19 package org.sleuthkit.autopsy.modules.android;
22 import java.sql.Connection;
23 import java.sql.DriverManager;
24 import java.sql.ResultSet;
25 import java.sql.SQLException;
26 import java.sql.Statement;
27 import java.util.List;
28 import java.util.logging.Level;
30 import org.openide.util.NbBundle;
46 class BrowserLocationAnalyzer {
48 private static final String moduleName = AndroidModuleFactory.getModuleName();
49 private static final Logger logger = Logger.getLogger(BrowserLocationAnalyzer.class.getName());
50 private static Blackboard blackboard;
52 public static void findGeoLocations(Content dataSource, FileManager fileManager) {
53 blackboard = Case.getCurrentCase().getServices().getBlackboard();
55 List<AbstractFile> abstractFiles = fileManager.findFiles(dataSource,
"CachedGeoposition%.db");
57 for (AbstractFile abstractFile : abstractFiles) {
59 if (abstractFile.getSize() == 0) {
62 File jFile =
new File(Case.getCurrentCase().getTempDirectory(), abstractFile.getName());
63 ContentUtils.writeToFile(abstractFile, jFile);
64 findGeoLocationsInDB(jFile.toString(), abstractFile);
65 }
catch (Exception e) {
66 logger.log(Level.SEVERE,
"Error parsing Browser Location files", e);
69 }
catch (TskCoreException e) {
70 logger.log(Level.SEVERE,
"Error finding Browser Location files", e);
75 private static void findGeoLocationsInDB(String DatabasePath, AbstractFile f) {
76 Connection connection = null;
77 ResultSet resultSet = null;
78 Statement statement = null;
79 if (DatabasePath == null || DatabasePath.isEmpty()) {
83 Class.forName(
"org.sqlite.JDBC");
84 connection = DriverManager.getConnection(
"jdbc:sqlite:" + DatabasePath);
85 statement = connection.createStatement();
86 }
catch (ClassNotFoundException | SQLException e) {
87 logger.log(Level.SEVERE,
"Error connecting to sql database", e);
92 resultSet = statement.executeQuery(
93 "SELECT timestamp, latitude, longitude, accuracy FROM CachedPosition;");
95 while (resultSet.next()) {
96 Long timestamp = Long.valueOf(resultSet.getString(
"timestamp")) / 1000;
97 double latitude = Double.valueOf(resultSet.getString(
"latitude"));
98 double longitude = Double.valueOf(resultSet.getString(
"longitude"));
100 BlackboardArtifact bba = f.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_TRACKPOINT);
101 bba.addAttribute(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE, moduleName, latitude));
102 bba.addAttribute(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE, moduleName, longitude));
103 bba.addAttribute(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, moduleName, timestamp));
104 bba.addAttribute(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME, moduleName,
105 NbBundle.getMessage(BrowserLocationAnalyzer.class,
106 "BrowserLocationAnalyzer.bbAttribute.browserLocationHistory")));
111 blackboard.indexArtifact(bba);
112 }
catch (Blackboard.BlackboardException ex) {
113 logger.log(Level.SEVERE, NbBundle.getMessage(Blackboard.class,
"Blackboard.unableToIndexArtifact.error.msg", bba.getDisplayName()), ex);
114 MessageNotifyUtil.Notify.error(
115 NbBundle.getMessage(Blackboard.class,
"Blackboard.unableToIndexArtifact.exception.msg"), bba.getDisplayName());
118 }
catch (Exception e) {
119 logger.log(Level.SEVERE,
"Error Putting artifacts to Blackboard", e);
122 if (resultSet != null) {
127 }
catch (Exception e) {
128 logger.log(Level.SEVERE,
"Error closing database", e);