diff --git a/Core/src/org/sleuthkit/autopsy/modules/iOS/CallLogAnalyzer.java b/Core/src/org/sleuthkit/autopsy/modules/iOS/CallLogAnalyzer.java index a3d8cc44ba..dcd80a55d4 100755 --- a/Core/src/org/sleuthkit/autopsy/modules/iOS/CallLogAnalyzer.java +++ b/Core/src/org/sleuthkit/autopsy/modules/iOS/CallLogAnalyzer.java @@ -85,6 +85,11 @@ class CallLogAnalyzer { SleuthkitCase skCase = currentCase.getSleuthkitCase(); try { AbstractFile f = skCase.getAbstractFileById(fId); + if(f == null){ + logger.log(Level.SEVERE, "Error getting abstract file " + fId); //NON-NLS + return; + } + try { resultSet = statement.executeQuery( "SELECT number,date,duration,type, name FROM calls ORDER BY date DESC;"); //NON-NLS diff --git a/Core/src/org/sleuthkit/autopsy/modules/iOS/ContactAnalyzer.java b/Core/src/org/sleuthkit/autopsy/modules/iOS/ContactAnalyzer.java index becafbafc0..0adde2c129 100755 --- a/Core/src/org/sleuthkit/autopsy/modules/iOS/ContactAnalyzer.java +++ b/Core/src/org/sleuthkit/autopsy/modules/iOS/ContactAnalyzer.java @@ -101,6 +101,11 @@ class ContactAnalyzer { SleuthkitCase skCase = currentCase.getSleuthkitCase(); try { AbstractFile f = skCase.getAbstractFileById(fId); + if(f == null){ + logger.log(Level.SEVERE, "Error getting abstract file " + fId); //NON-NLS + return; + } + try { // get display_name, mimetype(email or phone number) and data1 (phonenumber or email address depending on mimetype) //sorted by name, so phonenumber/email would be consecutive for a person if they exist. diff --git a/Core/src/org/sleuthkit/autopsy/modules/iOS/TextMessageAnalyzer.java b/Core/src/org/sleuthkit/autopsy/modules/iOS/TextMessageAnalyzer.java index 04d67b78f7..def68b8734 100755 --- a/Core/src/org/sleuthkit/autopsy/modules/iOS/TextMessageAnalyzer.java +++ b/Core/src/org/sleuthkit/autopsy/modules/iOS/TextMessageAnalyzer.java @@ -85,6 +85,11 @@ class TextMessageAnalyzer { SleuthkitCase skCase = currentCase.getSleuthkitCase(); try { AbstractFile f = skCase.getAbstractFileById(fId); + if(f == null){ + logger.log(Level.SEVERE, "Error getting abstract file " + fId); //NON-NLS + return; + } + try { resultSet = statement.executeQuery( "Select address,date,type,subject,body FROM sms;"); //NON-NLS diff --git a/Core/src/org/sleuthkit/autopsy/report/ReportGenerator.java b/Core/src/org/sleuthkit/autopsy/report/ReportGenerator.java index 51c074c1db..c808d0d78d 100644 --- a/Core/src/org/sleuthkit/autopsy/report/ReportGenerator.java +++ b/Core/src/org/sleuthkit/autopsy/report/ReportGenerator.java @@ -806,7 +806,10 @@ import org.sleuthkit.datamodel.TskData; logger.log(Level.WARNING, "Error while getting content from a blackboard artifact to report on.", ex); //NON-NLS return; } - checkIfFileIsImage(file); + + if(file != null){ + checkIfFileIsImage(file); + } } /** @@ -978,8 +981,11 @@ import org.sleuthkit.datamodel.TskData; String list = resultSet.getString("list"); //NON-NLS String uniquePath = ""; - try { - uniquePath = skCase.getAbstractFileById(objId).getUniquePath(); + try { + AbstractFile f = skCase.getAbstractFileById(objId); + if(f != null){ + uniquePath = skCase.getAbstractFileById(objId).getUniquePath(); + } } catch (TskCoreException ex) { errorList.add( NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetAbstractFileByID")); @@ -1109,7 +1115,10 @@ import org.sleuthkit.datamodel.TskData; String uniquePath = ""; try { - uniquePath = skCase.getAbstractFileById(objId).getUniquePath(); + AbstractFile f = skCase.getAbstractFileById(objId); + if(f != null){ + uniquePath = skCase.getAbstractFileById(objId).getUniquePath(); + } } catch (TskCoreException ex) { errorList.add( NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetAbstractFileFromID")); @@ -1772,15 +1781,23 @@ import org.sleuthkit.datamodel.TskData; break; case TSK_EXT_MISMATCH_DETECTED: AbstractFile file = skCase.getAbstractFileById(getObjectID()); - orderedRowData.add(file.getName()); - orderedRowData.add(file.getNameExtension()); - List attrs = file.getGenInfoAttributes(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG); - if (!attrs.isEmpty()) { - orderedRowData.add(attrs.get(0).getValueString()); + if(file != null){ + orderedRowData.add(file.getName()); + orderedRowData.add(file.getNameExtension()); + List attrs = file.getGenInfoAttributes(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG); + if (!attrs.isEmpty()) { + orderedRowData.add(attrs.get(0).getValueString()); + } else { + orderedRowData.add(""); + } + orderedRowData.add(file.getUniquePath()); } else { - orderedRowData.add(""); - } - orderedRowData.add(file.getUniquePath()); + // Make empty rows to make sure the formatting is correct + orderedRowData.add(null); + orderedRowData.add(null); + orderedRowData.add(null); + orderedRowData.add(null); + } break; case TSK_OS_INFO: orderedRowData.add(mappedAttributes.get(ATTRIBUTE_TYPE.TSK_PROCESSOR_ARCHITECTURE.getTypeID())); diff --git a/Core/src/org/sleuthkit/autopsy/report/ReportKML.java b/Core/src/org/sleuthkit/autopsy/report/ReportKML.java index fac72da35b..061329bf4a 100644 --- a/Core/src/org/sleuthkit/autopsy/report/ReportKML.java +++ b/Core/src/org/sleuthkit/autopsy/report/ReportKML.java @@ -131,12 +131,14 @@ class ReportKML implements GeneralReportModule { if (lon != 0 && lat != 0) { aFile = artifact.getSleuthkitCase().getAbstractFileById(artifact.getObjectID()); - extractedToPath = reportPath + aFile.getName(); - geoPath = extractedToPath; - f = new File(extractedToPath); - f.createNewFile(); - copyFileUsingStream(aFile, f); - imageName = aFile.getName(); + if(aFile != null){ + extractedToPath = reportPath + aFile.getName(); + geoPath = extractedToPath; + f = new File(extractedToPath); + f.createNewFile(); + copyFileUsingStream(aFile, f); + imageName = aFile.getName(); + } out.write(String.valueOf(lat)); out.write(";"); out.write(String.valueOf(lon)); diff --git a/Core/src/org/sleuthkit/autopsy/timeline/events/db/EventsRepository.java b/Core/src/org/sleuthkit/autopsy/timeline/events/db/EventsRepository.java index 52af156e35..19708c0438 100644 --- a/Core/src/org/sleuthkit/autopsy/timeline/events/db/EventsRepository.java +++ b/Core/src/org/sleuthkit/autopsy/timeline/events/db/EventsRepository.java @@ -243,32 +243,37 @@ public class EventsRepository { } else { try { AbstractFile f = skCase.getAbstractFileById(fID); - //TODO: This is broken for logical files? fix -jm - //TODO: logical files don't necessarily have valid timestamps, so ... -jm - final String uniquePath = f.getUniquePath(); - final String parentPath = f.getParentPath(); - String datasourceName = StringUtils.substringBefore(StringUtils.stripStart(uniquePath, "/"), parentPath); - String rootFolder = StringUtils.substringBetween(parentPath, "/", "/"); - String shortDesc = datasourceName + "/" + StringUtils.defaultIfBlank(rootFolder, ""); - String medD = datasourceName + parentPath; + + if(f != null){ + //TODO: This is broken for logical files? fix -jm + //TODO: logical files don't necessarily have valid timestamps, so ... -jm + final String uniquePath = f.getUniquePath(); + final String parentPath = f.getParentPath(); + String datasourceName = StringUtils.substringBefore(StringUtils.stripStart(uniquePath, "/"), parentPath); + String rootFolder = StringUtils.substringBetween(parentPath, "/", "/"); + String shortDesc = datasourceName + "/" + StringUtils.defaultIfBlank(rootFolder, ""); + String medD = datasourceName + parentPath; - //insert it into the db if time is > 0 => time is legitimate (drops logical files) - if (f.getAtime() > 0) { - eventDB.insertEvent(f.getAtime(), FileSystemTypes.FILE_ACCESSED, fID, null, uniquePath, medD, shortDesc, f.getKnown(), trans); - } - if (f.getMtime() > 0) { - eventDB.insertEvent(f.getMtime(), FileSystemTypes.FILE_MODIFIED, fID, null, uniquePath, medD, shortDesc, f.getKnown(), trans); - } - if (f.getCtime() > 0) { - eventDB.insertEvent(f.getCtime(), FileSystemTypes.FILE_CHANGED, fID, null, uniquePath, medD, shortDesc, f.getKnown(), trans); - } - if (f.getCrtime() > 0) { - eventDB.insertEvent(f.getCrtime(), FileSystemTypes.FILE_CREATED, fID, null, uniquePath, medD, shortDesc, f.getKnown(), trans); - } + //insert it into the db if time is > 0 => time is legitimate (drops logical files) + if (f.getAtime() > 0) { + eventDB.insertEvent(f.getAtime(), FileSystemTypes.FILE_ACCESSED, fID, null, uniquePath, medD, shortDesc, f.getKnown(), trans); + } + if (f.getMtime() > 0) { + eventDB.insertEvent(f.getMtime(), FileSystemTypes.FILE_MODIFIED, fID, null, uniquePath, medD, shortDesc, f.getKnown(), trans); + } + if (f.getCtime() > 0) { + eventDB.insertEvent(f.getCtime(), FileSystemTypes.FILE_CHANGED, fID, null, uniquePath, medD, shortDesc, f.getKnown(), trans); + } + if (f.getCrtime() > 0) { + eventDB.insertEvent(f.getCrtime(), FileSystemTypes.FILE_CREATED, fID, null, uniquePath, medD, shortDesc, f.getKnown(), trans); + } - process(Arrays.asList(new ProgressWindow.ProgressUpdate(i, numFiles, - NbBundle.getMessage(this.getClass(), - "EventsRepository.progressWindow.msg.populateMacEventsFiles2"), f.getName()))); + process(Arrays.asList(new ProgressWindow.ProgressUpdate(i, numFiles, + NbBundle.getMessage(this.getClass(), + "EventsRepository.progressWindow.msg.populateMacEventsFiles2"), f.getName()))); + } else { + LOGGER.log(Level.WARNING, "failed to look up data for file : " + fID); // NON-NLS + } } catch (TskCoreException tskCoreException) { LOGGER.log(Level.WARNING, "failed to insert mac event for file : " + fID, tskCoreException); // NON-NLS } diff --git a/Core/src/org/sleuthkit/autopsy/timeline/events/type/MiscTypes.java b/Core/src/org/sleuthkit/autopsy/timeline/events/type/MiscTypes.java index db097ad884..375f159cd4 100644 --- a/Core/src/org/sleuthkit/autopsy/timeline/events/type/MiscTypes.java +++ b/Core/src/org/sleuthkit/autopsy/timeline/events/type/MiscTypes.java @@ -28,6 +28,7 @@ import org.apache.commons.lang3.StringUtils; import org.openide.util.Exceptions; import org.openide.util.NbBundle; import org.sleuthkit.autopsy.timeline.zooming.EventTypeZoomLevel; +import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.BlackboardAttribute; import org.sleuthkit.datamodel.TskCoreException; @@ -129,7 +130,11 @@ public enum MiscTypes implements EventType, ArtifactEventType { (BlackboardArtifact t, Map u) -> { try { - return t.getSleuthkitCase().getAbstractFileById(t.getObjectID()).getName(); + AbstractFile f = t.getSleuthkitCase().getAbstractFileById(t.getObjectID()); + if(f != null){ + return f.getName(); + } + return " error loading file name"; // NON-NLS } catch (TskCoreException ex) { Exceptions.printStackTrace(ex); return " error loading file name"; // NON-NLS diff --git a/Core/src/org/sleuthkit/autopsy/timeline/explorernodes/EventRootNode.java b/Core/src/org/sleuthkit/autopsy/timeline/explorernodes/EventRootNode.java index 93c7b469be..b56dc46986 100644 --- a/Core/src/org/sleuthkit/autopsy/timeline/explorernodes/EventRootNode.java +++ b/Core/src/org/sleuthkit/autopsy/timeline/explorernodes/EventRootNode.java @@ -101,13 +101,18 @@ public class EventRootNode extends DisplayableItemNode { if (eventID >= 0) { final TimeLineEvent eventById = filteredEvents.getEventById(eventID); try { - if (eventById.getType().getSuperType() == BaseTypes.FILE_SYSTEM) { - return new EventNode(eventById, Case.getCurrentCase().getSleuthkitCase().getAbstractFileById(eventById.getFileID())); - } else { - AbstractFile file = Case.getCurrentCase().getSleuthkitCase().getAbstractFileById(eventById.getFileID()); - BlackboardArtifact blackboardArtifact = Case.getCurrentCase().getSleuthkitCase().getBlackboardArtifact(eventById.getArtifactID()); + AbstractFile file = Case.getCurrentCase().getSleuthkitCase().getAbstractFileById(eventById.getFileID()); + if(file != null){ + if (eventById.getType().getSuperType() == BaseTypes.FILE_SYSTEM) { + return new EventNode(eventById, file); + } else { + BlackboardArtifact blackboardArtifact = Case.getCurrentCase().getSleuthkitCase().getBlackboardArtifact(eventById.getArtifactID()); - return new EventNode(eventById, file, blackboardArtifact); + return new EventNode(eventById, file, blackboardArtifact); + } + } else { + LOGGER.log(Level.WARNING, "Failed to lookup sleuthkit object backing TimeLineEvent."); // NON-NLS + return null; } } catch (TskCoreException tskCoreException) {