mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-17 10:17:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed CellebritePhysicalReportProcessor archive handling logic

Browse Source
This commit is contained in:
Eugene Livis 2016-08-19 14:03:19 -04:00
parent c401bfaef4
commit 882b8cac58
1 changed files with 13 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
Experimental/src/org/sleuthkit/autopsy/experimental/cellex/datasourceprocessors/CellebritePhysicalReportProcessor.java
View File

@ -270,17 +270,11 @@ public class CellebritePhysicalReportProcessor implements AutomatedIngestDataSou
// e.g. blk0_mmcblk0.bin, blk0_mmcblk0(1).bin......, and blk24_mmcblk1.bin, blk24_mmcblk1(1).bin...... // e.g. blk0_mmcblk0.bin, blk0_mmcblk0(1).bin......, and blk24_mmcblk1.bin, blk24_mmcblk1(1).bin......
//iii. Multiple image files - one per volume - need to handle each one separately //iii. Multiple image files - one per volume - need to handle each one separately
// e.g. blk0_mmcblk0.bin, mtd0_system.bin, mtd1_cache.bin, mtd2_userdata.bin // e.g. blk0_mmcblk0.bin, mtd0_system.bin, mtd1_cache.bin, mtd2_userdata.bin
String fName = fileName.toLowerCase(); String fNameNoExt = FilenameUtils.removeExtension(fileName);
int lastPeriod = fName.lastIndexOf('.'); return fNameNoExt.toLowerCase().matches("\\w+\\(\\d+\\)");
if (-1 == lastPeriod) {
return false;
}
String fNameNoExt = fName.substring(0, lastPeriod);
return fNameNoExt.matches("\\w+\\(\\d+\\)");
} }
private static boolean isAcceptedByFiler(File file, List<FileFilter> filters) { private static boolean isAcceptedByFiler(File file, List<FileFilter> filters) {
for (FileFilter filter : filters) { for (FileFilter filter : filters) {
if (filter.accept(file)) { if (filter.accept(file)) {
return true; return true;
@ -290,19 +284,12 @@ public class CellebritePhysicalReportProcessor implements AutomatedIngestDataSou
} }
private static boolean isArchive(Path dataSourcePath) throws AutomatedIngestDataSourceProcessorException { private static boolean isArchive(Path dataSourcePath) throws AutomatedIngestDataSourceProcessorException {
String fileName = dataSourcePath.getFileName().toString(); String fileName = dataSourcePath.getFileName().toString();
// check whether it's a zip archive file that can be extracted // check whether it's a zip archive file that can be extracted
if (isAcceptedByFiler(new File(fileName), archiveFilters)) { if (isAcceptedByFiler(new File(fileName), archiveFilters)) {
try { return true;
Case currentCase = Case.getCurrentCase();
Path extractedDataSourcePath = extractDataSource(Paths.get(currentCase.getModuleDirectory()), dataSourcePath);
} catch (Exception ex) {
throw new AutomatedIngestDataSourceProcessorException(NbBundle.getMessage(CellebritePhysicalReportProcessor.class, "CellebritePhysicalReportProcessor.canProcess.exception.text"), ex);
}
} }
// ELTODO delete extracted archive contents return false;
return true;
} }
@Override @Override
@ -320,8 +307,15 @@ public class CellebritePhysicalReportProcessor implements AutomatedIngestDataSou
List<String> dataSourcePathList = Collections.emptyList(); List<String> dataSourcePathList = Collections.emptyList();
if (isArchive(dataSourcePath)) { if (isArchive(dataSourcePath)) {
// ELTODO extract the archive and pass the extracted folder as input // extract the archive and pass the extracted folder as input
run(deviceId, String imageFolderPath, "", progressMonitor, callBack) Path extractedDataSourcePath = Paths.get("");
try {
Case currentCase = Case.getCurrentCase();
extractedDataSourcePath = extractDataSource(Paths.get(currentCase.getModuleDirectory()), dataSourcePath);
} catch (Exception ex) {
throw new AutomatedIngestDataSourceProcessorException(NbBundle.getMessage(CellebritePhysicalReportProcessor.class, "CellebritePhysicalReportProcessor.canProcess.exception.text"), ex);
}
run(deviceId, extractedDataSourcePath.toString(), "", progressMonitor, callBack);
} else if (isValidDataSource(dataSourcePath)) { } else if (isValidDataSource(dataSourcePath)) {
// pass the single ".bin" file as input // pass the single ".bin" file as input
dataSourcePathList = Arrays.asList(new String[]{dataSourcePath.toString()}); dataSourcePathList = Arrays.asList(new String[]{dataSourcePath.toString()});