Autopsy  4.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
ExifParserFileIngestModule.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011-2015 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.modules.exif;
20 
21 import com.drew.imaging.ImageMetadataReader;
22 import com.drew.imaging.ImageProcessingException;
23 import com.drew.lang.GeoLocation;
24 import com.drew.lang.Rational;
25 import com.drew.metadata.Metadata;
26 import com.drew.metadata.exif.ExifIFD0Directory;
27 import com.drew.metadata.exif.ExifSubIFDDirectory;
28 import com.drew.metadata.exif.GpsDirectory;
29 import java.io.BufferedInputStream;
30 import java.io.IOException;
31 import java.io.InputStream;
32 import java.util.ArrayList;
33 import java.util.Collection;
34 import java.util.Date;
35 import java.util.HashSet;
36 import java.util.List;
37 import java.util.TimeZone;
38 import java.util.concurrent.atomic.AtomicInteger;
39 import java.util.logging.Level;
40 import org.openide.util.NbBundle;
41 import org.openide.util.NbBundle.Messages;
52 import org.sleuthkit.datamodel.AbstractFile;
53 import org.sleuthkit.datamodel.BlackboardArtifact;
54 import org.sleuthkit.datamodel.BlackboardAttribute;
55 import org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
56 import org.sleuthkit.datamodel.Content;
57 import org.sleuthkit.datamodel.Image;
58 import org.sleuthkit.datamodel.ReadContentInputStream;
59 import org.sleuthkit.datamodel.TskCoreException;
60 import org.sleuthkit.datamodel.TskData;
61 import org.sleuthkit.datamodel.TskData.TSK_DB_FILES_TYPE_ENUM;
62 
68 @NbBundle.Messages({
69  "CannotRunFileTypeDetection=Cannot run file type detection."
70 })
71 public final class ExifParserFileIngestModule implements FileIngestModule {
72 
73  private static final Logger logger = Logger.getLogger(ExifParserFileIngestModule.class.getName());
74  private final IngestServices services = IngestServices.getInstance();
75  private final AtomicInteger filesProcessed = new AtomicInteger(0);
76  private volatile boolean filesToFire = false;
77  private final List<BlackboardArtifact> listOfFacesDetectedArtifacts = new ArrayList<>();
78  private long jobId;
79  private static final IngestModuleReferenceCounter refCounter = new IngestModuleReferenceCounter();
81  private final HashSet<String> supportedMimeTypes = new HashSet<>();
82  private TimeZone timeZone = null;
84 
86  supportedMimeTypes.add("audio/x-wav"); //NON-NLS
87  supportedMimeTypes.add("image/jpeg"); //NON-NLS
88  supportedMimeTypes.add("image/tiff"); //NON-NLS
89  }
90 
91  @Override
92  public void startUp(IngestJobContext context) throws IngestModuleException {
93  jobId = context.getJobId();
94  refCounter.incrementAndGet(jobId);
95  try {
96  fileTypeDetector = new FileTypeDetector();
98  throw new IngestModuleException(Bundle.CannotRunFileTypeDetection(), ex);
99  }
100  }
101 
102  @Override
103  public ProcessResult process(AbstractFile content) {
104  blackboard = Case.getCurrentCase().getServices().getBlackboard();
105 
106  //skip unalloc
107  if (content.getType().equals(TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS)) {
108  return ProcessResult.OK;
109  }
110 
111  if (content.isFile() == false) {
112  return ProcessResult.OK;
113  }
114 
115  // skip known
116  if (content.getKnown().equals(TskData.FileKnown.KNOWN)) {
117  return ProcessResult.OK;
118  }
119 
120  // update the tree every 1000 files if we have EXIF data that is not being being displayed
121  final int filesProcessedValue = filesProcessed.incrementAndGet();
122  if ((filesProcessedValue % 1000 == 0)) {
123  if (filesToFire) {
124  services.fireModuleDataEvent(new ModuleDataEvent(ExifParserModuleFactory.getModuleName(), BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF));
125  filesToFire = false;
126  }
127  }
128 
129  //skip unsupported
130  if (!parsableFormat(content)) {
131  return ProcessResult.OK;
132  }
133 
134  return processFile(content);
135  }
136 
137  @Messages({"ExifParserFileIngestModule.indexError.message=Failed to index EXIF Metadata artifact for keyword search."})
138  ProcessResult processFile(AbstractFile f) {
139  InputStream in = null;
140  BufferedInputStream bin = null;
141 
142  try {
143  in = new ReadContentInputStream(f);
144  bin = new BufferedInputStream(in);
145 
146  Collection<BlackboardAttribute> attributes = new ArrayList<>();
147  Metadata metadata = ImageMetadataReader.readMetadata(bin);
148 
149  // Date
150  ExifSubIFDDirectory exifDir = metadata.getFirstDirectoryOfType(ExifSubIFDDirectory.class);
151  if (exifDir != null) {
152 
153  // set the timeZone for the current datasource.
