Autopsy  4.18.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
RecentDocumentsByLnk.java
Go to the documentation of this file.
1  /*
2  *
3  * Autopsy Forensic Browser
4  *
5  * Copyright 2012-2021 Basis Technology Corp.
6  *
7  * Copyright 2012 42six Solutions.
8  * Contact: aebadirad <at> 42six <dot> com
9  * Project Contact/Architect: carrier <at> sleuthkit <dot> org
10  *
11  * Licensed under the Apache License, Version 2.0 (the "License");
12  * you may not use this file except in compliance with the License.
13  * You may obtain a copy of the License at
14  *
15  * http://www.apache.org/licenses/LICENSE-2.0
16  *
17  * Unless required by applicable law or agreed to in writing, software
18  * distributed under the License is distributed on an "AS IS" BASIS,
19  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
20  * See the License for the specific language governing permissions and
21  * limitations under the License.
22  */
23 package org.sleuthkit.autopsy.recentactivity;
24 
25 import java.util.ArrayList;
26 import java.util.List;
27 import java.util.logging.Level;
28 import org.apache.commons.io.FilenameUtils;
29 import org.openide.util.NbBundle;
31 import java.util.Collection;
32 import org.openide.util.NbBundle.Messages;
38 import org.sleuthkit.datamodel.BlackboardArtifact;
39 import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
40 import org.sleuthkit.datamodel.BlackboardAttribute;
41 import org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
42 import org.sleuthkit.datamodel.Content;
43 import org.sleuthkit.datamodel.TskCoreException;
44 import org.sleuthkit.datamodel.AbstractFile;
45 import org.sleuthkit.datamodel.ReadContentInputStream;
46 import org.sleuthkit.datamodel.TskData;
47 
52 class RecentDocumentsByLnk extends Extract {
53 
54  private static final Logger logger = Logger.getLogger(RecentDocumentsByLnk.class.getName());
55  private Content dataSource;
56  private IngestJobContext context;
57 
58  @Messages({
59  "Progress_Message_Extract_Resent_Docs=Recent Documents",
60  })
61 
69  private void getRecentDocuments() {
70 
71  org.sleuthkit.autopsy.casemodule.services.FileManager fileManager = currentCase.getServices().getFileManager();
72  List<AbstractFile> recentFiles;
73  try {
74  recentFiles = fileManager.findFiles(dataSource, "%.lnk", "Recent"); //NON-NLS
75  } catch (TskCoreException ex) {
76  logger.log(Level.WARNING, "Error searching for .lnk files."); //NON-NLS
77  this.addErrorMessage(
78  NbBundle.getMessage(this.getClass(), "RecentDocumentsByLnk.getRecDoc.errMsg.errGetLnkFiles",
79  this.getName()));
80  return;
81  }
82 
83  if (recentFiles.isEmpty()) {
84  logger.log(Level.INFO, "Didn't find any recent files."); //NON-NLS
85  return;
86  }
87 
88  dataFound = true;
89  List<BlackboardArtifact> bbartifacts = new ArrayList<>();
90  for (AbstractFile recentFile : recentFiles) {
91  if (context.dataSourceIngestIsCancelled()) {
92  break;
93  }
94 
95  if (recentFile.getSize() == 0) {
96  continue;
97  }
98  JLNK lnk;
99  JLnkParser lnkParser = new JLnkParser(new ReadContentInputStream(recentFile), (int) recentFile.getSize());
100  try {
101  lnk = lnkParser.parse();
102  } catch (JLnkParserException e) {
103  //TODO should throw a specific checked exception
104  boolean unalloc = recentFile.isMetaFlagSet(TskData.TSK_FS_META_FLAG_ENUM.UNALLOC)
105  || recentFile.isDirNameFlagSet(TskData.TSK_FS_NAME_FLAG_ENUM.UNALLOC);
106  if (unalloc == false) {
107  logger.log(Level.WARNING, "Error lnk parsing the file to get recent files {0}", recentFile); //NON-NLS
108  }
109  continue;
110  }
111 
112  Collection<BlackboardAttribute> bbattributes = new ArrayList<>();
113  String path = lnk.getBestPath();
114  bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PATH,
115  NbBundle.getMessage(this.getClass(),
116  "RecentDocumentsByLnk.parentModuleName.noSpace"),
117  path));
118  bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PATH_ID,
119  NbBundle.getMessage(this.getClass(),
120  "RecentDocumentsByLnk.parentModuleName.noSpace"),
121  Util.findID(dataSource, path)));
122  bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED,
123  NbBundle.getMessage(this.getClass(),
124  "RecentDocumentsByLnk.parentModuleName.noSpace"),
125  recentFile.getCrtime()));
126  try{
127  BlackboardArtifact bba = createArtifactWithAttributes(ARTIFACT_TYPE.TSK_RECENT_OBJECT, recentFile, bbattributes);
128  if(bba != null) {
129  bbartifacts.add(bba);
130  bba = createAssociatedArtifact(path, bba);
131  if (bba != null) {
132  bbartifacts.add(bba);
133  }
134  }
135  } catch(TskCoreException ex) {
136  logger.log(Level.SEVERE, String.format("Failed to create TSK_RECENT_OBJECT artifact for file %d", recentFile.getId()), ex);
137  }
138  }
139 
140  if (!context.dataSourceIngestIsCancelled()) {
141  postArtifacts(bbartifacts);
142  }
143  }
144 
154  private BlackboardArtifact createAssociatedArtifact(String filePathName, BlackboardArtifact bba) {
155  String normalizePathName = FilenameUtils.normalize(filePathName, true);
156  String fileName = FilenameUtils.getName(normalizePathName);
157  String filePath = FilenameUtils.getPath(normalizePathName);
158  List<AbstractFile> sourceFiles;
159  try {
160  sourceFiles = currentCase.getSleuthkitCase().getFileManager().findFilesExactNameExactPath(dataSource, fileName, filePath);
161  for (AbstractFile sourceFile : sourceFiles) {
162  if (sourceFile.getParentPath().endsWith(filePath)) {
163  return createAssociatedArtifact(sourceFile, bba);
164  }
165  }
166  } catch (TskCoreException ex) {
167  logger.log(Level.WARNING, String.format("Error finding actual file %s. file may not exist", filePathName), ex); //NON-NLS
168  }
169 
170  return null;
171  }
172 
173  @Override
174  public void process(Content dataSource, IngestJobContext context, DataSourceIngestModuleProgress progressBar) {
175  this.dataSource = dataSource;
176  this.context = context;
177  dataFound = false;
178 
179  progressBar.progress(Bundle.Progress_Message_Extract_Resent_Docs());
180  this.getRecentDocuments();
181  }
182 }
List< AbstractFile > findFiles(String fileName)

Copyright © 2012-2021 Basis Technology. Generated on: Thu Jul 8 2021
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.