mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-16 09:47:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4278 from millmanorama/1117-FileTypeUtils

Browse Source 
1117 file type utils
This commit is contained in:
Richard Cordovano 2018-11-26 11:48:21 -05:00 committed by GitHub
commit 220f19b383
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
6 changed files with 263 additions and 181 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

85
Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeSearcher.java
View File

@ -21,16 +21,15 @@ package org.sleuthkit.autopsy.commonfilesearch;
import java.sql.SQLException; import java.sql.SQLException;
import java.util.ArrayList; import java.util.ArrayList;
import java.util.Collections; import java.util.HashSet;
import java.util.List; import java.util.List;
import java.util.Map; import java.util.Map;
import java.util.Set; import java.util.Set;
import java.util.TreeMap; import java.util.TreeMap;
import java.util.stream.Collectors;
import java.util.stream.Stream;
import org.openide.util.NbBundle; import org.openide.util.NbBundle;
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException;
import org.sleuthkit.autopsy.coreutils.FileTypeUtils;
import org.sleuthkit.datamodel.TskCoreException; import org.sleuthkit.datamodel.TskCoreException;
/** /**
@ -97,9 +96,10 @@ public abstract class AbstractCommonAttributeSearcher {
/** /**
* Get the portion of the title that will display the frequency percentage * Get the portion of the title that will display the frequency percentage
* threshold. Items that existed in over this percent of data sources were * threshold. Items that existed in over this percent of data sources were
* ommited from the results. * ommited from the results.
* *
* @return A string providing the frequency percentage threshold, or an empty string if no threshold was set * @return A string providing the frequency percentage threshold, or an
* empty string if no threshold was set
*/ */
@NbBundle.Messages({ @NbBundle.Messages({
"# {0} - threshold percent", "# {0} - threshold percent",
@ -130,69 +130,6 @@ public abstract class AbstractCommonAttributeSearcher {
return instanceCollatedCommonFiles; return instanceCollatedCommonFiles;
} }
/*
* The set of the MIME types that will be checked for extension mismatches
* when checkType is ONLY_MEDIA. ".jpg", ".jpeg", ".png", ".psd", ".nef",
* ".tiff", ".bmp", ".tec" ".aaf", ".3gp", ".asf", ".avi", ".m1v", ".m2v",
* //NON-NLS ".m4v", ".mp4", ".mov", ".mpeg", ".mpg", ".mpe", ".mp4", ".rm",
* ".wmv", ".mpv", ".flv", ".swf"
*/
static final Set<String> MEDIA_PICS_VIDEO_MIME_TYPES = Stream.of(
"image/bmp", //NON-NLS
"image/gif", //NON-NLS
"image/jpeg", //NON-NLS
"image/png", //NON-NLS
"image/tiff", //NON-NLS
"image/vnd.adobe.photoshop", //NON-NLS
"image/x-raw-nikon", //NON-NLS
"image/x-ms-bmp", //NON-NLS
"image/x-icon", //NON-NLS
"video/webm", //NON-NLS
"video/3gpp", //NON-NLS
"video/3gpp2", //NON-NLS
"video/ogg", //NON-NLS
"video/mpeg", //NON-NLS
"video/mp4", //NON-NLS
"video/quicktime", //NON-NLS
"video/x-msvideo", //NON-NLS
"video/x-flv", //NON-NLS
"video/x-m4v", //NON-NLS
"video/x-ms-wmv", //NON-NLS
"application/vnd.ms-asf", //NON-NLS
"application/vnd.rn-realmedia", //NON-NLS
"application/x-shockwave-flash" //NON-NLS
).collect(Collectors.toSet());
/*
* The set of the MIME types that will be checked for extension mismatches
* when checkType is ONLY_TEXT_FILES. ".doc", ".docx", ".odt", ".xls",
* ".xlsx", ".ppt", ".pptx" ".txt", ".rtf", ".log", ".text", ".xml" ".html",
* ".htm", ".css", ".js", ".php", ".aspx" ".pdf"
*/
static final Set<String> TEXT_FILES_MIME_TYPES = Stream.of(
"text/plain", //NON-NLS
"application/rtf", //NON-NLS
