19 package org.sleuthkit.autopsy.modules.iOS;
22 import java.io.FileOutputStream;
23 import java.io.IOException;
24 import java.io.InputStream;
25 import java.io.OutputStream;
26 import java.sql.Connection;
27 import java.sql.DriverManager;
28 import java.sql.ResultSet;
29 import java.sql.SQLException;
30 import java.sql.Statement;
31 import java.util.List;
32 import java.util.logging.Level;
33 import org.openide.util.NbBundle;
46 class ContactAnalyzer {
48 private Connection connection = null;
49 private ResultSet resultSet = null;
50 private Statement statement = null;
51 private String dbPath =
"";
52 private long fileId = 0;
53 private java.io.File jFile = null;
54 private String moduleName = iOSModuleFactory.getModuleName();
55 private static final Logger logger = Logger.getLogger(ContactAnalyzer.class.getName());
56 private Blackboard blackboard;
58 public void findContacts() {
60 blackboard = Case.getCurrentCase().getServices().getBlackboard();
61 List<AbstractFile> absFiles;
63 SleuthkitCase skCase = Case.getCurrentCase().getSleuthkitCase();
64 absFiles = skCase.findAllFilesWhere(
"LOWER(name) LIKE LOWER('%call_history%') ");
65 if (absFiles.isEmpty()) {
68 for (AbstractFile AF : absFiles) {
70 jFile =
new java.io.File(Case.getCurrentCase().getTempDirectory(), AF.getName().replaceAll(
"[<>%|\"/:*\\\\]",
""));
72 ContentUtils.writeToFile(AF, jFile);
75 dbPath = jFile.toString();
78 }
catch (Exception e) {
79 logger.log(Level.SEVERE,
"Error parsing Contacts", e);
82 }
catch (TskCoreException e) {
83 logger.log(Level.SEVERE,
"Error finding Contacts", e);
94 private void findContactsInDB(String DatabasePath,
long fId) {
95 if (DatabasePath == null || DatabasePath.isEmpty()) {
99 Class.forName(
"org.sqlite.JDBC");
100 connection = DriverManager.getConnection(
"jdbc:sqlite:" + DatabasePath);
101 statement = connection.createStatement();
102 }
catch (ClassNotFoundException | SQLException e) {
103 logger.log(Level.SEVERE,
"Error opening database", e);
106 Case currentCase = Case.getCurrentCase();
107 SleuthkitCase skCase = currentCase.getSleuthkitCase();
109 AbstractFile f = skCase.getAbstractFileById(fId);
111 logger.log(Level.SEVERE,
"Error getting abstract file " + fId);
118 resultSet = statement.executeQuery(
119 "SELECT mimetype,data1, name_raw_contact.display_name AS display_name \n"
120 +
"FROM raw_contacts JOIN contacts ON (raw_contacts.contact_id=contacts._id) \n"
121 +
"JOIN raw_contacts AS name_raw_contact ON(name_raw_contact_id=name_raw_contact._id) "
122 +
"LEFT OUTER JOIN data ON (data.raw_contact_id=raw_contacts._id) \n"
123 +
"LEFT OUTER JOIN mimetypes ON (data.mimetype_id=mimetypes._id) \n"
124 +
"WHERE mimetype = 'vnd.android.cursor.item/phone_v2' OR mimetype = 'vnd.android.cursor.item/email_v2'\n"
125 +
"ORDER BY name_raw_contact.display_name ASC;");
127 BlackboardArtifact bba;
128 bba = f.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT);
133 while (resultSet.next()) {
134 name = resultSet.getString(
"display_name");
135 data1 = resultSet.getString(
"data1");
136 mimetype = resultSet.getString(
"mimetype");
137 if (name.equals(oldName) ==
false) {
138 bba = f.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT);
139 bba.addAttribute(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME, moduleName, name));
141 if (mimetype.equals(
"vnd.android.cursor.item/phone_v2")) {
142 bba.addAttribute(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER, moduleName, data1));
144 bba.addAttribute(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL, moduleName, data1));
150 blackboard.indexArtifact(bba);
151 }
catch (Blackboard.BlackboardException ex) {
152 logger.log(Level.SEVERE, NbBundle.getMessage(Blackboard.class,
"Blackboard.unableToIndexArtifact.error.msg", bba.getDisplayName()), ex);
153 MessageNotifyUtil.Notify.error(
154 NbBundle.getMessage(Blackboard.class,
"Blackboard.unableToIndexArtifact.exception.msg"), bba.getDisplayName());
158 }
catch (Exception e) {
159 logger.log(Level.SEVERE,
"Error parsing Contacts to Blackboard", e);
165 }
catch (Exception e) {
166 logger.log(Level.SEVERE,
"Error closing database", e);
169 }
catch (Exception e) {
170 logger.log(Level.SEVERE,
"Error parsing Contacts to Blackboard", e);
175 public static void copyFileUsingStream(AbstractFile file, File jFile)
throws IOException {
176 InputStream is =
new ReadContentInputStream(file);
177 OutputStream os =
new FileOutputStream(jFile);
178 byte[] buffer =
new byte[8192];
181 while ((length = is.read(buffer)) != -1) {
182 os.write(buffer, 0, length);
183 System.out.println(length);
194 public static void copyFileUsingStreams(AbstractFile file, File jFile) {
196 OutputStream ostream = null;
199 istream =
new ReadContentInputStream(file);
201 ostream =
new FileOutputStream(jFile);
202 while ((c = istream.read()) != EOF) {
205 }
catch (IOException e) {
206 System.out.println(
"Error: " + e.getMessage());
211 }
catch (IOException e) {
212 System.out.println(
"File did not close");