mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-17 18:17:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

flesh out FileTypeCategory. Inline usage of FileTypeCategories. refactor InterCaseCommonAttributeSearcher.determineMimeTypeFilter() for readability.

Browse Source
This commit is contained in:
millmanorama 2018-11-09 12:43:44 +01:00
parent 69eb3e6d7f
commit 72e3f14ae4
6 changed files with 114 additions and 227 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

80
Core/src/org/sleuthkit/autopsy/commonfilesearch/AbstractCommonAttributeSearcher.java
View File

@ -21,16 +21,15 @@ package org.sleuthkit.autopsy.commonfilesearch;
import java.sql.SQLException; import java.sql.SQLException;
import java.util.ArrayList; import java.util.ArrayList;
import java.util.Collections; import java.util.HashSet;
import java.util.List; import java.util.List;
import java.util.Map; import java.util.Map;
import java.util.Set; import java.util.Set;
import java.util.TreeMap; import java.util.TreeMap;
import java.util.stream.Collectors;
import java.util.stream.Stream;
import org.openide.util.NbBundle; import org.openide.util.NbBundle;
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException;
import org.sleuthkit.autopsy.coreutils.FileTypeUtils;
import org.sleuthkit.datamodel.TskCoreException; import org.sleuthkit.datamodel.TskCoreException;
/** /**
@ -131,69 +130,6 @@ public abstract class AbstractCommonAttributeSearcher {
return instanceCollatedCommonFiles; return instanceCollatedCommonFiles;
} }
/*
* The set of the MIME types that will be checked for extension mismatches
* when checkType is ONLY_MEDIA. ".jpg", ".jpeg", ".png", ".psd", ".nef",
* ".tiff", ".bmp", ".tec" ".aaf", ".3gp", ".asf", ".avi", ".m1v", ".m2v",
* //NON-NLS ".m4v", ".mp4", ".mov", ".mpeg", ".mpg", ".mpe", ".mp4", ".rm",
* ".wmv", ".mpv", ".flv", ".swf"
*/
static final Set<String> MEDIA_PICS_VIDEO_MIME_TYPES = Stream.of(
"image/bmp", //NON-NLS
"image/gif", //NON-NLS
"image/jpeg", //NON-NLS
"image/png", //NON-NLS
"image/tiff", //NON-NLS
"image/vnd.adobe.photoshop", //NON-NLS
"image/x-raw-nikon", //NON-NLS
"image/x-ms-bmp", //NON-NLS
"image/x-icon", //NON-NLS
"video/webm", //NON-NLS
"video/3gpp", //NON-NLS
"video/3gpp2", //NON-NLS
"video/ogg", //NON-NLS
"video/mpeg", //NON-NLS
"video/mp4", //NON-NLS
"video/quicktime", //NON-NLS
"video/x-msvideo", //NON-NLS
"video/x-flv", //NON-NLS
"video/x-m4v", //NON-NLS
"video/x-ms-wmv", //NON-NLS
"application/vnd.ms-asf", //NON-NLS
"application/vnd.rn-realmedia", //NON-NLS
"application/x-shockwave-flash" //NON-NLS
).collect(Collectors.toSet());
/*
* The set of the MIME types that will be checked for extension mismatches
* when checkType is ONLY_TEXT_FILES. ".doc", ".docx", ".odt", ".xls",
* ".xlsx", ".ppt", ".pptx" ".txt", ".rtf", ".log", ".text", ".xml" ".html",
* ".htm", ".css", ".js", ".php", ".aspx" ".pdf"
*/
static final Set<String> TEXT_FILES_MIME_TYPES = Stream.of(
"text/plain", //NON-NLS
"text/css", //NON-NLS
"text/html", //NON-NLS
"text/csv", //NON-NLS
"application/rtf", //NON-NLS
"application/pdf", //NON-NLS
"text/calendar", //NON-NLS
"application/json", //NON-NLS
"application/javascript", //NON-NLS
"application/xml", //NON-NLS
"application/x-msoffice", //NON-NLS
"application/x-ooxml", //NON-NLS
"application/msword", //NON-NLS
"application/vnd.openxmlformats-officedocument.wordprocessingml.document", //NON-NLS
"application/vnd.ms-powerpoint", //NON-NLS
"application/vnd.openxmlformats-officedocument.presentationml.presentation", //NON-NLS
"application/vnd.ms-excel", //NON-NLS
"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", //NON-NLS
"application/vnd.oasis.opendocument.presentation", //NON-NLS
"application/vnd.oasis.opendocument.spreadsheet", //NON-NLS
"application/vnd.oasis.opendocument.text" //NON-NLS
).collect(Collectors.toSet());
/** /**
* @return the filterByMedia * @return the filterByMedia
*/ */
@ -221,4 +157,16 @@ public abstract class AbstractCommonAttributeSearcher {
void setFilterByDoc(boolean filterByDoc) { void setFilterByDoc(boolean filterByDoc) {
this.filterByDoc = filterByDoc; this.filterByDoc = filterByDoc;
} }
Set<String> getMimeTypesToFilterOn() {
Set<String> mimeTypesToFilterOn = new HashSet<>();
if (isFilterByMedia()) {
mimeTypesToFilterOn.addAll(FileTypeUtils.FileTypeCategory.VISUAL.getMediaTypes());
}
if (isFilterByDoc()) {
mimeTypesToFilterOn.addAll(FileTypeUtils.FileTypeCategory.DOCUMENTS.getMediaTypes());