"application/pdf", //NON-NLS
"text/css", //NON-NLS
"text/html", //NON-NLS
"text/csv", //NON-NLS
"application/json", //NON-NLS
"application/javascript", //NON-NLS
"application/xml", //NON-NLS
"text/calendar", //NON-NLS
"application/x-msoffice", //NON-NLS
"application/x-ooxml", //NON-NLS
"application/msword", //NON-NLS
"application/vnd.openxmlformats-officedocument.wordprocessingml.document", //NON-NLS
"application/vnd.ms-powerpoint", //NON-NLS
"application/vnd.openxmlformats-officedocument.presentationml.presentation", //NON-NLS
"application/vnd.ms-excel", //NON-NLS
"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", //NON-NLS
"application/vnd.oasis.opendocument.presentation", //NON-NLS
"application/vnd.oasis.opendocument.spreadsheet", //NON-NLS
"application/vnd.oasis.opendocument.text" //NON-NLS
).collect(Collectors.toSet());
/** /**
* @return the filterByMedia * @return the filterByMedia
*/ */
@ -220,4 +157,16 @@ public abstract class AbstractCommonAttributeSearcher {
void setFilterByDoc(boolean filterByDoc) { void setFilterByDoc(boolean filterByDoc) {
this.filterByDoc = filterByDoc; this.filterByDoc = filterByDoc;
} }
Set<String> getMimeTypesToFilterOn() {
Set<String> mimeTypesToFilterOn = new HashSet<>();
if (isFilterByMedia()) {
mimeTypesToFilterOn.addAll(FileTypeUtils.FileTypeCategory.VISUAL.getMediaTypes());
}
if (isFilterByDoc()) {
mimeTypesToFilterOn.addAll(FileTypeUtils.FileTypeCategory.DOCUMENTS.getMediaTypes());
}
return mimeTypesToFilterOn;
}
} }

13
Core/src/org/sleuthkit/autopsy/commonfilesearch/AllInterCaseCommonAttributeSearcher.java
View File

@ -20,16 +20,14 @@
package org.sleuthkit.autopsy.commonfilesearch; package org.sleuthkit.autopsy.commonfilesearch;
import java.sql.SQLException; import java.sql.SQLException;
import java.util.HashSet;
import java.util.Map; import java.util.Map;
import java.util.Set; import java.util.Set;
import org.openide.util.NbBundle; import org.openide.util.NbBundle;
import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance.Type;
import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException;
import org.sleuthkit.datamodel.TskCoreException; import org.sleuthkit.datamodel.TskCoreException;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance.Type;
import static org.sleuthkit.autopsy.commonfilesearch.AbstractCommonAttributeSearcher.MEDIA_PICS_VIDEO_MIME_TYPES;
/** /**
* Algorithm which finds files anywhere in the Central Repo which also occur in * Algorithm which finds files anywhere in the Central Repo which also occur in
@ -57,14 +55,7 @@ public class AllInterCaseCommonAttributeSearcher extends InterCaseCommonAttribut
public CommonAttributeSearchResults findMatches() throws TskCoreException, NoCurrentCaseException, SQLException, EamDbException { public CommonAttributeSearchResults findMatches() throws TskCoreException, NoCurrentCaseException, SQLException, EamDbException {
InterCaseSearchResultsProcessor eamDbAttrInst = new InterCaseSearchResultsProcessor(corAttrType); InterCaseSearchResultsProcessor eamDbAttrInst = new InterCaseSearchResultsProcessor(corAttrType);
Map<Integer, CommonAttributeValueList> interCaseCommonFiles = eamDbAttrInst.findInterCaseCommonAttributeValues(Case.getCurrentCase()); Map<Integer, CommonAttributeValueList> interCaseCommonFiles = eamDbAttrInst.findInterCaseCommonAttributeValues(Case.getCurrentCase());
Set<String> mimeTypesToFilterOn = getMimeTypesToFilterOn();
Set<String> mimeTypesToFilterOn = new HashSet<>();
if (isFilterByMedia()) {
mimeTypesToFilterOn.addAll(MEDIA_PICS_VIDEO_MIME_TYPES);
}
if (isFilterByDoc()) {
mimeTypesToFilterOn.addAll(TEXT_FILES_MIME_TYPES);
}
