23 package org.sleuthkit.autopsy.recentactivity;
25 import java.util.ArrayList;
26 import java.util.List;
27 import java.util.logging.Level;
29 import org.openide.util.NbBundle;
31 import java.util.Collection;
32 import org.openide.util.NbBundle.Messages;
41 import org.
sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
43 import org.
sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
51 class RecentDocumentsByLnk
extends Extract {
53 private static final Logger logger = Logger.getLogger(RecentDocumentsByLnk.class.getName());
54 private IngestServices services = IngestServices.getInstance();
55 private Content dataSource;
56 private IngestJobContext context;
59 "Progress_Message_Extract_Resent_Docs=Recent Documents",
69 private void getRecentDocuments() {
72 List<AbstractFile> recentFiles;
74 recentFiles = fileManager.
findFiles(dataSource,
"%.lnk",
"Recent");
75 }
catch (TskCoreException ex) {
76 logger.log(Level.WARNING,
"Error searching for .lnk files.");
78 NbBundle.getMessage(
this.getClass(),
"RecentDocumentsByLnk.getRecDoc.errMsg.errGetLnkFiles",
83 if (recentFiles.isEmpty()) {
84 logger.log(Level.INFO,
"Didn't find any recent files.");
89 for (AbstractFile recentFile : recentFiles) {
90 if (context.dataSourceIngestIsCancelled()) {
94 if (recentFile.getSize() == 0) {
98 JLnkParser lnkParser =
new JLnkParser(
new ReadContentInputStream(recentFile), (
int) recentFile.getSize());
100 lnk = lnkParser.parse();
101 }
catch (JLnkParserException e) {
103 boolean unalloc = recentFile.isMetaFlagSet(TskData.TSK_FS_META_FLAG_ENUM.UNALLOC)
104 || recentFile.isDirNameFlagSet(TskData.TSK_FS_NAME_FLAG_ENUM.UNALLOC);
105 if (unalloc ==
false) {
106 logger.log(Level.WARNING,
"Error lnk parsing the file to get recent files {0}", recentFile);
111 Collection<BlackboardAttribute> bbattributes =
new ArrayList<>();
112 String path = lnk.getBestPath();
113 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PATH,
114 NbBundle.getMessage(
this.getClass(),
115 "RecentDocumentsByLnk.parentModuleName.noSpace"),
117 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PATH_ID,
118 NbBundle.getMessage(
this.getClass(),
119 "RecentDocumentsByLnk.parentModuleName.noSpace"),
120 Util.findID(dataSource, path)));
121 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME,
122 NbBundle.getMessage(
this.getClass(),
123 "RecentDocumentsByLnk.parentModuleName.noSpace"),
124 recentFile.getCrtime()));
125 this.addArtifact(ARTIFACT_TYPE.TSK_RECENT_OBJECT, recentFile, bbattributes);
127 services.fireModuleDataEvent(
new ModuleDataEvent(
128 NbBundle.getMessage(
this.getClass(),
"RecentDocumentsByLnk.parentModuleName"),
129 BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT));
133 public void process(Content dataSource, IngestJobContext context, DataSourceIngestModuleProgress progressBar) {
134 this.dataSource = dataSource;
135 this.context = context;
138 progressBar.progress(Bundle.Progress_Message_Extract_Resent_Docs());
139 this.getRecentDocuments();
synchronized List< AbstractFile > findFiles(String fileName)