mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-12 16:06:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added comments and general code clean up

Browse Source
This commit is contained in:
U-BASIS\dsmyda 2019-12-13 15:46:24 -05:00
parent f4de27095c
commit d81c2bc22d
2 changed files with 244 additions and 248 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
Core/src/org/sleuthkit/autopsy/datasourceprocessors/xry/XRYCallsFileParser.java
View File

@ -52,8 +52,8 @@ final class XRYCallsFileParser extends AbstractSingleKeyValueParser {
private static final String NETWORK_LOCALE = "(network)"; private static final String NETWORK_LOCALE = "(network)";
/** /**
* All of the known XRY keys for call reports and the blackboard * All of the known XRY keys for call reports and their corresponding
* attribute types they map to. * blackboard attribute types, if any.
*/ */
private enum XryKey { private enum XryKey {
NUMBER("number", BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER), NUMBER("number", BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER),
@ -97,9 +97,9 @@ final class XRYCallsFileParser extends AbstractSingleKeyValueParser {
/** /**
* Matches the display name of the xry key to the appropriate enum type. * Matches the display name of the xry key to the appropriate enum type.
* *
* It is assumed that XRY key string is recognized. Otherwise, * It is assumed that XRY key string is recognized. Otherwise, an
* an IllegalArgumentException is thrown. Test all membership * IllegalArgumentException is thrown. Test all membership with
* with contains() before hand. * contains() before hand.
* *
* @param xryKey * @param xryKey
* @return * @return
@ -125,12 +125,14 @@ final class XRYCallsFileParser extends AbstractSingleKeyValueParser {
NONE(null); NONE(null);
private final String name; private final String name;
XryNamespace(String name) { XryNamespace(String name) {
this.name = name; this.name = name;
} }
/** /**
* Indicates if the display name of the XRY namespace is a recognized type. * Indicates if the display name of the XRY namespace is a recognized
* type.
* *
* @param xryNamespace * @param xryNamespace
* @return * @return
@ -147,11 +149,12 @@ final class XRYCallsFileParser extends AbstractSingleKeyValueParser {
} }
/** /**
* Matches the display name of the xry namespace to the appropriate enum type. * Matches the display name of the xry namespace to the appropriate enum
* type.
* *
* It is assumed that XRY namespace string is recognized. Otherwise, * It is assumed that XRY namespace string is recognized. Otherwise, an
* an IllegalArgumentException is thrown. Test all membership * IllegalArgumentException is thrown. Test all membership with
* with contains() before hand. * contains() before hand.
* *
* @param xryNamespace * @param xryNamespace
* @return * @return
@ -272,13 +275,12 @@ final class XRYCallsFileParser extends AbstractSingleKeyValueParser {
* *
* 1/3/1990 1:23:54 AM UTC+4 * 1/3/1990 1:23:54 AM UTC+4
* *
* In our current version of Java (openjdk-1.8.0.222), there is * In our current version of Java (openjdk-1.8.0.222), there is a bug
* a bug with having the timezone offset (UTC+4 or GMT-7) at the * with having the timezone offset (UTC+4 or GMT-7) at the end of the
* end of the date time input. This is fixed in later versions * date time input. This is fixed in later versions of the JDK (9 and
* of the JDK (9 and beyond). * beyond). https://bugs.openjdk.java.net/browse/JDK-8154050 Rather than
* https://bugs.openjdk.java.net/browse/JDK-8154050 * update the JDK to accommodate this, the components of the date time
* Rather than update the JDK to accommodate this, the components of * string are reversed:
* the date time string are reversed:
* *
* UTC+4 AM 1:23:54 1/3/1990 * UTC+4 AM 1:23:54 1/3/1990
* *
@ -286,11 +288,11 @@ final class XRYCallsFileParser extends AbstractSingleKeyValueParser {
*/ */
String reversedDateTime = reverseOrderOfDateTimeComponents(dateTimeWithoutLocale); String reversedDateTime = reverseOrderOfDateTimeComponents(dateTimeWithoutLocale);
/** /**
* Furthermore, the DateTimeFormatter's timezone offset letter ('O') does * Furthermore, the DateTimeFormatter's timezone offset letter ('O')
* not recognize UTC but recognizes GMT. According to * does not recognize UTC but recognizes GMT. According to
* https://en.wikipedia.org/wiki/Coordinated_Universal_Time, * https://en.wikipedia.org/wiki/Coordinated_Universal_Time, GMT only
* GMT only differs from UTC by at most 1 second and so substitution * differs from UTC by at most 1 second and so substitution will only
* will only introduce a trivial amount of error. * introduce a trivial amount of error.