}
return mimeTypesToFilterOn;
}
} }

15
Core/src/org/sleuthkit/autopsy/commonfilesearch/AllInterCaseCommonAttributeSearcher.java
View File

@ -26,10 +26,10 @@ import java.util.Set;
import org.openide.util.NbBundle; import org.openide.util.NbBundle;
import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException;
import org.sleuthkit.datamodel.TskCoreException;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance.Type; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance.Type;
import static org.sleuthkit.autopsy.commonfilesearch.AbstractCommonAttributeSearcher.MEDIA_PICS_VIDEO_MIME_TYPES; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException;
import org.sleuthkit.autopsy.coreutils.FileTypeUtils.FileTypeCategory;
import org.sleuthkit.datamodel.TskCoreException;
/** /**
* Algorithm which finds files anywhere in the Central Repo which also occur in * Algorithm which finds files anywhere in the Central Repo which also occur in
@ -57,14 +57,7 @@ public class AllInterCaseCommonAttributeSearcher extends InterCaseCommonAttribut
public CommonAttributeSearchResults findMatches() throws TskCoreException, NoCurrentCaseException, SQLException, EamDbException { public CommonAttributeSearchResults findMatches() throws TskCoreException, NoCurrentCaseException, SQLException, EamDbException {
InterCaseSearchResultsProcessor eamDbAttrInst = new InterCaseSearchResultsProcessor(corAttrType); InterCaseSearchResultsProcessor eamDbAttrInst = new InterCaseSearchResultsProcessor(corAttrType);
Map<Integer, CommonAttributeValueList> interCaseCommonFiles = eamDbAttrInst.findInterCaseCommonAttributeValues(Case.getCurrentCase()); Map<Integer, CommonAttributeValueList> interCaseCommonFiles = eamDbAttrInst.findInterCaseCommonAttributeValues(Case.getCurrentCase());
Set<String> mimeTypesToFilterOn = getMimeTypesToFilterOn();
Set<String> mimeTypesToFilterOn = new HashSet<>();
if (isFilterByMedia()) {
mimeTypesToFilterOn.addAll(MEDIA_PICS_VIDEO_MIME_TYPES);
}
if (isFilterByDoc()) {
mimeTypesToFilterOn.addAll(TEXT_FILES_MIME_TYPES);
}
return new CommonAttributeSearchResults(interCaseCommonFiles, this.frequencyPercentageThreshold, this.corAttrType, mimeTypesToFilterOn); return new CommonAttributeSearchResults(interCaseCommonFiles, this.frequencyPercentageThreshold, this.corAttrType, mimeTypesToFilterOn);
} }

63
Core/src/org/sleuthkit/autopsy/commonfilesearch/IntraCaseCommonAttributeSearcher.java
View File

@ -1,16 +1,16 @@
/* /*
* *
* Autopsy Forensic Browser * Autopsy Forensic Browser
* *
* Copyright 2018 Basis Technology Corp. * Copyright 2018 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org * Contact: carrier <at> sleuthkit <dot> org
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
* You may obtain a copy of the License at * You may obtain a copy of the License at
* *
* http://www.apache.org/licenses/LICENSE-2.0 * http://www.apache.org/licenses/LICENSE-2.0
* *
* Unless required by applicable law or agreed to in writing, software * Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, * distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@ -23,10 +23,10 @@ import java.sql.ResultSet;
import java.sql.SQLException; import java.sql.SQLException;
import java.util.Collections; import java.util.Collections;
import java.util.HashMap; import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
import java.util.Map; import java.util.Map;
import java.util.Set; import java.util.Set;
import java.util.stream.Collectors;
import org.apache.commons.lang3.StringUtils;
import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
import org.sleuthkit.datamodel.HashUtility; import org.sleuthkit.datamodel.HashUtility;
@ -45,25 +45,22 @@ import org.sleuthkit.datamodel.TskCoreException;
@SuppressWarnings("PMD.AbstractNaming") @SuppressWarnings("PMD.AbstractNaming")
public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAttributeSearcher { public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAttributeSearcher {
private static final String FILTER_BY_MIME_TYPES_WHERE_CLAUSE = " and mime_type in (%s)"; //NON-NLS // where %s is csv list of mime_types to filter on
private final Map<Long, String> dataSourceIdToNameMap; private final Map<Long, String> dataSourceIdToNameMap;
/** /**
* Subclass this to implement different algorithms for getting common files. * Subclass this to implement different algorithms for getting common files.