154  if (timeZone == null) {
155  try {
156  Content dataSource = f.getDataSource();
157  if ((dataSource != null) && (dataSource instanceof Image)) {
158  Image image = (Image) dataSource;
159  timeZone = TimeZone.getTimeZone(image.getTimeZone());
160  }
161  } catch (TskCoreException ex) {
162  logger.log(Level.INFO, "Error getting time zones", ex); //NON-NLS
163  }
164  }
165  Date date = exifDir.getDate(ExifSubIFDDirectory.TAG_DATETIME_ORIGINAL, timeZone);
166  if (date != null) {
167  attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME_CREATED, ExifParserModuleFactory.getModuleName(), date.getTime() / 1000));
168  }
169  }
170 
171  // GPS Stuff
172  GpsDirectory gpsDir = metadata.getFirstDirectoryOfType(GpsDirectory.class);
173  if (gpsDir != null) {
174  GeoLocation loc = gpsDir.getGeoLocation();
175  if (loc != null) {
176  double latitude = loc.getLatitude();
177  double longitude = loc.getLongitude();
178  attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_GEO_LATITUDE, ExifParserModuleFactory.getModuleName(), latitude));
179  attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE, ExifParserModuleFactory.getModuleName(), longitude));
180  }
181 
182  Rational altitude = gpsDir.getRational(GpsDirectory.TAG_ALTITUDE);
183  if (altitude != null) {
184  attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE, ExifParserModuleFactory.getModuleName(), altitude.doubleValue()));
185  }
186  }
187 
188  // Device info
189  ExifIFD0Directory devDir = metadata.getFirstDirectoryOfType(ExifIFD0Directory.class);
190  if (devDir != null) {
191  String model = devDir.getString(ExifIFD0Directory.TAG_MODEL);
192  if (model != null && !model.isEmpty()) {
193  attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DEVICE_MODEL, ExifParserModuleFactory.getModuleName(), model));
194  }
195 
196  String make = devDir.getString(ExifIFD0Directory.TAG_MAKE);
197  if (make != null && !make.isEmpty()) {
198  attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DEVICE_MAKE, ExifParserModuleFactory.getModuleName(), make));
199  }
200  }
201 
202  // Add the attributes, if there are any, to a new artifact
203  if (!attributes.isEmpty()) {
204  BlackboardArtifact bba = f.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF);
205  bba.addAttributes(attributes);
206 
207  try {
208  // index the artifact for keyword search
209  blackboard.indexArtifact(bba);
210  } catch (Blackboard.BlackboardException ex) {
211  logger.log(Level.SEVERE, "Unable to index blackboard artifact " + bba.getArtifactID(), ex); //NON-NLS
212  MessageNotifyUtil.Notify.error(
213  Bundle.ExifParserFileIngestModule_indexError_message(), bba.getDisplayName());
214  }
215  filesToFire = true;
216  }
217 
218  return ProcessResult.OK;
219  } catch (TskCoreException ex) {
220  logger.log(Level.WARNING, "Failed to create blackboard artifact for exif metadata ({0}).", ex.getLocalizedMessage()); //NON-NLS
221  return ProcessResult.ERROR;
222  } catch (ImageProcessingException ex) {
223  logger.log(Level.WARNING, "Failed to process the image file: {0}/{1}({2})", new Object[]{f.getParentPath(), f.getName(), ex.getLocalizedMessage()}); //NON-NLS
224  return ProcessResult.ERROR;
225  } catch (IOException ex) {
226  logger.log(Level.WARNING, "IOException when parsing image file: " + f.getParentPath() + "/" + f.getName(), ex); //NON-NLS
227  return ProcessResult.ERROR;
228  } finally {
229  try {
230  if (in != null) {
231  in.close();
232  }
233  if (bin != null) {
234  bin.close();
235  }
236  } catch (IOException ex) {
237  logger.log(Level.WARNING, "Failed to close InputStream.", ex); //NON-NLS
238  return ProcessResult.ERROR;
239  }
240  }
241  }
242 
251  private boolean parsableFormat(AbstractFile f) {
252  try {
253  String mimeType = fileTypeDetector.getFileType(f);
254  if (mimeType != null) {
255  return supportedMimeTypes.contains(mimeType);
256  } else {
257  return false;
258  }
259  } catch (TskCoreException ex) {
260  logger.log(Level.SEVERE, "Failed to detect file type", ex); //NON-NLS
261  return false;
262  }
263  }
264 
265  @Override
266  public void shutDown() {
267  // We only need to check for this final event on the last module per job
268  if (refCounter.decrementAndGet(jobId) == 0) {
269  timeZone = null;
270  if (filesToFire) {
271  //send the final new data event
272  services.fireModuleDataEvent(new ModuleDataEvent(ExifParserModuleFactory.getModuleName(), BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF));
273  }
274  }
275  }
276 }
void fireModuleDataEvent(ModuleDataEvent moduleDataEvent)
synchronized void indexArtifact(BlackboardArtifact artifact)
Definition: Blackboard.java:59
synchronized static Logger getLogger(String name)
Definition: Logger.java:161
static synchronized IngestServices getInstance()

Copyright © 2012-2016 Basis Technology. Generated on: Tue Oct 25 2016
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.