*/ */
String reversedDateTimeWithGMT = reversedDateTime.replace("UTC", "GMT"); String reversedDateTimeWithGMT = reversedDateTime.replace("UTC", "GMT");
TemporalAccessor result = DATE_TIME_PARSER.parseBest(reversedDateTimeWithGMT, TemporalAccessor result = DATE_TIME_PARSER.parseBest(reversedDateTimeWithGMT,
@ -310,10 +312,7 @@ final class XRYCallsFileParser extends AbstractSingleKeyValueParser {
/** /**
* Reverses the order of the date time components. * Reverses the order of the date time components.
* *
* Example: * Example: 1/3/1990 1:23:54 AM UTC+4 becomes UTC+4 AM 1:23:54 1/3/1990
* 1/3/1990 1:23:54 AM UTC+4
* becomes
* UTC+4 AM 1:23:54 1/3/1990
* *
* @param dateTime * @param dateTime
* @return * @return

123
Core/src/org/sleuthkit/autopsy/datasourceprocessors/xry/XRYMessagesFileParser.java
View File

@ -64,8 +64,8 @@ final class XRYMessagesFileParser implements XRYFileParser {
private static final int UNREAD = 0; private static final int UNREAD = 0;
/** /**
* All of the known XRY keys for message reports and the blackboard * All of the known XRY keys for message reports and their corresponding
* attribute types they map to. * blackboard attribute types, if any.
*/ */
private enum XryKey { private enum XryKey {
DELETED("deleted", BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ISDELETED), DELETED("deleted", BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ISDELETED),
@ -121,9 +121,9 @@ final class XRYMessagesFileParser implements XRYFileParser {
/** /**
* Matches the display name of the xry key to the appropriate enum type. * Matches the display name of the xry key to the appropriate enum type.
* *
* It is assumed that XRY key string is recognized. Otherwise, * It is assumed that XRY key string is recognized. Otherwise, an
* an IllegalArgumentException is thrown. Test all membership * IllegalArgumentException is thrown. Test all membership with
* with contains() before hand. * contains() before hand.
* *
* @param xryKey * @param xryKey
* @return * @return
@ -157,7 +157,8 @@ final class XRYMessagesFileParser implements XRYFileParser {
} }
/** /**
* Indicates if the display name of the XRY namespace is a recognized type. * Indicates if the display name of the XRY namespace is a recognized
* type.
* *
* @param xryNamespace * @param xryNamespace
* @return * @return
@ -172,11 +173,12 @@ final class XRYMessagesFileParser implements XRYFileParser {
} }
/** /**
* Matches the display name of the xry namespace to the appropriate enum type. * Matches the display name of the xry namespace to the appropriate enum
* type.
* *
* It is assumed that XRY namespace string is recognized. Otherwise, * It is assumed that XRY namespace string is recognized. Otherwise, an
* an IllegalArgumentException is thrown. Test all membership * IllegalArgumentException is thrown. Test all membership with
* with contains() before hand. * contains() before hand.
* *
* @param xryNamespace * @param xryNamespace
* @return * @return
@ -212,7 +214,6 @@ final class XRYMessagesFileParser implements XRYFileParser {
return name; return name;
} }
/** /**
* Indicates if the display name of the XRY key is a recognized type. * Indicates if the display name of the XRY key is a recognized type.