* *
* @param dataSourceIdMap a map of obj_id to datasource name * @param dataSourceIdMap a map of obj_id to datasource name
* @param filterByMediaMimeType match only on files whose mime types can be * @param filterByMediaMimeType match only on files whose mime types can be
* broadly categorized as media types * broadly categorized as media types
* @param filterByDocMimeType match only on files whose mime types can be * @param filterByDocMimeType match only on files whose mime types can be
* broadly categorized as document types * broadly categorized as document types
*/ */
IntraCaseCommonAttributeSearcher(Map<Long, String> dataSourceIdMap, boolean filterByMediaMimeType, boolean filterByDocMimeType, int percentageThreshold) { IntraCaseCommonAttributeSearcher(Map<Long, String> dataSourceIdMap, boolean filterByMediaMimeType, boolean filterByDocMimeType, int percentageThreshold) {
super(filterByMediaMimeType, filterByDocMimeType, percentageThreshold); super(filterByMediaMimeType, filterByDocMimeType, percentageThreshold);
this.dataSourceIdToNameMap = dataSourceIdMap; this.dataSourceIdToNameMap = dataSourceIdMap;
} }
Map<Long, String> getDataSourceIdToNameMap() { Map<Long, String> getDataSourceIdToNameMap() {
return Collections.unmodifiableMap(this.dataSourceIdToNameMap); return Collections.unmodifiableMap(this.dataSourceIdToNameMap);
} }
@ -96,7 +93,8 @@ public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAtt
* tree table tab to the top component. * tree table tab to the top component.
* *
* @return a data object with all of the matched files in a hierarchical * @return a data object with all of the matched files in a hierarchical
* format * format
*
* @throws TskCoreException * @throws TskCoreException
* @throws NoCurrentCaseException * @throws NoCurrentCaseException
* @throws SQLException * @throws SQLException
@ -149,29 +147,18 @@ public abstract class IntraCaseCommonAttributeSearcher extends AbstractCommonAtt
* expression will be conjoined to base query with an AND operator. * expression will be conjoined to base query with an AND operator.
* *
* @return sql fragment of the form: 'and "mime_type" in ( [comma delimited * @return sql fragment of the form: 'and "mime_type" in ( [comma delimited
* list of mime types] )' or empty string in the event that no types to * list of mime types] )' or empty string in the event that no types
* filter on were given. * to filter on were given.