return new CommonAttributeSearchResults(interCaseCommonFiles, this.frequencyPercentageThreshold, this.corAttrType, mimeTypesToFilterOn); return new CommonAttributeSearchResults(interCaseCommonFiles, this.frequencyPercentageThreshold, this.corAttrType, mimeTypesToFilterOn);
} }

62
Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCaseCommonAttributeSearcher.java
View File

@ -1,16 +1,16 @@
/* /*
* *
* Autopsy Forensic Browser * Autopsy Forensic Browser
* *
* Copyright 2018 Basis Technology Corp. * Copyright 2018 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org * Contact: carrier <at> sleuthkit <dot> org
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
* You may obtain a copy of the License at * You may obtain a copy of the License at
* *
* http://www.apache.org/licenses/LICENSE-2.0 * http://www.apache.org/licenses/LICENSE-2.0
* *
* Unless required by applicable law or agreed to in writing, software * Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, * distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@ -23,10 +23,9 @@ import java.sql.ResultSet;
import java.sql.SQLException; import java.sql.SQLException;
import java.util.Collections; import java.util.Collections;
import java.util.HashMap; import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
import java.util.Map; import java.util.Map;
import java.util.Set; import java.util.Set;
import java.util.stream.Collectors;
import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
import org.sleuthkit.datamodel.HashUtility; import org.sleuthkit.datamodel.HashUtility;
@ -45,25 +44,22 @@ import org.sleuthkit.datamodel.TskCoreException;
@SuppressWarnings("PMD.AbstractNaming") @SuppressWarnings("PMD.AbstractNaming")
public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAttributeSearcher { public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAttributeSearcher {
private static final String FILTER_BY_MIME_TYPES_WHERE_CLAUSE = " and mime_type in (%s)"; //NON-NLS // where %s is csv list of mime_types to filter on
private final Map<Long, String> dataSourceIdToNameMap; private final Map<Long, String> dataSourceIdToNameMap;
/** /**
* Subclass this to implement different algorithms for getting common files. * Subclass this to implement different algorithms for getting common files.
* *
* @param dataSourceIdMap a map of obj_id to datasource name * @param dataSourceIdMap a map of obj_id to datasource name
* @param filterByMediaMimeType match only on files whose mime types can be * @param filterByMediaMimeType match only on files whose mime types can be
* broadly categorized as media types * broadly categorized as media types
* @param filterByDocMimeType match only on files whose mime types can be * @param filterByDocMimeType match only on files whose mime types can be
* broadly categorized as document types * broadly categorized as document types
*/ */
IntraCaseCommonAttributeSearcher(Map<Long, String> dataSourceIdMap, boolean filterByMediaMimeType, boolean filterByDocMimeType, int percentageThreshold) { IntraCaseCommonAttributeSearcher(Map<Long, String> dataSourceIdMap, boolean filterByMediaMimeType, boolean filterByDocMimeType, int percentageThreshold) {
super(filterByMediaMimeType, filterByDocMimeType, percentageThreshold); super(filterByMediaMimeType, filterByDocMimeType, percentageThreshold);
this.dataSourceIdToNameMap = dataSourceIdMap; this.dataSourceIdToNameMap = dataSourceIdMap;
} }
Map<Long, String> getDataSourceIdToNameMap() { Map<Long, String> getDataSourceIdToNameMap() {
return Collections.unmodifiableMap(this.dataSourceIdToNameMap); return Collections.unmodifiableMap(this.dataSourceIdToNameMap);
} }
@ -96,7 +92,8 @@ public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAtt
* tree table tab to the top component. * tree table tab to the top component.
