Updated to use new mime type field of abstract file

This commit is contained in:
Oliver Spohngellert 2016-01-21 11:05:15 -05:00
parent ad7c704b65
commit b0d69166ca
6 changed files with 53 additions and 104 deletions

View File

@ -69,31 +69,6 @@ class SampleFileIngestModule implements FileIngestModule {
public void startUp(IngestJobContext context) throws IngestModuleException { public void startUp(IngestJobContext context) throws IngestModuleException {
this.context = context; this.context = context;
refCounter.incrementAndGet(context.getJobId()); refCounter.incrementAndGet(context.getJobId());
synchronized (SampleFileIngestModule.class) {
if (attrId == -1) {
// For this sample, make a new attribute type to use to post
// results to the blackboard. There are many standard blackboard
// artifact and attribute types and you should use them instead
// creating new ones to facilitate use of your results by other
// modules.
Case autopsyCase = Case.getCurrentCase();
SleuthkitCase sleuthkitCase = autopsyCase.getSleuthkitCase();
try {
// See if the attribute type has already been defined.
attrId = sleuthkitCase.getAttrTypeID("ATTR_SAMPLE");
if (attrId == -1) {
attrId = sleuthkitCase.addAttrType("ATTR_SAMPLE", "Sample Attribute");
}
} catch (TskCoreException ex) {
IngestServices ingestServices = IngestServices.getInstance();
Logger logger = ingestServices.getLogger(SampleIngestModuleFactory.getModuleName());
logger.log(Level.SEVERE, "Failed to create blackboard attribute", ex);
attrId = -1;
throw new IngestModuleException(ex.getLocalizedMessage());
}
}
}
} }
@Override @Override

View File

@ -245,15 +245,7 @@ class SevenZipExtractor {
private ArchiveFormat get7ZipOptions(AbstractFile archiveFile) { private ArchiveFormat get7ZipOptions(AbstractFile archiveFile) {
// try to get the file type from the BB // try to get the file type from the BB
String detectedFormat = null; String detectedFormat = null;
try { detectedFormat = archiveFile.getMIMEType();
ArrayList<BlackboardAttribute> attributes = archiveFile.getGenInfoAttributes(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG);
for (BlackboardAttribute attribute : attributes) {
detectedFormat = attribute.getValueString();
break;
}
} catch (TskCoreException ex) {
logger.log(Level.WARNING, "Couldn't obtain file attributes for file: " + archiveFile.toString(), ex); //NON-NLS
}
if (detectedFormat == null) { if (detectedFormat == null) {
logger.log(Level.WARNING, "Could not detect format for file: {0}", archiveFile); //NON-NLS logger.log(Level.WARNING, "Could not detect format for file: {0}", archiveFile); //NON-NLS

View File

@ -148,7 +148,6 @@ public class FileExtMismatchIngestModule implements FileIngestModule {
* @return false if the two match. True if there is a mismatch. * @return false if the two match. True if there is a mismatch.
*/ */
private boolean compareSigTypeToExt(AbstractFile abstractFile) { private boolean compareSigTypeToExt(AbstractFile abstractFile) {
try {
String currActualExt = abstractFile.getNameExtension(); String currActualExt = abstractFile.getNameExtension();
// If we are skipping names with no extension // If we are skipping names with no extension
@ -158,9 +157,7 @@ public class FileExtMismatchIngestModule implements FileIngestModule {
// find file_sig value. // find file_sig value.
// check the blackboard for a file type attribute // check the blackboard for a file type attribute
ArrayList<BlackboardAttribute> attributes = abstractFile.getGenInfoAttributes(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG); String currActualSigType = abstractFile.getMIMEType();
for (BlackboardAttribute attribute : attributes) {
String currActualSigType = attribute.getValueString();
if (settings.skipFilesWithTextPlainMimeType()) { if (settings.skipFilesWithTextPlainMimeType()) {
if (!currActualExt.isEmpty() && currActualSigType.equals("text/plain")) { //NON-NLS if (!currActualExt.isEmpty() && currActualSigType.equals("text/plain")) { //NON-NLS
return false; return false;
@ -182,10 +179,6 @@ public class FileExtMismatchIngestModule implements FileIngestModule {
return true; //potential mismatch return true; //potential mismatch
} }
} }
}
} catch (TskCoreException ex) {
logger.log(Level.WARNING, "Error while getting file signature from blackboard.", ex); //NON-NLS
}
return false; return false;
} }