*/ */
String determineMimeTypeFilter() { String determineMimeTypeFilter() {
Set<String> mimeTypesToFilterOn = getMimeTypesToFilterOn();
Set<String> mimeTypesToFilterOn = new HashSet<>(); if (mimeTypesToFilterOn.isEmpty()) {
String mimeTypeString = ""; return "";
if (isFilterByMedia()) { } else {
mimeTypesToFilterOn.addAll(MEDIA_PICS_VIDEO_MIME_TYPES); String mimeTypeString = mimeTypesToFilterOn.stream()
.map(s -> "'" + s + "'")
.collect(Collectors.joining(","));
return String.format(" and mime_type in (%s)", new Object[]{mimeTypeString});
} }
if (isFilterByDoc()) {
mimeTypesToFilterOn.addAll(TEXT_FILES_MIME_TYPES);
}
StringBuilder mimeTypeFilter = new StringBuilder(mimeTypesToFilterOn.size());
if (!mimeTypesToFilterOn.isEmpty()) {
for (String mimeType : mimeTypesToFilterOn) {
mimeTypeFilter.append(SINGLE_QUOTE).append(mimeType).append(SINGLE_QUTOE_COMMA);
}
mimeTypeString = mimeTypeFilter.toString().substring(0, mimeTypeFilter.length() - 1);
mimeTypeString = String.format(FILTER_BY_MIME_TYPES_WHERE_CLAUSE, new Object[]{mimeTypeString});
}
return mimeTypeString;
} }
static final String SINGLE_QUTOE_COMMA = "',";
static final String SINGLE_QUOTE = "'";
} }

15
Core/src/org/sleuthkit/autopsy/commonfilesearch/SingleInterCaseCommonAttributeSearcher.java
View File

@ -20,17 +20,15 @@
package org.sleuthkit.autopsy.commonfilesearch; package org.sleuthkit.autopsy.commonfilesearch;
import java.sql.SQLException; import java.sql.SQLException;
import java.util.HashSet;
import java.util.Map; import java.util.Map;
import java.util.Set; import java.util.Set;
import org.openide.util.NbBundle; import org.openide.util.NbBundle;
import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException; import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance.Type;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationCase; import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationCase;
import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException; import org.sleuthkit.autopsy.centralrepository.datamodel.EamDbException;
import org.sleuthkit.datamodel.TskCoreException; import org.sleuthkit.datamodel.TskCoreException;
import org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance.Type;
import static org.sleuthkit.autopsy.commonfilesearch.AbstractCommonAttributeSearcher.MEDIA_PICS_VIDEO_MIME_TYPES;
/** /**
* *
@ -52,7 +50,7 @@ public class SingleInterCaseCommonAttributeSearcher extends InterCaseCommonAttri
* @throws EamDbException * @throws EamDbException
*/ */
public SingleInterCaseCommonAttributeSearcher(int correlationCaseId, boolean filterByMediaMimeType, public SingleInterCaseCommonAttributeSearcher(int correlationCaseId, boolean filterByMediaMimeType,
boolean filterByDocMimeType, Type corAttrType, int percentageThreshold) throws EamDbException { boolean filterByDocMimeType, Type corAttrType, int percentageThreshold) throws EamDbException {
super(filterByMediaMimeType, filterByDocMimeType, corAttrType, percentageThreshold); super(filterByMediaMimeType, filterByDocMimeType, corAttrType, percentageThreshold);
this.corrleationCaseId = correlationCaseId; this.corrleationCaseId = correlationCaseId;
@ -81,16 +79,11 @@ public class SingleInterCaseCommonAttributeSearcher extends InterCaseCommonAttri
CommonAttributeSearchResults findFiles(CorrelationCase correlationCase) throws TskCoreException, NoCurrentCaseException, SQLException, EamDbException { CommonAttributeSearchResults findFiles(CorrelationCase correlationCase) throws TskCoreException, NoCurrentCaseException, SQLException, EamDbException {
