23 package org.sleuthkit.autopsy.recentactivity;
25 import java.util.ArrayList;
26 import java.util.List;
27 import java.util.logging.Level;
28 import org.apache.commons.io.FilenameUtils;
29 import org.openide.util.NbBundle;
31 import java.util.Collection;
32 import org.openide.util.NbBundle.Messages;
39 import org.
sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
41 import org.
sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
52 class RecentDocumentsByLnk
extends Extract {
54 private static final Logger logger = Logger.getLogger(RecentDocumentsByLnk.class.getName());
55 private Content dataSource;
56 private IngestJobContext context;
59 "Progress_Message_Extract_Resent_Docs=Recent Documents",
69 private void getRecentDocuments() {
72 List<AbstractFile> recentFiles;
74 recentFiles = fileManager.
findFiles(dataSource,
"%.lnk",
"Recent");
75 }
catch (TskCoreException ex) {
76 logger.log(Level.WARNING,
"Error searching for .lnk files.");
78 NbBundle.getMessage(
this.getClass(),
"RecentDocumentsByLnk.getRecDoc.errMsg.errGetLnkFiles",
83 if (recentFiles.isEmpty()) {
84 logger.log(Level.INFO,
"Didn't find any recent files.");
89 List<BlackboardArtifact> bbartifacts =
new ArrayList<>();
90 for (AbstractFile recentFile : recentFiles) {
91 if (context.dataSourceIngestIsCancelled()) {
95 if (recentFile.getSize() == 0) {
99 JLnkParser lnkParser =
new JLnkParser(
new ReadContentInputStream(recentFile), (
int) recentFile.getSize());
101 lnk = lnkParser.parse();
102 }
catch (JLnkParserException e) {
104 boolean unalloc = recentFile.isMetaFlagSet(TskData.TSK_FS_META_FLAG_ENUM.UNALLOC)
105 || recentFile.isDirNameFlagSet(TskData.TSK_FS_NAME_FLAG_ENUM.UNALLOC);
106 if (unalloc ==
false) {
107 logger.log(Level.WARNING,
"Error lnk parsing the file to get recent files {0}", recentFile);
112 Collection<BlackboardAttribute> bbattributes =
new ArrayList<>();
113 String path = lnk.getBestPath();
114 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PATH,
115 NbBundle.getMessage(
this.getClass(),
116 "RecentDocumentsByLnk.parentModuleName.noSpace"),
118 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PATH_ID,
119 NbBundle.getMessage(
this.getClass(),
120 "RecentDocumentsByLnk.parentModuleName.noSpace"),
121 Util.findID(dataSource, path)));
122 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED,
123 NbBundle.getMessage(
this.getClass(),
124 "RecentDocumentsByLnk.parentModuleName.noSpace"),
125 recentFile.getCrtime()));
127 BlackboardArtifact bba = createArtifactWithAttributes(ARTIFACT_TYPE.TSK_RECENT_OBJECT, recentFile, bbattributes);
129 bbartifacts.add(bba);
130 bba = createAssociatedArtifact(path, bba);
132 bbartifacts.add(bba);
135 }
catch(TskCoreException ex) {
136 logger.log(Level.SEVERE, String.format(
"Failed to create TSK_RECENT_OBJECT artifact for file %d", recentFile.getId()), ex);
140 if (!context.dataSourceIngestIsCancelled()) {
141 postArtifacts(bbartifacts);
154 private BlackboardArtifact createAssociatedArtifact(String filePathName, BlackboardArtifact bba) {
155 String normalizePathName = FilenameUtils.normalize(filePathName,
true);
156 String fileName = FilenameUtils.getName(normalizePathName);
157 String filePath = FilenameUtils.getPath(normalizePathName);
158 List<AbstractFile> sourceFiles;
160 sourceFiles = currentCase.getSleuthkitCase().getFileManager().findFilesExactNameExactPath(dataSource, fileName, filePath);
161 for (AbstractFile sourceFile : sourceFiles) {
162 if (sourceFile.getParentPath().endsWith(filePath)) {
163 return createAssociatedArtifact(sourceFile, bba);
166 }
catch (TskCoreException ex) {
167 logger.log(Level.WARNING, String.format(
"Error finding actual file %s. file may not exist", filePathName), ex);
174 public void process(Content dataSource, IngestJobContext context, DataSourceIngestModuleProgress progressBar) {
175 this.dataSource = dataSource;
176 this.context = context;
179 progressBar.progress(Bundle.Progress_Message_Extract_Resent_Docs());
180 this.getRecentDocuments();
List< AbstractFile > findFiles(String fileName)