19 package org.sleuthkit.autopsy.modules.encryptiondetection;
21 import java.io.IOException;
22 import java.util.Collections;
23 import java.util.List;
24 import java.util.logging.Level;
25 import org.openide.util.NbBundle.Messages;
48 final class EncryptionDetectionDataSourceIngestModule
implements DataSourceIngestModule {
50 private final IngestServices services = IngestServices.getInstance();
51 private final Logger logger = services.getLogger(EncryptionDetectionModuleFactory.getModuleName());
52 private Blackboard blackboard;
53 private double calculatedEntropy;
54 private final double minimumEntropy;
62 EncryptionDetectionDataSourceIngestModule(EncryptionDetectionIngestJobSettings settings) {
63 minimumEntropy = settings.getMinimumEntropy();
67 public void startUp(IngestJobContext context)
throws IngestModule.IngestModuleException {
69 blackboard = Case.getCurrentCase().getServices().getBlackboard();
73 "EncryptionDetectionDataSourceIngestModule.artifactComment.bitlocker=Bitlocker encryption detected.",
74 "EncryptionDetectionDataSourceIngestModule.artifactComment.suspected=Suspected encryption due to high entropy (%f).",
75 "EncryptionDetectionDataSourceIngestModule.processing.message=Checking image for encryption."
78 public ProcessResult process(Content dataSource, DataSourceIngestModuleProgress progressBar) {
83 if (dataSource instanceof Image) {
85 if (((Image) dataSource).getPaths().length == 0) {
86 logger.log(Level.SEVERE, String.format(
"Unable to process data source '%s' - image has no paths", dataSource.getName()));
87 return IngestModule.ProcessResult.ERROR;
90 List<VolumeSystem> volumeSystems = ((Image) dataSource).getVolumeSystems();
91 progressBar.switchToDeterminate(volumeSystems.size());
92 int numVolSystemsChecked = 0;
93 progressBar.progress(Bundle.EncryptionDetectionDataSourceIngestModule_processing_message(), 0);
94 for (VolumeSystem volumeSystem : volumeSystems) {
95 for (Volume volume : volumeSystem.getVolumes()) {
96 if (BitlockerDetection.isBitlockerVolume(volume)) {
97 return flagVolume(volume, BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED, Bundle.EncryptionDetectionDataSourceIngestModule_artifactComment_bitlocker());
99 if (isVolumeEncrypted(volume)) {
100 return flagVolume(volume, BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_SUSPECTED, String.format(Bundle.EncryptionDetectionDataSourceIngestModule_artifactComment_suspected(), calculatedEntropy));
104 numVolSystemsChecked++;
105 progressBar.progress(Bundle.EncryptionDetectionDataSourceIngestModule_processing_message(), numVolSystemsChecked);
108 }
catch (ReadContentInputStream.ReadContentInputStreamException ex) {
109 logger.log(Level.WARNING, String.format(
"Unable to read data source '%s'", dataSource.getName()), ex);
110 return IngestModule.ProcessResult.ERROR;
111 }
catch (IOException | TskCoreException ex) {
112 logger.log(Level.SEVERE, String.format(
"Unable to process data source '%s'", dataSource.getName()), ex);
113 return IngestModule.ProcessResult.ERROR;
116 return IngestModule.ProcessResult.OK;
127 private void validateSettings() throws IngestModule.IngestModuleException {
128 EncryptionDetectionTools.validateMinEntropyValue(minimumEntropy);
141 private IngestModule.ProcessResult flagVolume(Volume volume, BlackboardArtifact.ARTIFACT_TYPE artifactType, String comment) {
143 BlackboardArtifact artifact = volume.newArtifact(artifactType);
144 artifact.addAttribute(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT, EncryptionDetectionModuleFactory.getModuleName(), comment));
150 blackboard.indexArtifact(artifact);
151 }
catch (Blackboard.BlackboardException ex) {
152 logger.log(Level.SEVERE,
"Unable to index blackboard artifact " + artifact.getArtifactID(), ex);
158 services.fireModuleDataEvent(
new ModuleDataEvent(EncryptionDetectionModuleFactory.getModuleName(), artifactType, Collections.singletonList(artifact)));
163 StringBuilder detailsSb =
new StringBuilder(
"");
164 detailsSb.append(
"File: ");
165 Content parentFile = volume.getParent();
166 if (parentFile != null) {
167 detailsSb.append(volume.getParent().getUniquePath());
169 detailsSb.append(volume.getName());
170 if (artifactType.equals(BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_SUSPECTED)) {
171 detailsSb.append(
"<br/>\nEntropy: ").append(calculatedEntropy);
174 services.postMessage(IngestMessage.createDataMessage(EncryptionDetectionModuleFactory.getModuleName(),
175 artifactType.getDisplayName() +
" Match: " + volume.getName(),
176 detailsSb.toString(),
180 return IngestModule.ProcessResult.OK;
181 }
catch (TskCoreException ex) {
182 logger.log(Level.SEVERE, String.format(
"Failed to create blackboard artifact for '%s'.", volume.getName()), ex);
183 return IngestModule.ProcessResult.ERROR;
195 private boolean isVolumeEncrypted(Volume volume)
throws ReadContentInputStream.ReadContentInputStreamException, IOException, TskCoreException {
200 if (volume.getFileSystems().isEmpty()) {
201 calculatedEntropy = EncryptionDetectionTools.calculateEntropy(volume);
202 if (calculatedEntropy >= minimumEntropy) {