InterCaseSearchResultsProcessor eamDbAttrInst = new InterCaseSearchResultsProcessor(this.corAttrType); InterCaseSearchResultsProcessor eamDbAttrInst = new InterCaseSearchResultsProcessor(this.corAttrType);
Map<Integer, CommonAttributeValueList> interCaseCommonFiles = eamDbAttrInst.findSingleInterCaseCommonAttributeValues(Case.getCurrentCase(), correlationCase); Map<Integer, CommonAttributeValueList> interCaseCommonFiles = eamDbAttrInst.findSingleInterCaseCommonAttributeValues(Case.getCurrentCase(), correlationCase);
Set<String> mimeTypesToFilterOn = new HashSet<>(); Set<String> mimeTypesToFilterOn = getMimeTypesToFilterOn();
if (isFilterByMedia()) {
mimeTypesToFilterOn.addAll(MEDIA_PICS_VIDEO_MIME_TYPES);
}
if (isFilterByDoc()) {
mimeTypesToFilterOn.addAll(TEXT_FILES_MIME_TYPES);
}
return new CommonAttributeSearchResults(interCaseCommonFiles, this.frequencyPercentageThreshold, this.corAttrType, mimeTypesToFilterOn); return new CommonAttributeSearchResults(interCaseCommonFiles, this.frequencyPercentageThreshold, this.corAttrType, mimeTypesToFilterOn);
} }
@NbBundle.Messages({ @NbBundle.Messages({
"# {0} - case name", "# {0} - case name",
"# {1} - attr type", "# {1} - attr type",

149
Core/src/org/sleuthkit/autopsy/coreutils/FileTypeUtils.java
View File

@ -20,12 +20,10 @@ package org.sleuthkit.autopsy.coreutils;
import com.google.common.collect.ImmutableCollection; import com.google.common.collect.ImmutableCollection;
import com.google.common.collect.ImmutableSet; import com.google.common.collect.ImmutableSet;
import java.util.Arrays;
import static java.util.Arrays.asList; import static java.util.Arrays.asList;
import java.util.Collection; import java.util.Collection;
import java.util.Collections; import java.util.Collections;
import javax.imageio.ImageIO; import javax.imageio.ImageIO;
import org.apache.commons.collections4.CollectionUtils;
import org.openide.util.NbBundle; import org.openide.util.NbBundle;
/** /**
@ -33,12 +31,13 @@ import org.openide.util.NbBundle;
*/ */
public final class FileTypeUtils { public final class FileTypeUtils {
private static final ImmutableCollection<String> IMAGE_MIME_TYPES; private static final ImmutableSet<String> IMAGE_MIME_TYPES;
private static final ImmutableCollection<String> AUDIO_MIME_TYPES; private static final ImmutableSet<String> AUDIO_MIME_TYPES;
private static final ImmutableCollection<String> VIDEO_MIME_TYPES; private static final ImmutableSet<String> VIDEO_MIME_TYPES;
private static final ImmutableCollection<String> MEDIA_MIME_TYPES; private static final ImmutableSet<String> MULTI_MEDIA_MIME_TYPES;
private static final ImmutableCollection<String> DOCUMENT_MIME_TYPES; private static final ImmutableSet<String> DOCUMENT_MIME_TYPES;
private static final ImmutableCollection<String> EXECUTABLE_MIME_TYPES; private static final ImmutableSet<String> EXECUTABLE_MIME_TYPES;
private static final ImmutableSet<String> VISUAL_MEDIA_MIME_TYPES;
static { static {
IMAGE_MIME_TYPES = new ImmutableSet.Builder<String>() IMAGE_MIME_TYPES = new ImmutableSet.Builder<String>()
@ -51,19 +50,17 @@ public final class FileTypeUtils {
"image/vnd.adobe.photoshop", //NON-NLS "image/vnd.adobe.photoshop", //NON-NLS
"image/x-raw-nikon", //NON-NLS "image/x-raw-nikon", //NON-NLS
"image/x-ms-bmp", //NON-NLS "image/x-ms-bmp", //NON-NLS
"image/x-icon" //NON-NLS "image/x-icon", //NON-NLS
"image/webp", //NON-NLS
"image/vnd.microsoft.icon" //NON-NLS
).build(); ).build();
AUDIO_MIME_TYPES = new ImmutableSet.Builder<String>() AUDIO_MIME_TYPES = new ImmutableSet.Builder<String>()
.add("image/bmp", //NON-NLS .add("audio/midi", //NON-NLS