* *
* @return a data object with all of the matched files in a hierarchical * @return a data object with all of the matched files in a hierarchical
* format * format
*
* @throws TskCoreException * @throws TskCoreException
* @throws NoCurrentCaseException * @throws NoCurrentCaseException
* @throws SQLException * @throws SQLException
@ -149,29 +146,18 @@ public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAtt
* expression will be conjoined to base query with an AND operator. * expression will be conjoined to base query with an AND operator.
* *
* @return sql fragment of the form: 'and "mime_type" in ( [comma delimited * @return sql fragment of the form: 'and "mime_type" in ( [comma delimited
* list of mime types] )' or empty string in the event that no types to * list of mime types] )' or empty string in the event that no types
* filter on were given. * to filter on were given.
*/ */
String determineMimeTypeFilter() { String determineMimeTypeFilter() {
Set<String> mimeTypesToFilterOn = getMimeTypesToFilterOn();
Set<String> mimeTypesToFilterOn = new HashSet<>(); if (mimeTypesToFilterOn.isEmpty()) {
String mimeTypeString = ""; return "";
if (isFilterByMedia()) { } else {
mimeTypesToFilterOn.addAll(MEDIA_PICS_VIDEO_MIME_TYPES); String mimeTypeString = mimeTypesToFilterOn.stream()
.map(mimeType -> "'" + mimeType + "'")
.collect(Collectors.joining(","));
return String.format(" and mime_type in (%s)", new Object[]{mimeTypeString});
} }
if (isFilterByDoc()) {
mimeTypesToFilterOn.addAll(TEXT_FILES_MIME_TYPES);
}
StringBuilder mimeTypeFilter = new StringBuilder(mimeTypesToFilterOn.size());
if (!mimeTypesToFilterOn.isEmpty()) {
for (String mimeType : mimeTypesToFilterOn) {
mimeTypeFilter.append(SINGLE_QUOTE).append(mimeType).append(SINGLE_QUTOE_COMMA);
}
mimeTypeString = mimeTypeFilter.toString().substring(0, mimeTypeFilter.length() - 1);
mimeTypeString = String.format(FILTER_BY_MIME_TYPES_WHERE_CLAUSE, new Object[]{mimeTypeString});
}
return mimeTypeString;
} }
static final String SINGLE_QUTOE_COMMA = "',";
static final String SINGLE_QUOTE = "'";
} }

15
Core/src/org/sleuthkit/autopsy/commonfilesearch/SingleInterCaseCommonAttributeSearcher.java
View File

@ -20,17 +20,15 @@
package org.sleuthkit.autopsy.commonfilesearch; package org.sleuthkit.autopsy.commonfilesearch;
import java.sql.SQLException; import java.sql.SQLException;
import java.util.HashSet;
import java.util.Map; import java.util.Map;
import java.util.Set; import java.util.Set;
import org.openide.util.NbBundle; import org.openide.util.NbBundle;
import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance.Type;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationCase; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationCase;
import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException;
import org.sleuthkit.datamodel.TskCoreException; import org.sleuthkit.datamodel.TskCoreException;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance.Type;
import static org.sleuthkit.autopsy.commonfilesearch.AbstractCommonAttributeSearcher.MEDIA_PICS_VIDEO_MIME_TYPES;
/** /**
* *
@ -52,7 +50,7 @@ public class SingleInterCaseCommonAttributeSearcher extends InterCaseCommonAttri
