19 package org.sleuthkit.autopsy.modules.fileextmismatch;
21 import java.util.Collections;
22 import java.util.HashMap;
24 import java.util.logging.Level;
25 import org.openide.util.NbBundle;
26 import org.openide.util.NbBundle.Messages;
40 import org.
sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
50 "CannotRunFileTypeDetection=Unable to run file type detection.",
51 "FileExtMismatchIngestModule.readError.message=Could not read settings."
57 private final FileExtMismatchDetectorModuleSettings
settings;
58 private HashMap<String, Set<String>> mimeTypeToExtsMap =
new HashMap<>();
60 private static final HashMap<Long, IngestJobTotals> totalsForIngestJobs =
new HashMap<>();
67 private long processTime = 0;
68 private long numFiles = 0;
77 private static synchronized void addToTotals(
long ingestJobId,
long processTimeInc) {
79 if (ingestJobTotals == null) {
81 totalsForIngestJobs.put(ingestJobId, ingestJobTotals);
86 totalsForIngestJobs.put(ingestJobId, ingestJobTotals);
90 this.settings = settings;
95 jobId = context.getJobId();
99 mimeTypeToExtsMap = FileExtMismatchSettings.readSettings().getMimeTypeToExtsMap();
101 }
catch (FileExtMismatchSettings.FileExtMismatchSettingsException ex) {
109 @Messages({
"FileExtMismatchIngestModule.indexError.message=Failed to index file extension mismatch artifact for keyword search."})
112 if (this.settings.skipKnownFiles() && (abstractFile.getKnown() == FileKnown.KNOWN)) {
117 if ((abstractFile.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS)
118 || (abstractFile.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS)
119 || (abstractFile.isFile() ==
false)) {
124 if ((abstractFile.isMetaFlagSet(TskData.TSK_FS_META_FLAG_ENUM.UNALLOC))
125 || (abstractFile.isDirNameFlagSet(TskData.TSK_FS_NAME_FLAG_ENUM.UNALLOC))) {
130 long startTime = System.currentTimeMillis();
132 boolean mismatchDetected = compareSigTypeToExt(abstractFile);
134 addToTotals(jobId, System.currentTimeMillis() - startTime);
136 if (mismatchDetected) {
138 BlackboardArtifact bart = abstractFile.newArtifact(ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED);
144 logger.log(Level.SEVERE,
"Unable to index blackboard artifact " + bart.getArtifactID(), ex);
146 Bundle.FileExtMismatchIngestModule_indexError_message(), bart.getDisplayName());
152 }
catch (TskException ex) {
153 logger.log(Level.WARNING,
"Error matching file signature", ex);
166 String currActualExt = abstractFile.getNameExtension();
169 if (settings.skipFilesWithNoExtension() && currActualExt.isEmpty()) {
172 String currActualSigType = detector.
getFileType(abstractFile);
173 if (currActualSigType == null) {
176 if (settings.skipFilesWithTextPlainMimeType()) {
177 if (!currActualExt.isEmpty() && currActualSigType.equals(
"text/plain")) {
183 Set<String> allowedExtSet = mimeTypeToExtsMap.get(currActualSigType);
184 if (allowedExtSet != null) {
186 for (String e : allowedExtSet) {
187 if (e.equals(currActualExt)) {
202 synchronized (
this) {
203 jobTotals = totalsForIngestJobs.remove(jobId);
205 if (jobTotals != null) {
206 StringBuilder detailsSb =
new StringBuilder();
207 detailsSb.append(
"<table border='0' cellpadding='4' width='280'>");
209 detailsSb.append(
"<tr><td>").append(
210 NbBundle.getMessage(
this.getClass(),
"FileExtMismatchIngestModule.complete.totalProcTime"))
211 .append(
"</td><td>").append(jobTotals.
processTime).append(
"</td></tr>\n");
212 detailsSb.append(
"<tr><td>").append(
213 NbBundle.getMessage(
this.getClass(),
"FileExtMismatchIngestModule.complete.totalFiles"))
214 .append(
"</td><td>").append(jobTotals.
numFiles).append(
"</td></tr>\n");
215 detailsSb.append(
"</table>");
218 NbBundle.getMessage(this.getClass(),
219 "FileExtMismatchIngestModule.complete.svcMsg.text"),
220 detailsSb.toString()));
synchronized long decrementAndGet(long jobId)
FileTypeDetector detector
synchronized long incrementAndGet(long jobId)
static IngestMessage createMessage(MessageType messageType, String source, String subject, String detailsHtml)
boolean compareSigTypeToExt(AbstractFile abstractFile)
void postMessage(final IngestMessage message)
void fireModuleDataEvent(ModuleDataEvent moduleDataEvent)
Blackboard getBlackboard()
static void error(String title, String message)
void startUp(IngestJobContext context)
synchronized void indexArtifact(BlackboardArtifact artifact)
final FileExtMismatchDetectorModuleSettings settings
static Case getCurrentCase()
synchronized static Logger getLogger(String name)
String getFileType(AbstractFile file)
ProcessResult process(AbstractFile abstractFile)
static Blackboard blackboard
static synchronized void addToTotals(long ingestJobId, long processTimeInc)
static synchronized IngestServices getInstance()