"image/gif", //NON-NLS "audio/mpeg", //NON-NLS
"image/jpeg", //NON-NLS "audio/webm", //NON-NLS
"image/png", //NON-NLS "audio/ogg", //NON-NLS
"image/tiff", //NON-NLS "audio/wav" //NON-NLS
"image/vnd.adobe.photoshop", //NON-NLS ).build();
"image/x-raw-nikon", //NON-NLS
"image/x-ms-bmp", //NON-NLS
"image/x-icon") //NON-NLS
.build();
VIDEO_MIME_TYPES = new ImmutableSet.Builder<String>() VIDEO_MIME_TYPES = new ImmutableSet.Builder<String>()
.add("video/webm", //NON-NLS .add("video/webm", //NON-NLS
"video/3gpp", //NON-NLS "video/3gpp", //NON-NLS
@ -75,12 +72,23 @@ public final class FileTypeUtils {
"video/x-msvideo", //NON-NLS "video/x-msvideo", //NON-NLS
"video/x-flv", //NON-NLS "video/x-flv", //NON-NLS
"video/x-m4v", //NON-NLS "video/x-m4v", //NON-NLS
"video/x-ms-wmv") "video/x-ms-wmv"//NON-NLS
.build(); ).build();
MEDIA_MIME_TYPES = new ImmutableSet.Builder<String>() VISUAL_MEDIA_MIME_TYPES = new ImmutableSet.Builder<String>()
.addAll(IMAGE_MIME_TYPES)
.addAll(VIDEO_MIME_TYPES)
.add("application/vnd.ms-asf", //NON-NLS
"application/vnd.rn-realmedia", //NON-NLS
"application/x-shockwave-flash" //NON-NLS
).build();
MULTI_MEDIA_MIME_TYPES = new ImmutableSet.Builder<String>()
.addAll(IMAGE_MIME_TYPES) .addAll(IMAGE_MIME_TYPES)
.addAll(AUDIO_MIME_TYPES) .addAll(AUDIO_MIME_TYPES)
.addAll(VIDEO_MIME_TYPES) .addAll(VIDEO_MIME_TYPES)
.add("application/vnd.ms-asf", //NON-NLS
"application/vnd.rn-realmedia", //NON-NLS
"application/x-shockwave-flash" //NON-NLS
)
.build(); .build();
DOCUMENT_MIME_TYPES = new ImmutableSet.Builder<String>() DOCUMENT_MIME_TYPES = new ImmutableSet.Builder<String>()
.add("text/plain", //NON-NLS .add("text/plain", //NON-NLS
@ -102,7 +110,7 @@ public final class FileTypeUtils {
"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", //NON-NLS "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", //NON-NLS
"application/vnd.oasis.opendocument.presentation", //NON-NLS "application/vnd.oasis.opendocument.presentation", //NON-NLS
"application/vnd.oasis.opendocument.spreadsheet", //NON-NLS "application/vnd.oasis.opendocument.spreadsheet", //NON-NLS
"application/vnd.oasis.opendocument.text" //NON-NLS) "application/vnd.oasis.opendocument.text" //NON-NLS
).build(); ).build();
EXECUTABLE_MIME_TYPES = new ImmutableSet.Builder<String>() EXECUTABLE_MIME_TYPES = new ImmutableSet.Builder<String>()
.add("application/x-bat",//NON-NLS .add("application/x-bat",//NON-NLS
@ -131,77 +139,36 @@ public final class FileTypeUtils {
"FileTypeUtils.FileTypeCategory.Video.displayName=Video", "FileTypeUtils.FileTypeCategory.Video.displayName=Video",
"FileTypeUtils.FileTypeCategory.Image.displayName=Image", "FileTypeUtils.FileTypeCategory.Image.displayName=Image",
"FileTypeUtils.FileTypeCategory.Media.displayName=Media", "FileTypeUtils.FileTypeCategory.Media.displayName=Media",
"FileTypeUtils.FileTypeCategory.Visual.displayName=Visual",
"FileTypeUtils.FileTypeCategory.Documents.displayName=Documents", "FileTypeUtils.FileTypeCategory.Documents.displayName=Documents",
"FileTypeUtils.FileTypeCategory.Executables.displayName=Executables"}) "FileTypeUtils.FileTypeCategory.Executables.displayName=Executables"})
public enum FileTypeCategory { static public enum FileTypeCategory {
IMAGE(Bundle.FileTypeUtils_FileTypeCategory_Image_displayName(), Collections.emptyList(), Collections.emptyList()), IMAGE(Bundle.FileTypeUtils_FileTypeCategory_Image_displayName(),
VIDEO(Bundle.FileTypeUtils_FileTypeCategory_Video_displayName(), Collections.emptyList(), Collections.emptyList()), IMAGE_MIME_TYPES,