* @throws EamDbException * @throws EamDbException
*/ */
public SingleInterCaseCommonAttributeSearcher(int correlationCaseId, boolean filterByMediaMimeType, public SingleInterCaseCommonAttributeSearcher(int correlationCaseId, boolean filterByMediaMimeType,
boolean filterByDocMimeType, Type corAttrType, int percentageThreshold) throws EamDbException { boolean filterByDocMimeType, Type corAttrType, int percentageThreshold) throws EamDbException {
super(filterByMediaMimeType, filterByDocMimeType, corAttrType, percentageThreshold); super(filterByMediaMimeType, filterByDocMimeType, corAttrType, percentageThreshold);
this.corrleationCaseId = correlationCaseId; this.corrleationCaseId = correlationCaseId;
@ -81,16 +79,11 @@ public class SingleInterCaseCommonAttributeSearcher extends InterCaseCommonAttri
CommonAttributeSearchResults findFiles(CorrelationCase correlationCase) throws TskCoreException, NoCurrentCaseException, SQLException, EamDbException { CommonAttributeSearchResults findFiles(CorrelationCase correlationCase) throws TskCoreException, NoCurrentCaseException, SQLException, EamDbException {
InterCaseSearchResultsProcessor eamDbAttrInst = new InterCaseSearchResultsProcessor(this.corAttrType); InterCaseSearchResultsProcessor eamDbAttrInst = new InterCaseSearchResultsProcessor(this.corAttrType);
Map<Integer, CommonAttributeValueList> interCaseCommonFiles = eamDbAttrInst.findSingleInterCaseCommonAttributeValues(Case.getCurrentCase(), correlationCase); Map<Integer, CommonAttributeValueList> interCaseCommonFiles = eamDbAttrInst.findSingleInterCaseCommonAttributeValues(Case.getCurrentCase(), correlationCase);
Set<String> mimeTypesToFilterOn = new HashSet<>(); Set<String> mimeTypesToFilterOn = getMimeTypesToFilterOn();
if (isFilterByMedia()) {
mimeTypesToFilterOn.addAll(MEDIA_PICS_VIDEO_MIME_TYPES);
}
if (isFilterByDoc()) {
mimeTypesToFilterOn.addAll(TEXT_FILES_MIME_TYPES);
}
return new CommonAttributeSearchResults(interCaseCommonFiles, this.frequencyPercentageThreshold, this.corAttrType, mimeTypesToFilterOn); return new CommonAttributeSearchResults(interCaseCommonFiles, this.frequencyPercentageThreshold, this.corAttrType, mimeTypesToFilterOn);
} }
@NbBundle.Messages({ @NbBundle.Messages({
"# {0} - case name", "# {0} - case name",
"# {1} - attr type", "# {1} - attr type",

207
Core/src/org/sleuthkit/autopsy/coreutils/FileTypeUtils.java Normal file
View File

@ -0,0 +1,207 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2018 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.coreutils;
import com.google.common.collect.ImmutableSet;
import static java.util.Arrays.asList;
import java.util.Collection;
import java.util.Collections;
import javax.imageio.ImageIO;
import static org.apache.commons.collections4.ListUtils.removeAll;
import org.openide.util.NbBundle;
/**
* Utilities for dealing with file/mime-types
*/
public final class FileTypeUtils {
private static final ImmutableSet<String> IMAGE_MIME_TYPES
= new ImmutableSet.Builder<String>()
.addAll(removeAll(asList(ImageIO.getReaderMIMETypes()),
asList("application/octet-stream"))) //this claims to be supported, but is not really an image.