* *
@ -231,9 +232,9 @@ final class XRYMessagesFileParser implements XRYFileParser {
/** /**
* Matches the display name of the xry key to the appropriate enum type. * Matches the display name of the xry key to the appropriate enum type.
* *
* It is assumed that XRY key string is recognized. Otherwise, * It is assumed that XRY key string is recognized. Otherwise, an
* an IllegalArgumentException is thrown. Test all membership * IllegalArgumentException is thrown. Test all membership with
* with contains() before hand. * contains() before hand.
* *
* @param xryKey * @param xryKey
* @return * @return
@ -253,11 +254,11 @@ final class XRYMessagesFileParser implements XRYFileParser {
/** /**
* Message-SMS report artifacts can span multiple XRY entities and their * Message-SMS report artifacts can span multiple XRY entities and their
* attributes can span multiple lines. The "Text" and "Message" keys are the only known key * attributes can span multiple lines. The "Text" and "Message" keys are the
* value pair that can span multiple lines. Messages can be segmented, * only known key value pair that can span multiple lines. Messages can be
* meaning that their "Text" and "Message" content can appear in multiple XRY entities. * segmented, meaning that their "Text" and "Message" content can appear in
* Our goal for a segmented message is to aggregate all of the text pieces and * multiple XRY entities. Our goal for a segmented message is to aggregate
* create 1 artifact. * all of the text pieces and create 1 artifact.
* *
* This parse implementation assumes that segments are contiguous and that * This parse implementation assumes that segments are contiguous and that
* they ascend incrementally. There are checks in place to verify this * they ascend incrementally. There are checks in place to verify this
@ -291,12 +292,8 @@ final class XRYMessagesFileParser implements XRYFileParser {
} }
/** /**
* * Extracts all blackboard attributes from the XRY Entity. This function will
* @param xryEntity * unify any segmented text, if need be.
* @param reader
* @param referenceValues
* @return
* @throws IOException
*/ */
private List<BlackboardAttribute> getBlackboardAttributes(String xryEntity, private List<BlackboardAttribute> getBlackboardAttributes(String xryEntity,
XRYFileReader reader, Set<Integer> referenceValues) throws IOException { XRYFileReader reader, Set<Integer> referenceValues) throws IOException {
@ -307,7 +304,7 @@ final class XRYMessagesFileParser implements XRYFileParser {
List<BlackboardAttribute> attributes = new ArrayList<>(); List<BlackboardAttribute> attributes = new ArrayList<>();
//Count the key value pairs in the XRY entity. //Count the key value pairs in the XRY entity.
int keyCount = countKeys(xryLines); int keyCount = getCountOfKeyValuePairs(xryLines);
for (int i = 1; i <= keyCount; i++) { for (int i = 1; i <= keyCount; i++) {
//Get the ith key value pair in the entity. Always expect to have //Get the ith key value pair in the entity. Always expect to have
//a valid value. //a valid value.
@ -333,8 +330,8 @@ final class XRYMessagesFileParser implements XRYFileParser {
//Assume text and message are the only fields that can be segmented //Assume text and message are the only fields that can be segmented
//among multiple XRY entities. //among multiple XRY entities.
if (pair.hasKey(XryKey.TEXT.getDisplayName()) || if (pair.hasKey(XryKey.TEXT.getDisplayName())
pair.hasKey(XryKey.MESSAGE.getDisplayName())) { || pair.hasKey(XryKey.MESSAGE.getDisplayName())) {
String segmentedText = getSegmentedText(xryLines, reader, referenceValues); String segmentedText = getSegmentedText(xryLines, reader, referenceValues);
pair = new XRYKeyValuePair(pair.getKey(), pair = new XRYKeyValuePair(pair.getKey(),
//Assume text is segmented by word. //Assume text is segmented by word.