AUDIO(Bundle.FileTypeUtils_FileTypeCategory_Audio_displayName(), Collections.emptyList(), Collections.emptyList()), Collections.emptyList()),
Media(Bundle.FileTypeUtils_FileTypeCategory_Media_displayName(), VIDEO(Bundle.FileTypeUtils_FileTypeCategory_Video_displayName(),
CollectionUtils.union(Arrays.asList(ImageIO.getReaderMIMETypes()), VIDEO_MIME_TYPES,
Arrays.asList( Collections.emptyList()),
"image/bmp", //NON-NLS AUDIO(Bundle.FileTypeUtils_FileTypeCategory_Audio_displayName(),
"image/gif", //NON-NLS AUDIO_MIME_TYPES,
"image/jpeg", //NON-NLS Collections.emptyList()),
"image/png", //NON-NLS VISUAL(Bundle.FileTypeUtils_FileTypeCategory_Media_displayName(),
"image/tiff", //NON-NLS VISUAL_MEDIA_MIME_TYPES,
"image/vnd.adobe.photoshop", //NON-NLS Collections.emptyList()),
"image/x-raw-nikon", //NON-NLS MEDIA(Bundle.FileTypeUtils_FileTypeCategory_Media_displayName(),
"image/x-ms-bmp", //NON-NLS MULTI_MEDIA_MIME_TYPES,
"image/x-icon", //NON-NLS Collections.emptyList()),
"video/webm", //NON-NLS EXECUTABLE(Bundle.FileTypeUtils_FileTypeCategory_Executables_displayName(),
"video/3gpp", //NON-NLS EXECUTABLE_MIME_TYPES,
"video/3gpp2", //NON-NLS Collections.emptyList()),
"video/ogg", //NON-NLS DOCUMENTS(Bundle.FileTypeUtils_FileTypeCategory_Documents_displayName(),
"video/mpeg", //NON-NLS DOCUMENT_MIME_TYPES,
"video/mp4", //NON-NLS Collections.emptyList());
"video/quicktime", //NON-NLS
"video/x-msvideo", //NON-NLS
"video/x-flv", //NON-NLS
"video/x-m4v", //NON-NLS
"video/x-ms-wmv", //NON-NLS
"application/vnd.ms-asf", //NON-NLS
"application/vnd.rn-realmedia", //NON-NLS
"application/x-shockwave-flash" //NON-NLS
)), Collections.emptyList()),
Executable(Bundle.FileTypeUtils_FileTypeCategory_Executables_displayName(),
Arrays.asList(
"application/x-bat",//NON-NLS
"application/x-dosexec",//NON-NLS
"application/vnd.microsoft.portable-executable",//NON-NLS
"application/x-msdownload",//NON-NLS
"application/exe",//NON-NLS
"application/x-exe",//NON-NLS
"application/dos-exe",//NON-NLS
"vms/exe",//NON-NLS
"application/x-winexe",//NON-NLS
"application/msdos-windows",//NON-NLS
"application/x-msdos-program"//NON-NLS
), Collections.emptyList()),
Documents(Bundle.FileTypeUtils_FileTypeCategory_Documents_displayName(),
Arrays.asList("text/*", //NON-NLS
"application/rtf", //NON-NLS
"application/pdf", //NON-NLS
"application/json", //NON-NLS
"application/javascript", //NON-NLS
"application/xml", //NON-NLS
"application/x-msoffice", //NON-NLS
"application/x-ooxml", //NON-NLS
"application/msword", //NON-NLS
"application/vnd.openxmlformats-officedocument.wordprocessingml.document", //NON-NLS
"application/vnd.ms-powerpoint", //NON-NLS
"application/vnd.openxmlformats-officedocument.presentationml.presentation", //NON-NLS
"application/vnd.ms-excel", //NON-NLS
"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", //NON-NLS
"application/vnd.oasis.opendocument.presentation", //NON-NLS
"application/vnd.oasis.opendocument.spreadsheet", //NON-NLS
"application/vnd.oasis.opendocument.text" //NON-NLS)
), Collections.emptyList());
private final String displayName; private final String displayName;
private final ImmutableCollection<String> mediaTypes; private final ImmutableSet<String> mediaTypes;
private final ImmutableCollection<String> extensions; private final ImmutableSet<String> extensions;
private FileTypeCategory(String displayName, Collection<String> mediaTypes, Collection<String> extensions) { private FileTypeCategory(String displayName, Collection<String> mediaTypes, Collection<String> extensions) {
this.displayName = displayName; this.displayName = displayName;
@ -213,12 +180,12 @@ public final class FileTypeUtils {