.add("image/bmp", //NON-NLS
"image/gif", //NON-NLS
"image/jpeg", //NON-NLS
"image/png", //NON-NLS
"image/tiff", //NON-NLS
"image/vnd.adobe.photoshop", //NON-NLS
"image/x-raw-nikon", //NON-NLS
"image/x-ms-bmp", //NON-NLS
"image/x-icon", //NON-NLS
"image/webp", //NON-NLS
"image/vnd.microsoft.icon", //NON-NLS
"image/x-rgb", //NON-NLS
"image/x-ms-bmp", //NON-NLS
"image/x-xbitmap", //NON-NLS
"image/x-portable-graymap", //NON-NLS
"image/x-portable-bitmap" //NON-NLS
).build();
private static final ImmutableSet<String> AUDIO_MIME_TYPES
= new ImmutableSet.Builder<String>()
.add("audio/midi", //NON-NLS
"audio/mpeg", //NON-NLS
"audio/webm", //NON-NLS
"audio/ogg", //NON-NLS
"audio/wav", //NON-NLS
"audio/vnd.wave", //NON-NLS
"audio/x-ms-wma"//NON-NLS
).build();
private static final ImmutableSet<String> VIDEO_MIME_TYPES
= new ImmutableSet.Builder<String>()
.add("video/webm", //NON-NLS
"video/3gpp", //NON-NLS
"video/3gpp2", //NON-NLS
"video/ogg", //NON-NLS
"video/mpeg", //NON-NLS
"video/mp4", //NON-NLS
"video/quicktime", //NON-NLS
"video/x-msvideo", //NON-NLS
"video/x-flv", //NON-NLS
"video/x-m4v", //NON-NLS
"video/x-ms-wmv"//NON-NLS
).build();
private static final ImmutableSet<String> DOCUMENT_MIME_TYPES
= new ImmutableSet.Builder<String>()
.add("text/plain", //NON-NLS
"text/css", //NON-NLS
"text/html", //NON-NLS
"text/csv", //NON-NLS
"text/xml", //NON-NLS
"text/x-log", //NON-NLS
"application/rtf", //NON-NLS
"application/pdf", //NON-NLS
"application/json", //NON-NLS
"application/javascript", //NON-NLS
"application/xml", //NON-NLS
"application/x-msoffice", //NON-NLS
"application/x-ooxml", //NON-NLS
"application/msword", //NON-NLS
"application/msword2", //NON-NLS
"application/vnd.wordperfect", //NON-NLS
"application/vnd.openxmlformats-officedocument.wordprocessingml.document", //NON-NLS
"application/vnd.ms-powerpoint", //NON-NLS
"application/vnd.openxmlformats-officedocument.presentationml.presentation", //NON-NLS
"application/vnd.ms-excel", //NON-NLS
"application/vnd.ms-excel.sheet.4", //NON-NLS
"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", //NON-NLS
"application/vnd.oasis.opendocument.presentation", //NON-NLS
"application/vnd.oasis.opendocument.spreadsheet", //NON-NLS
"application/vnd.oasis.opendocument.text" //NON-NLS
).build();
private static final ImmutableSet<String> EXECUTABLE_MIME_TYPES
= new ImmutableSet.Builder<String>()
.add("application/x-bat",//NON-NLS
"application/x-dosexec",//NON-NLS
"application/vnd.microsoft.portable-executable",//NON-NLS
"application/x-msdownload",//NON-NLS
"application/exe",//NON-NLS
"application/x-exe",//NON-NLS
"application/dos-exe",//NON-NLS
"vms/exe",//NON-NLS
"application/x-winexe",//NON-NLS
"application/msdos-windows",//NON-NLS
"application/x-msdos-program"//NON-NLS
).build();
private static final ImmutableSet<String> MULTI_MEDIA_MIME_TYPES
= new ImmutableSet.Builder<String>()
.addAll(IMAGE_MIME_TYPES)
.addAll(AUDIO_MIME_TYPES)
.addAll(VIDEO_MIME_TYPES)
.build();
private static final ImmutableSet<String> VISUAL_MEDIA_MIME_TYPES
= new ImmutableSet.Builder<String>()
.addAll(IMAGE_MIME_TYPES)
.addAll(VIDEO_MIME_TYPES)
.add("application/vnd.ms-asf", //NON-NLS
"application/vnd.rn-realmedia", //NON-NLS
"application/x-shockwave-flash" //NON-NLS
).build();
private FileTypeUtils() {
}
/**
* Enum of categories/groups of file types.
*/
@NbBundle.Messages({
"FileTypeCategory.Audio.displayName=Audio",
"FileTypeCategory.Video.displayName=Video",
"FileTypeCategory.Image.displayName=Image",
"FileTypeCategory.Media.displayName=Media",
"FileTypeCategory.Visual.displayName=Visual",
"FileTypeCategory.Documents.displayName=Documents",
"FileTypeCategory.Executables.displayName=Executables"})
public enum FileTypeCategory {
IMAGE(Bundle.FileTypeCategory_Image_displayName(),
IMAGE_MIME_TYPES,
Collections.emptyList()),
VIDEO(Bundle.FileTypeCategory_Video_displayName(),
VIDEO_MIME_TYPES,
Collections.emptyList()),
AUDIO(Bundle.FileTypeCategory_Audio_displayName(),
AUDIO_MIME_TYPES,
Collections.emptyList()),
/**
* Images, Videos, flash Animations, etc
*/
VISUAL(Bundle.FileTypeCategory_Media_displayName(),
VISUAL_MEDIA_MIME_TYPES,
Collections.emptyList()),
/**
* VISUAL plus AUDIO.
