mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-12 16:06:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Return directly when file is to be ignored.

Browse Source
This commit is contained in:
U-BASIS\dgrove 2018-06-11 12:09:03 -04:00
parent 50546c77de
commit c97b22e7fb
1 changed files with 16 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
Core/src/org/sleuthkit/autopsy/modules/encryptiondetection/EncryptionDetectionFileIngestModule.java
View File

@ -138,36 +138,33 @@ final class EncryptionDetectionFileIngestModule extends FileIngestModuleAdapter
/* /*
* Has the file been deleted? * Has the file been deleted?
*/ */
if (!file.isMetaFlagSet(TskData.TSK_FS_META_FLAG_ENUM.UNALLOC) if (!file.isMetaFlagSet(TskData.TSK_FS_META_FLAG_ENUM.UNALLOC)) {
&& !file.isDirNameFlagSet(TskData.TSK_FS_NAME_FLAG_ENUM.UNALLOC)) {
/* /*
* Is the file in FILE_IGNORE_LIST? * Is the file in FILE_IGNORE_LIST?
*/ */
boolean ignoreFile = false;
String filePath = file.getParentPath(); String filePath = file.getParentPath();
if (filePath.equals("/")) { if (filePath.equals("/")) {
String fileName = file.getName(); String fileName = file.getName();
for (String listEntry : FILE_IGNORE_LIST) { for (String listEntry : FILE_IGNORE_LIST) {
if (fileName.equalsIgnoreCase(listEntry)) { if (fileName.equalsIgnoreCase(listEntry)) {
ignoreFile = true; // Skip this file.
break; return IngestModule.ProcessResult.OK;
} }
} }
} }
if (!ignoreFile) {
/* /*
* Qualify the MIME type. * Qualify the MIME type.
*/ */
String mimeType = fileTypeDetector.getMIMEType(file); String mimeType = fileTypeDetector.getMIMEType(file);
if (mimeType.equals("application/octet-stream")) { if (mimeType.equals("application/octet-stream")) {
if (isFileEncryptionSuspected(file)) { if (isFileEncryptionSuspected(file)) {
return flagFile(file, BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_SUSPECTED, return flagFile(file, BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_SUSPECTED,
String.format(Bundle.EncryptionDetectionFileIngestModule_artifactComment_suspected(), calculatedEntropy)); String.format(Bundle.EncryptionDetectionFileIngestModule_artifactComment_suspected(), calculatedEntropy));
} }
} else { } else {
if (isFilePasswordProtected(file)) { if (isFilePasswordProtected(file)) {
return flagFile(file, BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED, Bundle.EncryptionDetectionFileIngestModule_artifactComment_password()); return flagFile(file, BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED, Bundle.EncryptionDetectionFileIngestModule_artifactComment_password());
}
} }
} }
} }