return displayName; return displayName;
} }
public ImmutableCollection<String> getMediaTypes() { public ImmutableSet<String> getMediaTypes() {
return mediaTypes; return mediaTypes;
} }
public ImmutableCollection<String> getExtension() { public ImmutableSet<String> getExtension() {
return extensions; return extensions;
} }
} }

19
Core/src/org/sleuthkit/autopsy/timeline/utils/FilterUtils.java
View File

@ -18,17 +18,16 @@
*/ */
package org.sleuthkit.autopsy.timeline.utils; package org.sleuthkit.autopsy.timeline.utils;
import com.google.common.net.MediaType;
import java.util.Collection; import java.util.Collection;
import java.util.HashSet; import java.util.HashSet;
import java.util.Set; import java.util.Set;
import org.openide.util.NbBundle; import org.openide.util.NbBundle;
import static org.sleuthkit.autopsy.coreutils.FileTypeUtils.FileTypeCategory.Documents;
import static org.sleuthkit.autopsy.coreutils.FileTypeUtils.FileTypeCategory.Executable;
import static org.sleuthkit.autopsy.coreutils.FileTypeUtils.FileTypeCategory.Media;
import org.sleuthkit.datamodel.TimelineManager; import org.sleuthkit.datamodel.TimelineManager;
import org.sleuthkit.datamodel.timeline.TimelineFilter.FileTypeFilter; import org.sleuthkit.datamodel.timeline.TimelineFilter.FileTypeFilter;
import org.sleuthkit.datamodel.timeline.TimelineFilter.FileTypesFilter; import org.sleuthkit.datamodel.timeline.TimelineFilter.FileTypesFilter;
import static org.sleuthkit.autopsy.coreutils.FileTypeUtils.FileTypeCategory.MEDIA;
import static org.sleuthkit.autopsy.coreutils.FileTypeUtils.FileTypeCategory.EXECUTABLE;
import static org.sleuthkit.autopsy.coreutils.FileTypeUtils.FileTypeCategory.DOCUMENTS;
/** /**
* Utilities to deal with TimelineFilters * Utilities to deal with TimelineFilters
@ -38,9 +37,9 @@ public final class FilterUtils {
private static final Set<String> NON_OTHER_MIME_TYPES = new HashSet<>(); private static final Set<String> NON_OTHER_MIME_TYPES = new HashSet<>();
static { static {
NON_OTHER_MIME_TYPES.addAll(Documents.getMediaTypes()); NON_OTHER_MIME_TYPES.addAll(DOCUMENTS.getMediaTypes());
NON_OTHER_MIME_TYPES.addAll(Executable.getMediaTypes()); NON_OTHER_MIME_TYPES.addAll(EXECUTABLE.getMediaTypes());
NON_OTHER_MIME_TYPES.addAll(Media.getMediaTypes()); NON_OTHER_MIME_TYPES.addAll(MEDIA.getMediaTypes());
} }
private FilterUtils() { private FilterUtils() {
@ -57,9 +56,9 @@ public final class FilterUtils {
public static FileTypesFilter createDefaultFileTypesFilter() { public static FileTypesFilter createDefaultFileTypesFilter() {
FileTypesFilter fileTypesFilter = new FileTypesFilter(); FileTypesFilter fileTypesFilter = new FileTypesFilter();
fileTypesFilter.addSubFilter(new FileTypeFilter(Media.getDisplayName(), Media.getMediaTypes())); fileTypesFilter.addSubFilter(new FileTypeFilter(MEDIA.getDisplayName(), MEDIA.getMediaTypes()));
fileTypesFilter.addSubFilter(new FileTypeFilter(Documents.getDisplayName(), Documents.getMediaTypes())); fileTypesFilter.addSubFilter(new FileTypeFilter(DOCUMENTS.getDisplayName(), DOCUMENTS.getMediaTypes()));
fileTypesFilter.addSubFilter(new FileTypeFilter(Executable.getDisplayName(), Executable.getMediaTypes())); fileTypesFilter.addSubFilter(new FileTypeFilter(EXECUTABLE.getDisplayName(), EXECUTABLE.getMediaTypes()));
fileTypesFilter.addSubFilter(new InverseFileTypeFilter(Bundle.FilterUtils_otherFilter_displayName(), NON_OTHER_MIME_TYPES)); fileTypesFilter.addSubFilter(new InverseFileTypeFilter(Bundle.FilterUtils_otherFilter_displayName(), NON_OTHER_MIME_TYPES));
return fileTypesFilter; return fileTypesFilter;