*/
MEDIA(Bundle.FileTypeCategory_Media_displayName(),
MULTI_MEDIA_MIME_TYPES,
Collections.emptyList()),
EXECUTABLE(Bundle.FileTypeCategory_Executables_displayName(),
EXECUTABLE_MIME_TYPES,
Collections.emptyList()),
/**
* (Plain) Text and "Office" documents.
*/
DOCUMENTS(Bundle.FileTypeCategory_Documents_displayName(),
DOCUMENT_MIME_TYPES,
Collections.emptyList());
private final String displayName;
private final ImmutableSet<String> mediaTypes;
private final ImmutableSet<String> extensions;
private FileTypeCategory(String displayName, Collection<String> mediaTypes, Collection<String> extensions) {
this.displayName = displayName;
this.mediaTypes = ImmutableSet.copyOf(mediaTypes);
this.extensions = ImmutableSet.copyOf(extensions);
}
public String getDisplayName() {
return displayName;
}
public ImmutableSet<String> getMediaTypes() {
return mediaTypes;
}
public ImmutableSet<String> getExtensions() {
throw new UnsupportedOperationException("This method is not implemented yet."); //just to be explicit.
}
}
}

62
Core/src/org/sleuthkit/autopsy/timeline/utils/FilterUtils.java
View File

@ -18,7 +18,6 @@
*/ */
package org.sleuthkit.autopsy.timeline.utils; package org.sleuthkit.autopsy.timeline.utils;
import com.google.common.collect.ImmutableSet;
import java.util.Collection; import java.util.Collection;
import java.util.HashSet; import java.util.HashSet;
import java.util.Set; import java.util.Set;
@ -26,61 +25,21 @@ import org.openide.util.NbBundle;
import org.sleuthkit.datamodel.TimelineManager; import org.sleuthkit.datamodel.TimelineManager;
import org.sleuthkit.datamodel.timeline.TimelineFilter.FileTypeFilter; import org.sleuthkit.datamodel.timeline.TimelineFilter.FileTypeFilter;
import org.sleuthkit.datamodel.timeline.TimelineFilter.FileTypesFilter; import org.sleuthkit.datamodel.timeline.TimelineFilter.FileTypesFilter;
import static org.sleuthkit.autopsy.coreutils.FileTypeUtils.FileTypeCategory.MEDIA;
import static org.sleuthkit.autopsy.coreutils.FileTypeUtils.FileTypeCategory.EXECUTABLE;
import static org.sleuthkit.autopsy.coreutils.FileTypeUtils.FileTypeCategory.DOCUMENTS;
/** /**
* Utilities to deal with TimelineFilters * Utilities to deal with TimelineFilters
*/ */
public final class FilterUtils { public final class FilterUtils {
private static final Set<String> MEDIA_MIME_TYPES = ImmutableSet.of(
"image/*",//NON-NLS
"video/*",//NON-NLS
"audio/*",//NON-NLS
"application/vnd.ms-asf", //NON-NLS
"application/vnd.rn-realmedia", //NON-NLS
"application/x-shockwave-flash" //NON-NLS
);
private static final Set<String> EXECUTABLE_MIME_TYPES = ImmutableSet.of(
"application/x-bat",//NON-NLS
"application/x-dosexec",//NON-NLS
"application/vnd.microsoft.portable-executable",//NON-NLS
"application/x-msdownload",//NON-NLS
"application/exe",//NON-NLS
"application/x-exe",//NON-NLS
"application/dos-exe",//NON-NLS
"vms/exe",//NON-NLS
"application/x-winexe",//NON-NLS
"application/msdos-windows",//NON-NLS
"application/x-msdos-program"//NON-NLS
);
