Autopsy  4.19.3
Graphical digital forensics platform for The Sleuth Kit and other tools.
EncryptionDetectionFileIngestModule.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2017-2021 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.modules.encryptiondetection;
20 
21 import com.healthmarketscience.jackcess.crypt.CryptCodecProvider;
22 import com.healthmarketscience.jackcess.Database;
23 import com.healthmarketscience.jackcess.DatabaseBuilder;
24 import com.healthmarketscience.jackcess.crypt.InvalidCredentialsException;
25 import com.healthmarketscience.jackcess.impl.CodecProvider;
26 import com.healthmarketscience.jackcess.impl.UnsupportedCodecException;
27 import com.healthmarketscience.jackcess.util.MemFileChannel;
28 import java.io.BufferedInputStream;
29 import java.io.IOException;
30 import java.io.InputStream;
31 import java.util.Arrays;
32 import java.util.logging.Level;
33 import org.apache.tika.exception.EncryptedDocumentException;
34 import org.apache.tika.exception.TikaException;
35 import org.apache.tika.metadata.Metadata;
36 import org.apache.tika.parser.AutoDetectParser;
37 import org.apache.tika.parser.ParseContext;
38 import org.apache.tika.sax.BodyContentHandler;
39 import org.openide.util.NbBundle.Messages;
49 import org.sleuthkit.datamodel.AbstractFile;
50 import org.sleuthkit.datamodel.Blackboard;
51 import org.sleuthkit.datamodel.BlackboardArtifact;
52 import org.sleuthkit.datamodel.BlackboardAttribute;
53 import org.sleuthkit.datamodel.ReadContentInputStream;
54 import org.sleuthkit.datamodel.ReadContentInputStream.ReadContentInputStreamException;
55 import org.sleuthkit.datamodel.Score;
56 import org.sleuthkit.datamodel.TskCoreException;
57 import org.sleuthkit.datamodel.TskData;
58 import org.xml.sax.ContentHandler;
59 import org.xml.sax.SAXException;
60 
64 final class EncryptionDetectionFileIngestModule extends FileIngestModuleAdapter {
65 
66  private static final int FILE_SIZE_MODULUS = 512;
67 
68  private static final String DATABASE_FILE_EXTENSION = "db";
69  private static final int MINIMUM_DATABASE_FILE_SIZE = 65536; //64 KB
70 
71  private static final String MIME_TYPE_OOXML_PROTECTED = "application/x-ooxml-protected";
72  private static final String MIME_TYPE_MSWORD = "application/msword";
73  private static final String MIME_TYPE_MSEXCEL = "application/vnd.ms-excel";
74  private static final String MIME_TYPE_MSPOWERPOINT = "application/vnd.ms-powerpoint";
75  private static final String MIME_TYPE_MSACCESS = "application/x-msaccess";
76  private static final String MIME_TYPE_PDF = "application/pdf";
77 
78  private static final String[] FILE_IGNORE_LIST = {"hiberfile.sys", "pagefile.sys"};
79 
80  private final IngestServices services = IngestServices.getInstance();
81  private final Logger logger = services.getLogger(EncryptionDetectionModuleFactory.getModuleName());
82  private FileTypeDetector fileTypeDetector;
83  private Blackboard blackboard;
84  private IngestJobContext context;
85  private double calculatedEntropy;
86 
87  private final double minimumEntropy;
88  private final int minimumFileSize;
89  private final boolean fileSizeMultipleEnforced;
90  private final boolean slackFilesAllowed;
91 
99  EncryptionDetectionFileIngestModule(EncryptionDetectionIngestJobSettings settings) {
100  minimumEntropy = settings.getMinimumEntropy();
101  minimumFileSize = settings.getMinimumFileSize();
102  fileSizeMultipleEnforced = settings.isFileSizeMultipleEnforced();
103  slackFilesAllowed = settings.isSlackFilesAllowed();
104  }
105 
106  @Override
107  public void startUp(IngestJobContext context) throws IngestModule.IngestModuleException {
108  try {
109  validateSettings();
110  this.context = context;
111  blackboard = Case.getCurrentCaseThrows().getSleuthkitCase().getBlackboard();
112 
113  fileTypeDetector = new FileTypeDetector();
114  } catch (FileTypeDetector.FileTypeDetectorInitException ex) {
115  throw new IngestModule.IngestModuleException("Failed to create file type detector", ex);
116  } catch (NoCurrentCaseException ex) {
117  throw new IngestModule.IngestModuleException("Exception while getting open case.", ex);
118  }
119  }
120 
121  @Messages({
122  "EncryptionDetectionFileIngestModule.artifactComment.suspected=Suspected encryption due to high entropy (%f)."
