Autopsy  3.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
RecentDocumentsByLnk.java
Go to the documentation of this file.
1  /*
2  *
3  * Autopsy Forensic Browser
4  *
5  * Copyright 2012-2014 Basis Technology Corp.
6  *
7  * Copyright 2012 42six Solutions.
8  * Contact: aebadirad <at> 42six <dot> com
9  * Project Contact/Architect: carrier <at> sleuthkit <dot> org
10  *
11  * Licensed under the Apache License, Version 2.0 (the "License");
12  * you may not use this file except in compliance with the License.
13  * You may obtain a copy of the License at
14  *
15  * http://www.apache.org/licenses/LICENSE-2.0
16  *
17  * Unless required by applicable law or agreed to in writing, software
18  * distributed under the License is distributed on an "AS IS" BASIS,
19  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
20  * See the License for the specific language governing permissions and
21  * limitations under the License.
22  */
23 package org.sleuthkit.autopsy.recentactivity;
24 
25 import java.util.ArrayList;
26 import java.util.List;
27 import java.util.logging.Level;
28 
29 import org.openide.util.NbBundle;
31 import java.util.Collection;
44 import org.sleuthkit.datamodel.*;
45 
50 class RecentDocumentsByLnk extends Extract {
51  private static final Logger logger = Logger.getLogger(RecentDocumentsByLnk.class.getName());
52  private IngestServices services = IngestServices.getInstance();
53  private Content dataSource;
54  private IngestJobContext context;
55 
61  private void getRecentDocuments() {
62 
63  org.sleuthkit.autopsy.casemodule.services.FileManager fileManager = currentCase.getServices().getFileManager();
64  List<AbstractFile> recentFiles;
65  try {
66  recentFiles = fileManager.findFiles(dataSource, "%.lnk", "Recent"); //NON-NLS
67  } catch (TskCoreException ex) {
68  logger.log(Level.WARNING, "Error searching for .lnk files."); //NON-NLS
69  this.addErrorMessage(
70  NbBundle.getMessage(this.getClass(), "RecentDocumentsByLnk.getRecDoc.errMsg.errGetLnkFiles",
71  this.getName()));
72  return;
73  }
74 
75  if (recentFiles.isEmpty()) {
76  logger.log(Level.INFO, "Didn't find any recent files."); //NON-NLS
77  return;
78  }
79 
80  dataFound = true;
81  for (AbstractFile recentFile : recentFiles) {
82  if (context.dataSourceIngestIsCancelled()) {
83  break;
84  }
85 
86  if (recentFile.getSize() == 0) {
87  continue;
88  }
89  JLNK lnk;
90  JLnkParser lnkParser = new JLnkParser(new ReadContentInputStream(recentFile), (int) recentFile.getSize());
91  try {
92  lnk = lnkParser.parse();
93  } catch (JLnkParserException e) {
94  //TODO should throw a specific checked exception
95  boolean unalloc = recentFile.isMetaFlagSet(TskData.TSK_FS_META_FLAG_ENUM.UNALLOC)
96  || recentFile.isDirNameFlagSet(TskData.TSK_FS_NAME_FLAG_ENUM.UNALLOC);
97  if (unalloc == false) {
98  logger.log(Level.SEVERE, "Error lnk parsing the file to get recent files" + recentFile, e); //NON-NLS
99  this.addErrorMessage(
100  NbBundle.getMessage(this.getClass(), "RecentDocumentsByLnk.getRecDoc.errParsingFile",
101  this.getName(), recentFile.getName()));
102  }
103  continue;
104  }
105 
106  Collection<BlackboardAttribute> bbattributes = new ArrayList<>();
107  String path = lnk.getBestPath();
108  bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PATH.getTypeID(),
109  NbBundle.getMessage(this.getClass(),
110  "RecentDocumentsByLnk.parentModuleName.noSpace"),
111  path));
112  bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PATH_ID.getTypeID(),
113  NbBundle.getMessage(this.getClass(),
114  "RecentDocumentsByLnk.parentModuleName.noSpace"),
115  Util.findID(dataSource, path)));
116  bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID(),
117  NbBundle.getMessage(this.getClass(),
118  "RecentDocumentsByLnk.parentModuleName.noSpace"),
119  recentFile.getCrtime()));
120  this.addArtifact(ARTIFACT_TYPE.TSK_RECENT_OBJECT, recentFile, bbattributes);
121  }
122  services.fireModuleDataEvent(new ModuleDataEvent(
123  NbBundle.getMessage(this.getClass(), "RecentDocumentsByLnk.parentModuleName"),
125  }
126 
127  @Override
128  public void process(Content dataSource, IngestJobContext context) {
129  this.dataSource = dataSource;
130  this.context = context;
131  dataFound = false;
132  this.getRecentDocuments();
133  }
134 }
synchronized List< AbstractFile > findFiles(Content dataSource, String fileName)

Copyright © 2012-2015 Basis Technology. Generated on: Mon Oct 19 2015
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.