private static final Set<String> DOCUMENT_MIME_TYPES =ImmutableSet.of(
"text/*", //NON-NLS
"application/rtf", //NON-NLS
"application/pdf", //NON-NLS
"application/json", //NON-NLS
"application/javascript", //NON-NLS
"application/xml", //NON-NLS
"application/x-msoffice", //NON-NLS
"application/x-ooxml", //NON-NLS
"application/msword", //NON-NLS
"application/vnd.openxmlformats-officedocument.wordprocessingml.document", //NON-NLS
"application/vnd.ms-powerpoint", //NON-NLS
"application/vnd.openxmlformats-officedocument.presentationml.presentation", //NON-NLS
"application/vnd.ms-excel", //NON-NLS
"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", //NON-NLS
"application/vnd.oasis.opendocument.presentation", //NON-NLS
"application/vnd.oasis.opendocument.spreadsheet", //NON-NLS
"application/vnd.oasis.opendocument.text" //NON-NLS
);
private static final Set<String> NON_OTHER_MIME_TYPES = new HashSet<>(); private static final Set<String> NON_OTHER_MIME_TYPES = new HashSet<>();
static { static {
NON_OTHER_MIME_TYPES.addAll(MEDIA_MIME_TYPES); NON_OTHER_MIME_TYPES.addAll(DOCUMENTS.getMediaTypes());
NON_OTHER_MIME_TYPES.addAll(DOCUMENT_MIME_TYPES); NON_OTHER_MIME_TYPES.addAll(EXECUTABLE.getMediaTypes());
NON_OTHER_MIME_TYPES.addAll(EXECUTABLE_MIME_TYPES); NON_OTHER_MIME_TYPES.addAll(MEDIA.getMediaTypes());
} }
private FilterUtils() { private FilterUtils() {
@ -93,16 +52,13 @@ public final class FilterUtils {
* @return The new FileTypesFilter. * @return The new FileTypesFilter.
*/ */
@NbBundle.Messages({ @NbBundle.Messages({
"FilterUtils.mediaFilter.displayName=Media",
"FilterUtils.documentsFilter.displayName=Documents",
"FilterUtils.executablesFilter.displayName=Executables",
"FilterUtils.otherFilter.displayName=Other"}) "FilterUtils.otherFilter.displayName=Other"})
public static FileTypesFilter createDefaultFileTypesFilter() { public static FileTypesFilter createDefaultFileTypesFilter() {
FileTypesFilter fileTypesFilter = new FileTypesFilter(); FileTypesFilter fileTypesFilter = new FileTypesFilter();
fileTypesFilter.addSubFilter(new FileTypeFilter(Bundle.FilterUtils_mediaFilter_displayName(), MEDIA_MIME_TYPES)); fileTypesFilter.addSubFilter(new FileTypeFilter(MEDIA.getDisplayName(), MEDIA.getMediaTypes()));
fileTypesFilter.addSubFilter(new FileTypeFilter(Bundle.FilterUtils_documentsFilter_displayName(), DOCUMENT_MIME_TYPES)); fileTypesFilter.addSubFilter(new FileTypeFilter(DOCUMENTS.getDisplayName(), DOCUMENTS.getMediaTypes()));
fileTypesFilter.addSubFilter(new FileTypeFilter(Bundle.FilterUtils_executablesFilter_displayName(), EXECUTABLE_MIME_TYPES)); fileTypesFilter.addSubFilter(new FileTypeFilter(EXECUTABLE.getDisplayName(), EXECUTABLE.getMediaTypes()));
fileTypesFilter.addSubFilter(new InverseFileTypeFilter(Bundle.FilterUtils_otherFilter_displayName(), NON_OTHER_MIME_TYPES)); fileTypesFilter.addSubFilter(new InverseFileTypeFilter(Bundle.FilterUtils_otherFilter_displayName(), NON_OTHER_MIME_TYPES));
return fileTypesFilter; return fileTypesFilter;