This commit is contained in:
Ann Priestman 2017-11-22 08:21:48 -05:00
parent 7a4fd008c3
commit 6f2fae67af
3 changed files with 56 additions and 48 deletions

View File

@ -162,7 +162,6 @@ class EncaseHashSetParser implements HashSetParser {
throw new TskCoreException("readBuffer called on null inputStream"); throw new TskCoreException("readBuffer called on null inputStream");
} }
if (length != inputStream.read(buffer)) { if (length != inputStream.read(buffer)) {
close();
throw new TskCoreException("Ran out of data unexpectedly while parsing Encase file " + filename); throw new TskCoreException("Ran out of data unexpectedly while parsing Encase file " + filename);
} }
} }

View File

@ -220,12 +220,8 @@ class ImportCentralRepoDbProgressDialog extends javax.swing.JDialog implements P
} else if(importFileName.toLowerCase().endsWith(".kdb")){ } else if(importFileName.toLowerCase().endsWith(".kdb")){
hashSetParser = new KdbHashSetParser(importFileName); hashSetParser = new KdbHashSetParser(importFileName);
} else { } else {
if (importFileName.toLowerCase().endsWith(".hash")) { // We've gotten here with a format that can't be processed
hashSetParser = new EncaseHashSetParser(importFileName); throw new TskCoreException("Hash set to import is an unknown format : " + importFileName);
} else {
// We've gotten here with a format that can't be processed
throw new TskCoreException("Hash set to import is an unknown format : " + importFileName);
}
} }
try { try {

