mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-14 17:06:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #6992 from markmckinnon/7631-Use-Signatures-for-VHD-detection-in-VM-extractor-ingest-module

Browse Source 
7631-Use-Signatures-for-VHD-detection-in-VM-extractor-ingest-module
This commit is contained in:
Richard Cordovano 2021-05-27 12:22:57 -04:00 committed by GitHub
commit d17372b8c9
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 43 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
Core/src/org/sleuthkit/autopsy/modules/vmextractor/VMExtractorIngestModule.java
View File

@ -49,6 +49,7 @@ import org.sleuthkit.autopsy.ingest.IngestManager;
import org.sleuthkit.autopsy.ingest.IngestMessage; import org.sleuthkit.autopsy.ingest.IngestMessage;
import org.sleuthkit.autopsy.ingest.IngestModule; import org.sleuthkit.autopsy.ingest.IngestModule;
import org.sleuthkit.autopsy.ingest.IngestServices; import org.sleuthkit.autopsy.ingest.IngestServices;
import org.sleuthkit.autopsy.modules.filetypeid.FileTypeDetector;
import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.Content; import org.sleuthkit.datamodel.Content;
import org.sleuthkit.datamodel.DataSource; import org.sleuthkit.datamodel.DataSource;
@ -118,6 +119,7 @@ final class VMExtractorIngestModule extends DataSourceIngestModuleAdapter {
try { try {
// look for all VM files // look for all VM files
vmFiles = findVirtualMachineFiles(dataSource); vmFiles = findVirtualMachineFiles(dataSource);
vmFiles = removeNonVMFiles(vmFiles);
} catch (TskCoreException ex) { } catch (TskCoreException ex) {
logger.log(Level.SEVERE, "Error querying case database", ex); //NON-NLS logger.log(Level.SEVERE, "Error querying case database", ex); //NON-NLS
return ProcessResult.ERROR; return ProcessResult.ERROR;
@ -237,6 +239,47 @@ final class VMExtractorIngestModule extends DataSourceIngestModuleAdapter {
} }
return vmFiles; return vmFiles;
} }
/**
* Check all the files and if a file is a vhd then check to make sure it is a valid vhd using the mimetype. We are not
* checking the mimetype for VMDK's at this point in time.
*
* @param vmFiles List of virtual machine abstract files to look at
*
* @return List of abstract files of virtual machine files.
*/
private static List<AbstractFile> removeNonVMFiles(List<AbstractFile> vmFiles) {
List<AbstractFile> vFile = new ArrayList<>();
FileTypeDetector fileTypeDetector = null;
for (AbstractFile vmFile : vmFiles) {
if (vmFile.getNameExtension().equalsIgnoreCase("vhd")) {
String fileMimeType = vmFile.getMIMEType();
if (fileMimeType == null) {
try {
fileTypeDetector = new FileTypeDetector();
} catch (FileTypeDetector.FileTypeDetectorInitException ex) {
logger.log(Level.WARNING, String.format("Unable to create file type detector for determining MIME type for file %s with id of %d", vmFile.getName(), vmFile.getId()));
vFile.add(vmFile);
continue;
}
fileMimeType = fileTypeDetector.getMIMEType(vmFile);
try {
vmFile.setMIMEType(fileMimeType);
vmFile.save();
} catch (TskCoreException ex) {
logger.log(Level.WARNING, String.format("Unable to save mimetype of %s for file %s with id of %d", fileMimeType, vmFile.getName(), vmFile.getId()));
}
}
if (fileMimeType.equalsIgnoreCase("application/x-vhd")) {
vFile.add(vmFile);
}
} else {
vFile.add(vmFile);
}
}
return vFile;
}
/** /**
* Writes out an abstract file to a specified output folder. * Writes out an abstract file to a specified output folder.