mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-17 10:17:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

Hold off on writing md5, known status, and MIME type until the end of ingest

Browse Source
This commit is contained in:
Ann Priestman 2017-11-15 14:07:29 -05:00
parent 48123343cc
commit c4339f6e2a
4 changed files with 39 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
Core/src/org/sleuthkit/autopsy/ingest/FileIngestPipeline.java
View File

@ -21,10 +21,14 @@ package org.sleuthkit.autopsy.ingest;
import java.util.ArrayList;
import java.util.Date;
import java.util.List;
import java.util.logging.Level;
import org.openide.util.NbBundle;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.TskCoreException;
/**
* This class manages a sequence of file level ingest modules for a data source
@ -136,6 +140,13 @@ final class FileIngestPipeline {
break;
}
}
try{
Case.getCurrentCase().getSleuthkitCase().setKnownAndFileTypeAndMD5(file);
} catch (TskCoreException ex){
Logger.getLogger(FileIngestPipeline.class.getName()).log(Level.SEVERE, "Failed to save data", ex); //NON-NLS
}
file.close();
if (!this.job.isCancelled()) {
IngestManager.getInstance().fireFileIngestDone(file);

7
Core/src/org/sleuthkit/autopsy/modules/filetypeid/FileTypeDetector.java
View File

@ -187,7 +187,8 @@ public class FileTypeDetector {
* writing the result to the case database.
*/
public String getFileType(AbstractFile file) throws TskCoreException {
return detect(file, true);
return file.getMIMEType();
//return detect(file, true);
}
/**
@ -222,7 +223,7 @@ public class FileTypeDetector {
* @throws TskCoreException If there is a problem writing the result to the
* case database.
*/
private String detect(AbstractFile file, boolean addToCaseDb) throws TskCoreException {
public String detect(AbstractFile file, boolean addToCaseDb) throws TskCoreException {
/*
* Check to see if the file has already been typed. This is the "check"
* part of a check-then-act race condition (see note below).
@ -322,7 +323,7 @@ public class FileTypeDetector {
/*
* Add the MIME type to the files table in the case database.
*/
Case.getCurrentCase().getSleuthkitCase().setFileMIMEType(file, mimeType);
//Case.getCurrentCase().getSleuthkitCase().setFileMIMEType(file, mimeType);
}
return mimeType;

3
Core/src/org/sleuthkit/autopsy/modules/filetypeid/FileTypeIdIngestModule.java
View File

@ -91,7 +91,8 @@ public class FileTypeIdIngestModule implements FileIngestModule {
*/
try {
long startTime = System.currentTimeMillis();
fileTypeDetector.getFileType(file);
String type = fileTypeDetector.detect(file, false);
file.setMIMEType(type);
addToTotals(jobId, (System.currentTimeMillis() - startTime));
return ProcessResult.OK;
} catch (Exception e) {

42
Core/src/org/sleuthkit/autopsy/modules/hashdatabase/HashDbIngestModule.java
View File

@ -204,20 +204,21 @@ public class HashDbIngestModule implements FileIngestModule {
foundBad = true;
totals.totalKnownBadCount.incrementAndGet();
try {
skCase.setKnown(file, TskData.FileKnown.BAD);
} catch (TskException ex) {
logger.log(Level.WARNING, "Couldn't set notable state for file " + name + " - see sleuthkit log for details", ex); //NON-NLS
services.postMessage(IngestMessage.createErrorMessage(
HashLookupModuleFactory.getModuleName(),
NbBundle.getMessage(this.getClass(),
"HashDbIngestModule.hashLookupErrorMsg",
name),
NbBundle.getMessage(this.getClass(),
"HashDbIngestModule.settingKnownBadStateErr",
name)));
ret = ProcessResult.ERROR;
}
//try {
file.setKnown(TskData.FileKnown.BAD);
// skCase.setKnown(file, TskData.FileKnown.BAD);
//} catch (TskException ex) {
// logger.log(Level.WARNING, "Couldn't set notable state for file " + name + " - see sleuthkit log for details", ex); //NON-NLS
// services.postMessage(IngestMessage.createErrorMessage(
// HashLookupModuleFactory.getModuleName(),
// NbBundle.getMessage(this.getClass(),
// "HashDbIngestModule.hashLookupErrorMsg",
// name),
// NbBundle.getMessage(this.getClass(),
// "HashDbIngestModule.settingKnownBadStateErr",
// name)));
// ret = ProcessResult.ERROR;
//}
String hashSetName = db.getHashSetName();
String comment = "";
@ -261,13 +262,14 @@ public class HashDbIngestModule implements FileIngestModule {
try {
long lookupstart = System.currentTimeMillis();
if (db.lookupMD5Quick(file)) {
try {
skCase.setKnown(file, TskData.FileKnown.KNOWN);
//try {
file.setKnown(TskData.FileKnown.KNOWN);
//skCase.setKnown(file, TskData.FileKnown.KNOWN);
break;
} catch (TskException ex) {
logger.log(Level.WARNING, "Couldn't set known state for file " + name + " - see sleuthkit log for details", ex); //NON-NLS
ret = ProcessResult.ERROR;
}
//} catch (TskException ex) {
// logger.log(Level.WARNING, "Couldn't set known state for file " + name + " - see sleuthkit log for details", ex); //NON-NLS
// ret = ProcessResult.ERROR;
//}
}
long delta = (System.currentTimeMillis() - lookupstart);
totals.totalLookuptime.addAndGet(delta);