View File

@ -122,17 +122,10 @@ public class FileTypeDetector {
* @throws TskCoreException * @throws TskCoreException
*/ */
public String getFileType(AbstractFile file) throws TskCoreException { public String getFileType(AbstractFile file) throws TskCoreException {
String fileType; String fileType = file.getMIMEType();
ArrayList<BlackboardAttribute> attributes = file.getGenInfoAttributes(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG); if(null != fileType) {
for (BlackboardAttribute attribute : attributes) {
/**
* Get the first TSK_FILE_TYPE_SIG attribute.
*/
fileType = attribute.getValueString();
if (null != fileType && !fileType.isEmpty()) {
return fileType; return fileType;
} }
}
return detectAndPostToBlackboard(file); return detectAndPostToBlackboard(file);
} }
@ -158,6 +151,7 @@ public class FileTypeDetector {
*/ */
BlackboardArtifact getInfoArt = file.getGenInfoArtifact(); BlackboardArtifact getInfoArt = file.getGenInfoArtifact();
BlackboardAttribute batt = new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG.getTypeID(), FileTypeIdModuleFactory.getModuleName(), mimeType); BlackboardAttribute batt = new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG.getTypeID(), FileTypeIdModuleFactory.getModuleName(), mimeType);
file.setMIMEType(mimeType);
getInfoArt.addAttribute(batt); getInfoArt.addAttribute(batt);
} }
return mimeType; return mimeType;

View File

@ -236,8 +236,8 @@ class ReportGenerator {
* *
* @param artifactTypeSelections the enabled/disabled state of the artifact * @param artifactTypeSelections the enabled/disabled state of the artifact
* types to be included in the report * types to be included in the report
* @param tagSelections the enabled/disabled state of the tag names * @param tagSelections the enabled/disabled state of the tag names to be
* to be included in the report * included in the report
*/ */
public void generateTableReports(Map<ARTIFACT_TYPE, Boolean> artifactTypeSelections, Map<String, Boolean> tagNameSelections) { public void generateTableReports(Map<ARTIFACT_TYPE, Boolean> artifactTypeSelections, Map<String, Boolean> tagNameSelections) {
if (!tableProgress.isEmpty() && null != artifactTypeSelections) { if (!tableProgress.isEmpty() && null != artifactTypeSelections) {
@ -1841,13 +1841,7 @@ class ReportGenerator {
AbstractFile file = skCase.getAbstractFileById(getObjectID()); AbstractFile file = skCase.getAbstractFileById(getObjectID());
if (file != null) { if (file != null) {
orderedRowData.add(file.getName()); orderedRowData.add(file.getName());
orderedRowData.add(file.getNameExtension()); orderedRowData.add(file.getMIMEType());
List<BlackboardAttribute> attrs = file.getGenInfoAttributes(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG);
if (!attrs.isEmpty()) {
orderedRowData.add(attrs.get(0).getValueString());
} else {
orderedRowData.add("");
}
orderedRowData.add(file.getUniquePath()); orderedRowData.add(file.getUniquePath());
} else { } else {
// Make empty rows to make sure the formatting is correct // Make empty rows to make sure the formatting is correct

View File

@ -123,7 +123,8 @@ public abstract class DrawableFile<T extends AbstractFile> extends AbstractFile
file.getGid(), file.getGid(),
file.getMd5Hash(), file.getMd5Hash(),
file.getKnown(), file.getKnown(),
file.getParentPath()); file.getParentPath(),
null);
this.analyzed = new SimpleBooleanProperty(analyzed); this.analyzed = new SimpleBooleanProperty(analyzed);
this.file = file; this.file = file;
} }