123  })
124  @Override
125  public IngestModule.ProcessResult process(AbstractFile file) {
126 
127  try {
128  /*
129  * Qualify the file type, qualify it against hash databases, and
130  * verify the file hasn't been deleted.
131  */
132  if (!file.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS)
133  && !file.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS)
134  && !file.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.VIRTUAL_DIR)
135  && !file.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.LOCAL_DIR)
136  && (!file.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.SLACK) || slackFilesAllowed)
137  && !file.getKnown().equals(TskData.FileKnown.KNOWN)
138  && !file.isMetaFlagSet(TskData.TSK_FS_META_FLAG_ENUM.UNALLOC)) {
139  /*
140  * Is the file in FILE_IGNORE_LIST?
141  */
142  String filePath = file.getParentPath();
143  if (filePath.equals("/")) {
144  String fileName = file.getName();
145  for (String listEntry : FILE_IGNORE_LIST) {
146  if (fileName.equalsIgnoreCase(listEntry)) {
147  // Skip this file.
148  return IngestModule.ProcessResult.OK;
149  }
150  }
151  }
152 
153  /*
154  * Qualify the MIME type.
155  */
156  String mimeType = fileTypeDetector.getMIMEType(file);
157  if (mimeType.equals("application/octet-stream") && isFileEncryptionSuspected(file)) {
158  return flagFile(file, BlackboardArtifact.Type.TSK_ENCRYPTION_SUSPECTED, Score.SCORE_LIKELY_NOTABLE,
159  String.format(Bundle.EncryptionDetectionFileIngestModule_artifactComment_suspected(), calculatedEntropy));
160  } else if (isFilePasswordProtected(file)) {
161  return flagFile(file, BlackboardArtifact.Type.TSK_ENCRYPTION_DETECTED, Score.SCORE_NOTABLE,
162  EncryptionDetectionModuleFactory.PASSWORD_PROTECT_MESSAGE);
163  }
164  }
165  } catch (ReadContentInputStreamException | SAXException | TikaException | UnsupportedCodecException ex) {
166  logger.log(Level.WARNING, String.format("Unable to read file '%s'", file.getParentPath() + file.getName()), ex);
167  return IngestModule.ProcessResult.ERROR;
168  } catch (IOException ex) {
169  logger.log(Level.SEVERE, String.format("Unable to process file '%s'", file.getParentPath() + file.getName()), ex);
170  return IngestModule.ProcessResult.ERROR;
171  }
172 
173  return IngestModule.ProcessResult.OK;
174  }
175 
182  private void validateSettings() throws IngestModule.IngestModuleException {
183  EncryptionDetectionTools.validateMinEntropyValue(minimumEntropy);
184  EncryptionDetectionTools.validateMinFileSizeValue(minimumFileSize);
185  }
186 
199  private IngestModule.ProcessResult flagFile(AbstractFile file, BlackboardArtifact.Type artifactType, Score score, String comment) {
200  try {
201  if (context.fileIngestIsCancelled()) {
202  return IngestModule.ProcessResult.OK;
203  }
204 
205  BlackboardArtifact artifact = file.newAnalysisResult(artifactType, score, null, null, comment,
206  Arrays.asList(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT,
207  EncryptionDetectionModuleFactory.getModuleName(), comment)))
208  .getAnalysisResult();
209 
210  try {
211  /*
212  * post the artifact which will index the artifact for keyword
213  * search, and fire an event to notify UI of this new artifact
214  */
215  blackboard.postArtifact(artifact, EncryptionDetectionModuleFactory.getModuleName(), context.getJobId());
216  } catch (Blackboard.BlackboardException ex) {
217  logger.log(Level.SEVERE, "Unable to index blackboard artifact " + artifact.getArtifactID(), ex); //NON-NLS
218  }
219 
220  /*
221  * Make an ingest inbox message.