@ -353,10 +350,10 @@ final class XRYMessagesFileParser implements XRYFileParser {
} }
/** /**
* Counts the key value pairs in an XRY entity. * Counts the key value pairs in an XRY entity. Skips counting the first
* Skips counting the first line as it is assumed to be the title. * line as it is assumed to be the title.
*/ */
private Integer countKeys(String[] xryEntity) { private Integer getCountOfKeyValuePairs(String[] xryEntity) {
int count = 0; int count = 0;
for (int i = 1; i < xryEntity.length; i++) { for (int i = 1; i < xryEntity.length; i++) {
if (XRYKeyValuePair.isPair(xryEntity[i])) { if (XRYKeyValuePair.isPair(xryEntity[i])) {
@ -367,12 +364,12 @@ final class XRYMessagesFileParser implements XRYFileParser {
} }
/** /**
* Builds up segmented message entities so that the text is unified in the * Builds up segmented message entities so that the text is unified for a
* artifact. * single artifact.
* *
* @param referenceNumber Reference number that messages are group by * @param reader File reader that is producing XRY entities.
* @param segmentNumber Segment number of the starting segment. * @param referenceNumbersSeen All known references numbers up until this point.
* @param reader * @param xryEntity The source XRY entity.
* @return * @return
* @throws IOException * @throws IOException
*/ */
@ -414,8 +411,8 @@ final class XRYMessagesFileParser implements XRYFileParser {
String[] nextEntityLines = nextEntity.split("\n"); String[] nextEntityLines = nextEntity.split("\n");
Optional<Integer> nextReferenceNumber = getMetaKeyValue(nextEntityLines, XryMetaKey.REFERENCE_NUMBER); Optional<Integer> nextReferenceNumber = getMetaKeyValue(nextEntityLines, XryMetaKey.REFERENCE_NUMBER);
if (!nextReferenceNumber.isPresent() || if (!nextReferenceNumber.isPresent()
!Objects.equals(nextReferenceNumber, referenceNumber)) { || !Objects.equals(nextReferenceNumber, referenceNumber)) {
//Don't consume the next entity. It is not related //Don't consume the next entity. It is not related
//to the current message thread. //to the current message thread.
break; break;
@ -440,11 +437,11 @@ final class XRYMessagesFileParser implements XRYFileParser {
+ "text will be out of order.", nextSegmentNumber.get(), currentSegmentNumber)); + "text will be out of order.", nextSegmentNumber.get(), currentSegmentNumber));
} }
int keyCount = countKeys(nextEntityLines); int keyCount = getCountOfKeyValuePairs(nextEntityLines);
for (int i = 1; i <= keyCount; i++) { for (int i = 1; i <= keyCount; i++) {
XRYKeyValuePair pair = getKeyValuePairByIndex(nextEntityLines, i).get(); XRYKeyValuePair pair = getKeyValuePairByIndex(nextEntityLines, i).get();
if(pair.hasKey(XryKey.TEXT.getDisplayName()) || if (pair.hasKey(XryKey.TEXT.getDisplayName())
pair.hasKey(XryKey.MESSAGE.getDisplayName())) { || pair.hasKey(XryKey.MESSAGE.getDisplayName())) {
segmentedText.append(pair.getValue()).append(' '); segmentedText.append(pair.getValue()).append(' ');
} }
} }
@ -463,9 +460,10 @@ final class XRYMessagesFileParser implements XRYFileParser {
} }
/** /**
* Extracts the value of the XRY meta key, if any.
* *
* @param xryLines * @param xryLines XRY entity to extract from.
* @param metaKey * @param metaKey The key type to extract.
* @return * @return
*/ */
private Optional<Integer> getMetaKeyValue(String[] xryLines, XryMetaKey metaKey) { private Optional<Integer> getMetaKeyValue(String[] xryLines, XryMetaKey metaKey) {
@ -488,9 +486,12 @@ final class XRYMessagesFileParser implements XRYFileParser {
} }
/** /**
* Extracts the ith XRY Key Value pair in the XRY Entity.
* *
* @param xryLines * The total number of pairs can be determined via getCountOfKeyValuePairs().