View File

@ -1,13 +1,25 @@
/* /*
* To change this license header, choose License Headers in Project Properties. * Autopsy Forensic Browser
* To change this template file, choose Tools | Templates *
* and open the template in the editor. * Copyright 2011 - 2017 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/ */
package org.sleuthkit.autopsy.modules.hashdatabase; package org.sleuthkit.autopsy.modules.hashdatabase;
import java.sql.Connection; import java.sql.Connection;
import java.sql.DriverManager; import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.ResultSet; import java.sql.ResultSet;
import java.sql.SQLException; import java.sql.SQLException;
import java.sql.Statement; import java.sql.Statement;
@ -16,35 +28,35 @@ import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.datamodel.TskCoreException; import org.sleuthkit.datamodel.TskCoreException;
/** /**
* * Parser for Autopsy/TSK-created databases (*.kdb)
*/ */
public class KdbHashSetParser implements HashSetParser { public class KdbHashSetParser implements HashSetParser {
private final String JDBC_DRIVER = "org.sqlite.JDBC"; // NON-NLS private final String JDBC_DRIVER = "org.sqlite.JDBC"; // NON-NLS
private final String JDBC_BASE_URI = "jdbc:sqlite:"; // NON-NLS private final String JDBC_BASE_URI = "jdbc:sqlite:"; // NON-NLS
private final String filename; // Name of the input file (saved for logging) private final String filename; // Name of the input file (saved for logging)
private final long totalHashes; // Estimated number of hashes private final long totalHashes; // Estimated number of hashes
private int totalHashesRead = 0; // Number of hashes that have been read private int totalHashesRead = 0; // Number of hashes that have been read
private Connection conn; private Connection conn;
private Statement statement; private Statement statement;
private ResultSet resultSet; private ResultSet resultSet;
KdbHashSetParser(String filename) throws TskCoreException {
KdbHashSetParser(String filename) throws TskCoreException{
this.filename = filename; this.filename = filename;
conn = null; conn = null;
statement = null; statement = null;
resultSet = null; resultSet = null;
try{ try {
// Open the database // Open the database
StringBuilder connectionURL = new StringBuilder(); StringBuilder connectionURL = new StringBuilder();
connectionURL.append(JDBC_BASE_URI); connectionURL.append(JDBC_BASE_URI);
connectionURL.append(filename); connectionURL.append(filename);
Class.forName(JDBC_DRIVER); Class.forName(JDBC_DRIVER);
conn = DriverManager.getConnection(connectionURL.toString()); conn = DriverManager.getConnection(connectionURL.toString());
// Get the number of hashes in the table // Get the number of hashes in the table
statement = conn.createStatement(); statement = conn.createStatement();
resultSet = statement.executeQuery("SELECT count(*) AS count FROM hashes"); resultSet = statement.executeQuery("SELECT count(*) AS count FROM hashes");
@ -54,94 +66,95 @@ public class KdbHashSetParser implements HashSetParser {
close(); close();
throw new TskCoreException("Error getting hash count from database " + filename); throw new TskCoreException("Error getting hash count from database " + filename);
} }
// Get the hashes // Get the hashes
resultSet = statement.executeQuery("SELECT md5 FROM hashes"); resultSet = statement.executeQuery("SELECT md5 FROM hashes");
// At this point, getNextHash can read each hash from the result set // At this point, getNextHash can read each hash from the result set
} catch (ClassNotFoundException | SQLException ex) {
} catch (ClassNotFoundException | SQLException ex){
throw new TskCoreException("Error opening/reading database " + filename, ex); throw new TskCoreException("Error opening/reading database " + filename, ex);
} }
} }
/** /**
* Get the next hash to import * Get the next hash to import
* @return The hash as a string, or null if the end of file was reached without error *
* @throws TskCoreException * @return The hash as a string
* @throws TskCoreException
*/ */
@Override @Override
public String getNextHash() throws TskCoreException { public String getNextHash() throws TskCoreException {
try{ try {
if(resultSet.next()){ if (resultSet.next()) {
byte[] hashBytes = resultSet.getBytes("md5"); byte[] hashBytes = resultSet.getBytes("md5");
StringBuilder sb = new StringBuilder(); StringBuilder sb = new StringBuilder();
for (byte b : hashBytes) { for (byte b : hashBytes) {
sb.append(String.format("%02x", b)); sb.append(String.format("%02x", b));
} }
if(sb.toString().length() != 32){ if (sb.toString().length() != 32) {
throw new TskCoreException("Hash has incorrect length: " + sb.toString()); throw new TskCoreException("Hash has incorrect length: " + sb.toString());
} }
totalHashesRead++; totalHashesRead++;
return sb.toString(); return sb.toString();
} else { } else {
throw new TskCoreException("Could not read expected number of hashes from database " + filename); throw new TskCoreException("Could not read expected number of hashes from database " + filename);
} }
} catch (SQLException ex){ } catch (SQLException ex) {
throw new TskCoreException("Error reading hash from result set for database " + filename, ex); throw new TskCoreException("Error reading hash from result set for database " + filename, ex);
} }
} }
/** /**
* Check if there are more hashes to read * Check if there are more hashes to read
*
* @return true if we've read all expected hash values, false otherwise * @return true if we've read all expected hash values, false otherwise
*/ */
@Override @Override
public boolean doneReading() { public boolean doneReading() {
return(totalHashesRead >= totalHashes); return (totalHashesRead >= totalHashes);
} }
/** /**
* Get the expected number of hashes in the file. * Get the expected number of hashes in the file.
* This number can be an estimate. *
* @return The expected hash count * @return The expected hash count
*/ */
@Override @Override
public long getExpectedHashCount() { public long getExpectedHashCount() {
return totalHashes; return totalHashes;
} }
/** /**
* Closes the import file * Closes the import file
*/ */
@Override @Override
public final void close() { public final void close() {
if(statement != null){ if (statement != null) {
try { try {
statement.close(); statement.close();
} catch (SQLException ex) { } catch (SQLException ex) {
Logger.getLogger(KdbHashSetParser.class.getName()).log(Level.SEVERE, "Error closing prepared statement.", ex); Logger.getLogger(KdbHashSetParser.class.getName()).log(Level.SEVERE, "Error closing prepared statement.", ex);
} }
} }
if(resultSet != null){ if (resultSet != null) {
try { try {
resultSet.close(); resultSet.close();
} catch (SQLException ex) { } catch (SQLException ex) {
Logger.getLogger(KdbHashSetParser.class.getName()).log(Level.SEVERE, "Error closing result set.", ex); Logger.getLogger(KdbHashSetParser.class.getName()).log(Level.SEVERE, "Error closing result set.", ex);
} }
} }
if(conn != null){ if (conn != null) {
try { try {
conn.close(); conn.close();
} catch (SQLException ex) { } catch (SQLException ex) {
Logger.getLogger(KdbHashSetParser.class.getName()).log(Level.SEVERE, "Error closing connection.", ex); Logger.getLogger(KdbHashSetParser.class.getName()).log(Level.SEVERE, "Error closing connection.", ex);
} }
} }
} }
} }