This commit is contained in:
Ann Priestman 2017-11-22 08:21:48 -05:00
parent 7a4fd008c3
commit 6f2fae67af
3 changed files with 56 additions and 48 deletions

View File

@ -162,7 +162,6 @@ class EncaseHashSetParser implements HashSetParser {
throw new TskCoreException("readBuffer called on null inputStream"); throw new TskCoreException("readBuffer called on null inputStream");
} }
if (length != inputStream.read(buffer)) { if (length != inputStream.read(buffer)) {
close();
throw new TskCoreException("Ran out of data unexpectedly while parsing Encase file " + filename); throw new TskCoreException("Ran out of data unexpectedly while parsing Encase file " + filename);
} }
} }

View File

@ -219,14 +219,10 @@ class ImportCentralRepoDbProgressDialog extends javax.swing.JDialog implements P
hashSetParser = new EncaseHashSetParser(importFileName); hashSetParser = new EncaseHashSetParser(importFileName);
} else if(importFileName.toLowerCase().endsWith(".kdb")){ } else if(importFileName.toLowerCase().endsWith(".kdb")){
hashSetParser = new KdbHashSetParser(importFileName); hashSetParser = new KdbHashSetParser(importFileName);
} else {
if (importFileName.toLowerCase().endsWith(".hash")) {
hashSetParser = new EncaseHashSetParser(importFileName);
} else { } else {
// We've gotten here with a format that can't be processed // We've gotten here with a format that can't be processed
throw new TskCoreException("Hash set to import is an unknown format : " + importFileName); throw new TskCoreException("Hash set to import is an unknown format : " + importFileName);
} }
}
try { try {
// Conver to the FileKnown enum used by EamGlobalSet // Conver to the FileKnown enum used by EamGlobalSet

View File

@ -1,13 +1,25 @@
/* /*
* To change this license header, choose License Headers in Project Properties. * Autopsy Forensic Browser
* To change this template file, choose Tools | Templates *
* and open the template in the editor. * Copyright 2011 - 2017 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/ */
package org.sleuthkit.autopsy.modules.hashdatabase; package org.sleuthkit.autopsy.modules.hashdatabase;
import java.sql.Connection; import java.sql.Connection;
import java.sql.DriverManager; import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.ResultSet; import java.sql.ResultSet;
import java.sql.SQLException; import java.sql.SQLException;
import java.sql.Statement; import java.sql.Statement;
@ -16,9 +28,10 @@ import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.datamodel.TskCoreException; import org.sleuthkit.datamodel.TskCoreException;
/** /**
* * Parser for Autopsy/TSK-created databases (*.kdb)
*/ */
public class KdbHashSetParser implements HashSetParser { public class KdbHashSetParser implements HashSetParser {
private final String JDBC_DRIVER = "org.sqlite.JDBC"; // NON-NLS private final String JDBC_DRIVER = "org.sqlite.JDBC"; // NON-NLS
private final String JDBC_BASE_URI = "jdbc:sqlite:"; // NON-NLS private final String JDBC_BASE_URI = "jdbc:sqlite:"; // NON-NLS
@ -29,15 +42,14 @@ public class KdbHashSetParser implements HashSetParser {
private Statement statement; private Statement statement;
private ResultSet resultSet; private ResultSet resultSet;
KdbHashSetParser(String filename) throws TskCoreException {
KdbHashSetParser(String filename) throws TskCoreException{
this.filename = filename; this.filename = filename;
conn = null; conn = null;
statement = null; statement = null;
resultSet = null; resultSet = null;
try{ try {
// Open the database // Open the database
StringBuilder connectionURL = new StringBuilder(); StringBuilder connectionURL = new StringBuilder();
connectionURL.append(JDBC_BASE_URI); connectionURL.append(JDBC_BASE_URI);
@ -59,8 +71,7 @@ public class KdbHashSetParser implements HashSetParser {
resultSet = statement.executeQuery("SELECT md5 FROM hashes"); resultSet = statement.executeQuery("SELECT md5 FROM hashes");
// At this point, getNextHash can read each hash from the result set // At this point, getNextHash can read each hash from the result set
} catch (ClassNotFoundException | SQLException ex) {
} catch (ClassNotFoundException | SQLException ex){
throw new TskCoreException("Error opening/reading database " + filename, ex); throw new TskCoreException("Error opening/reading database " + filename, ex);
} }
@ -68,21 +79,22 @@ public class KdbHashSetParser implements HashSetParser {
/** /**
* Get the next hash to import * Get the next hash to import
* @return The hash as a string, or null if the end of file was reached without error *
* @return The hash as a string
* @throws TskCoreException * @throws TskCoreException
*/ */
@Override @Override
public String getNextHash() throws TskCoreException { public String getNextHash() throws TskCoreException {
try{ try {
if(resultSet.next()){ if (resultSet.next()) {
byte[] hashBytes = resultSet.getBytes("md5"); byte[] hashBytes = resultSet.getBytes("md5");
StringBuilder sb = new StringBuilder(); StringBuilder sb = new StringBuilder();
for (byte b : hashBytes) { for (byte b : hashBytes) {
sb.append(String.format("%02x", b)); sb.append(String.format("%02x", b));
} }
if(sb.toString().length() != 32){ if (sb.toString().length() != 32) {
throw new TskCoreException("Hash has incorrect length: " + sb.toString()); throw new TskCoreException("Hash has incorrect length: " + sb.toString());
} }
@ -91,23 +103,24 @@ public class KdbHashSetParser implements HashSetParser {
} else { } else {
throw new TskCoreException("Could not read expected number of hashes from database " + filename); throw new TskCoreException("Could not read expected number of hashes from database " + filename);
} }
} catch (SQLException ex){ } catch (SQLException ex) {
throw new TskCoreException("Error reading hash from result set for database " + filename, ex); throw new TskCoreException("Error reading hash from result set for database " + filename, ex);
} }
} }
/** /**
* Check if there are more hashes to read * Check if there are more hashes to read
*
* @return true if we've read all expected hash values, false otherwise * @return true if we've read all expected hash values, false otherwise
*/ */
@Override @Override
public boolean doneReading() { public boolean doneReading() {
return(totalHashesRead >= totalHashes); return (totalHashesRead >= totalHashes);
} }
/** /**
* Get the expected number of hashes in the file. * Get the expected number of hashes in the file.
* This number can be an estimate. *
* @return The expected hash count * @return The expected hash count
*/ */
@Override @Override
@ -120,7 +133,7 @@ public class KdbHashSetParser implements HashSetParser {
*/ */
@Override @Override
public final void close() { public final void close() {
if(statement != null){ if (statement != null) {
try { try {
statement.close(); statement.close();
} catch (SQLException ex) { } catch (SQLException ex) {
@ -128,7 +141,7 @@ public class KdbHashSetParser implements HashSetParser {
} }
} }
if(resultSet != null){ if (resultSet != null) {
try { try {
resultSet.close(); resultSet.close();
} catch (SQLException ex) { } catch (SQLException ex) {
@ -136,7 +149,7 @@ public class KdbHashSetParser implements HashSetParser {
} }
} }
if(conn != null){ if (conn != null) {
try { try {
conn.close(); conn.close();
} catch (SQLException ex) { } catch (SQLException ex) {