* @param index *
* @param xryLines XRY entity.
* @param index The requested Key Value pair.
* @return * @return
*/ */
private Optional<XRYKeyValuePair> getKeyValuePairByIndex(String[] xryLines, int index) { private Optional<XRYKeyValuePair> getKeyValuePairByIndex(String[] xryLines, int index) {
@ -534,8 +535,8 @@ final class XRYMessagesFileParser implements XRYFileParser {
/** /**
* Creates an attribute from the extracted key value pair. * Creates an attribute from the extracted key value pair.
* *
* @param nameSpace The namespace of this key value pair. * @param nameSpace The namespace of this key value pair. It will have been
* It will have been verified beforehand, otherwise it will be NONE. * verified beforehand, otherwise it will be NONE.
* @param key The recognized XRY key. * @param key The recognized XRY key.
* @param value The value associated with that key. * @param value The value associated with that key.
* @return Corresponding blackboard attribute, if any. * @return Corresponding blackboard attribute, if any.
@ -667,13 +668,12 @@ final class XRYMessagesFileParser implements XRYFileParser {
* *
* 1/3/1990 1:23:54 AM UTC+4 * 1/3/1990 1:23:54 AM UTC+4
* *
* In our current version of Java (openjdk-1.8.0.222), there is * In our current version of Java (openjdk-1.8.0.222), there is a bug
* a bug with having the timezone offset (UTC+4 or GMT-7) at the * with having the timezone offset (UTC+4 or GMT-7) at the end of the
* end of the date time input. This is fixed in later versions * date time input. This is fixed in later versions of the JDK (9 and
* of the JDK (9 and beyond). * beyond). https://bugs.openjdk.java.net/browse/JDK-8154050 Rather than
* https://bugs.openjdk.java.net/browse/JDK-8154050 * update the JDK to accommodate this, the components of the date time
* Rather than update the JDK to accommodate this, the components of * string are reversed:
* the date time string are reversed:
* *
* UTC+4 AM 1:23:54 1/3/1990 * UTC+4 AM 1:23:54 1/3/1990
* *
@ -681,11 +681,11 @@ final class XRYMessagesFileParser implements XRYFileParser {
*/ */
String reversedDateTime = reverseOrderOfDateTimeComponents(dateTimeWithoutLocale); String reversedDateTime = reverseOrderOfDateTimeComponents(dateTimeWithoutLocale);
/** /**
* Furthermore, the DateTimeFormatter's timezone offset letter ('O') does * Furthermore, the DateTimeFormatter's timezone offset letter ('O')
* not recognize UTC but recognizes GMT. According to * does not recognize UTC but recognizes GMT. According to
* https://en.wikipedia.org/wiki/Coordinated_Universal_Time, * https://en.wikipedia.org/wiki/Coordinated_Universal_Time, GMT only
* GMT only differs from UTC by at most 1 second and so substitution * differs from UTC by at most 1 second and so substitution will only
* will only introduce a trivial amount of error. * introduce a trivial amount of error.
*/ */
String reversedDateTimeWithGMT = reversedDateTime.replace("UTC", "GMT"); String reversedDateTimeWithGMT = reversedDateTime.replace("UTC", "GMT");
TemporalAccessor result = DATE_TIME_PARSER.parseBest(reversedDateTimeWithGMT, TemporalAccessor result = DATE_TIME_PARSER.parseBest(reversedDateTimeWithGMT,
@ -705,10 +705,7 @@ final class XRYMessagesFileParser implements XRYFileParser {
/** /**
* Reverses the order of the date time components. * Reverses the order of the date time components.
* *
* Example: * Example: 1/3/1990 1:23:54 AM UTC+4 becomes UTC+4 AM 1:23:54 1/3/1990
* 1/3/1990 1:23:54 AM UTC+4
* becomes
* UTC+4 AM 1:23:54 1/3/1990
* *
* @param dateTime * @param dateTime
* @return * @return