(filename,1) filename, strftime('%s', datetime) 'epoch_date', description, source, type, sourcetype \n" String sqlStatement = "select substr(filename,1) filename, strftime('%s', datetime) 'epoch_date', description, source, type, sourcetype \n"
+ " from log2timeline where source not in ('FILE') and sourcetype not in ('UNKNOWN');"; + " from log2timeline where source not in ('FILE') and sourcetype not in ('UNKNOWN');";
try {
SQLiteDBConnect tempdbconnect = new SQLiteDBConnect("org.sqlite.JDBC", connectionString); //NON-NLS
try (ResultSet resultSet = tempdbconnect.executeQry(sqlStatement)) {
while (resultSet.next()) {
if (context.dataSourceIngestIsCancelled()) {
logger.log(Level.INFO, Bundle.PlasoIngestModule_create_artifacts_cancelled()); //NON-NLS
MessageNotifyUtil.Message.info(Bundle.PlasoIngestModule_create_artifacts_cancelled());
return;
}
// lots of bad dates try (SQLiteDBConnect tempdbconnect = new SQLiteDBConnect("org.sqlite.JDBC", connectionString); //NON-NLS
if (resultSet.getString("sourcetype").equals("PE Import Time")) { ResultSet resultSet = tempdbconnect.executeQry(sqlStatement)) {
continue; while (resultSet.next()) {
} // bad dates and duplicates with what we have. if (context.dataSourceIngestIsCancelled()) {
// TODO: merge results somehow logger.log(Level.INFO, Bundle.PlasoIngestModule_create_artifacts_cancelled()); //NON-NLS
else if (resultSet.getString("source").equals("WEBHIST")) { MessageNotifyUtil.Message.info(Bundle.PlasoIngestModule_create_artifacts_cancelled());
continue; return;
} }
statusHelper.progress(resultSet.getString("filename")); // lots of bad dates
if (resultSet.getString("sourcetype").equals("PE Import Time")) {
continue;
} // bad dates and duplicates with what we have.
// TODO: merge results somehow
else if (resultSet.getString("source").equals("WEBHIST")) {
continue;
}
Content resolvedFile = getAbstractFile(resultSet.getString("filename")); statusHelper.progress(resultSet.getString("filename"));
if (resolvedFile == null) {
logger.log(Level.INFO, "File from Plaso output not found. Associating with data source instead: {0}", resultSet.getString("filename"));
resolvedFile = image;
}
long eventType = findEventSubtype(resultSet.getString("source"), resultSet.getString("filename"), resultSet.getString("type"), resultSet.getString("description"), resultSet.getString("sourcetype"));
Collection<BlackboardAttribute> bbattributes = Arrays.asList(
new BlackboardAttribute(
ATTRIBUTE_TYPE.TSK_DATETIME, MODULE_NAME,
resultSet.getLong("epoch_date")),
new BlackboardAttribute(
ATTRIBUTE_TYPE.TSK_DESCRIPTION, MODULE_NAME,
resultSet.getString("description")),
new BlackboardAttribute(
ATTRIBUTE_TYPE.TSK_TL_EVENT_TYPE, MODULE_NAME,
eventType));
Content resolvedFile = getAbstractFile(resultSet.getString("filename"));
if (resolvedFile == null) {
logger.log(Level.INFO, "File from Plaso output not found. Associating with data source instead: {0}", resultSet.getString("filename"));
resolvedFile = image;
}
long eventType = findEventSubtype(resultSet.getString("source"), resultSet.getString("filename"), resultSet.getString("type"), resultSet.getString("description"), resultSet.getString("sourcetype"));
Collection<BlackboardAttribute> bbattributes = Arrays.asList(
new BlackboardAttribute(
ATTRIBUTE_TYPE.TSK_DATETIME, MODULE_NAME,
resultSet.getLong("epoch_date")),
new BlackboardAttribute(
ATTRIBUTE_TYPE.TSK_DESCRIPTION, MODULE_NAME,
resultSet.getString("description")),
new BlackboardAttribute(
ATTRIBUTE_TYPE.TSK_TL_EVENT_TYPE, MODULE_NAME,
eventType));
try {
BlackboardArtifact bbart = resolvedFile.newArtifact(TSK_TL_EVENT);
bbart.addAttributes(bbattributes);
try { try {
BlackboardArtifact bbart = resolvedFile.newArtifact(TSK_TL_EVENT); /*
bbart.addAttributes(bbattributes); * post the artifact which will index the artifact for
try { * keyword search, and fire an event to notify UI of
/* * this new artifact
* post the artifact which will index the artifact */
* for keyword search, and fire an event to notify blackboard.postArtifact(bbart, MODULE_NAME);
* UI of this new artifact } catch (BlackboardException ex) {
*/ logger.log(Level.INFO, Bundle.PlasoIngestModule_exception_posting_artifact(), ex); //NON-NLS
blackboard.postArtifact(bbart, MODULE_NAME);
} catch (org.sleuthkit.datamodel.Blackboard.BlackboardException ex) {
logger.log(Level.INFO, Bundle.PlasoIngestModule_exception_posting_artifact(), ex); //NON-NLS
}
} catch (TskCoreException ex) {
logger.log(Level.INFO, Bundle.PlasoIngestModule_exception_adding_artifact(), ex);
} }
} catch (TskCoreException ex) {
logger.log(Level.INFO, Bundle.PlasoIngestModule_exception_adding_artifact(), ex);
} }
} }
tempdbconnect.closeConnection();
} catch (SQLException ex) { } catch (SQLException ex) {
logger.log(Level.SEVERE, Bundle.PlasoIngestModule_exception_database_error(), ex); //NON-NLS logger.log(Level.SEVERE, Bundle.PlasoIngestModule_exception_database_error(), ex); //NON-NLS
} }
@ -336,12 +336,12 @@ public class PlasoIngestModule implements DataSourceIngestModule {
@NbBundle.Messages({"PlasoIngestModule_exception_find_file=Exception finding file."}) @NbBundle.Messages({"PlasoIngestModule_exception_find_file=Exception finding file."})
private AbstractFile getAbstractFile(String file) { private AbstractFile getAbstractFile(String file) {
List<AbstractFile> abstractFiles; Path path = Paths.get(file);
File eventFile = new File(file.replaceAll("\\\\", "/")); String fileName = path.getFileName().toString();
String fileName = eventFile.getName().toLowerCase(); String filePath = path.getParent().toString().replaceAll("\\\\", "/");
String filePath = eventFile.getParent(); if (filePath.endsWith("/") == false) {
filePath = filePath.replaceAll("\\\\", "/"); filePath += "/";
filePath = filePath.toLowerCase() + "/"; }
// check the cached file // check the cached file
if (previousFile != null if (previousFile != null
@ -351,7 +351,7 @@ public class PlasoIngestModule implements DataSourceIngestModule {
} }
try { try {
abstractFiles = fileManager.findFiles(fileName, filePath); List<AbstractFile> abstractFiles = fileManager.findFiles(fileName, filePath);
if (abstractFiles.size() == 1) { if (abstractFiles.size() == 1) {
return abstractFiles.get(0); return abstractFiles.get(0);
} }