222  */
223  StringBuilder detailsSb = new StringBuilder();
224  detailsSb.append("File: ").append(file.getParentPath()).append(file.getName());
225  if (artifactType.equals(BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_SUSPECTED)) {
226  detailsSb.append("<br/>\nEntropy: ").append(calculatedEntropy);
227  }
228 
229  services.postMessage(IngestMessage.createDataMessage(EncryptionDetectionModuleFactory.getModuleName(),
230  artifactType.getDisplayName() + " Match: " + file.getName(),
231  detailsSb.toString(),
232  file.getName(),
233  artifact));
234 
235  return IngestModule.ProcessResult.OK;
236  } catch (TskCoreException ex) {
237  logger.log(Level.SEVERE, String.format("Failed to create blackboard artifact for '%s'.", file.getParentPath() + file.getName()), ex); //NON-NLS
238  return IngestModule.ProcessResult.ERROR;
239  }
240  }
241 
261  private boolean isFilePasswordProtected(AbstractFile file) throws ReadContentInputStreamException, IOException, SAXException, TikaException, UnsupportedCodecException {
262 
263  boolean passwordProtected = false;
264 
265  switch (file.getMIMEType()) {
266  case MIME_TYPE_OOXML_PROTECTED:
267  /*
268  * Office Open XML files that are password protected can be
269  * determined so simply by checking the MIME type.
270  */
271  passwordProtected = true;
272  break;
273 
274  case MIME_TYPE_MSWORD:
275  case MIME_TYPE_MSEXCEL:
276  case MIME_TYPE_MSPOWERPOINT:
277  case MIME_TYPE_PDF: {
278  /*
279  * A file of one of these types will be determined to be
280  * password protected or not by attempting to parse it via Tika.
281  */
282  InputStream in = null;
283  BufferedInputStream bin = null;
284 
285  try {
286  in = new ReadContentInputStream(file);
287  bin = new BufferedInputStream(in);
288  ContentHandler handler = new BodyContentHandler(-1);
289  Metadata metadata = new Metadata();
290  metadata.add(Metadata.RESOURCE_NAME_KEY, file.getName());
291  AutoDetectParser parser = new AutoDetectParser();
292  parser.parse(bin, handler, metadata, new ParseContext());
293  } catch (EncryptedDocumentException ex) {
294  /*
295  * File is determined to be password protected.
296  */
297  passwordProtected = true;
298  } finally {
299  if (in != null) {
300  in.close();
301  }
302  if (bin != null) {
303  bin.close();
304  }
305  }
306  break;
307  }
308 
309  case MIME_TYPE_MSACCESS: {
310  /*
311  * Access databases are determined to be password protected
312  * using Jackcess. If the database can be opened, the password
313  * is read from it to see if it's null. If the database can not
314  * be opened due to an InvalidCredentialException being thrown,
315  * it is automatically determined to be password protected.
316  */
317  InputStream in = null;
318  BufferedInputStream bin = null;
319 
320  try {
321  in = new ReadContentInputStream(file);
322  bin = new BufferedInputStream(in);
323  MemFileChannel memFileChannel = MemFileChannel.newChannel(bin);
324  CodecProvider codecProvider = new CryptCodecProvider();
325  DatabaseBuilder databaseBuilder = new DatabaseBuilder();
326  databaseBuilder.setChannel(memFileChannel);
327  databaseBuilder.setCodecProvider(codecProvider);
328  Database accessDatabase;
329  try {
330  accessDatabase = databaseBuilder.open();
331  } catch (InvalidCredentialsException ex) {
332  logger.log(Level.INFO, String.format(
333  "Jackcess throws invalid credentials exception for file (name: %s, id: %s). It will be assumed to be password protected.",
334  file.getName(), file.getId()));
335  return true;
336  } catch (Exception ex) { // Firewall, see JIRA-7097
337  logger.log(Level.WARNING, String.format("Unexpected exception "
338  + "trying to open msaccess database using Jackcess "
339  + "(name: %s, id: %d)", file.getName(), file.getId()), ex);
340  return passwordProtected;
341  }
342  /*
343  * No exception has been thrown at this point, so the file
344  * is either a JET database, or an unprotected ACE database.
345  * Read the password from the database to see if it exists.
346  */
347  if (accessDatabase.getDatabasePassword() != null) {
348  passwordProtected = true;
349  }
350  } catch (InvalidCredentialsException ex) {
351  /*
352  * The ACE database is determined to be password protected.
353  */
354  passwordProtected = true;
355  } finally {
356  if (in != null) {
357  in.close();
358  }
359  if (bin != null) {
360  bin.close();
361  }
362  }
363  }
364  }
365 
366  return passwordProtected;
367  }
368 
384  private boolean isFileEncryptionSuspected(AbstractFile file) throws ReadContentInputStreamException, IOException {
385  /*
386  * Criteria for the checks in this method are partially based on
387  * http://www.forensicswiki.org/wiki/TrueCrypt#Detection
388  */
389 
390  boolean possiblyEncrypted = false;
391 
392  /*
393  * Qualify the size.
394  */
395  boolean fileSizeQualified = false;
396  String fileExtension = file.getNameExtension();
397  long contentSize = file.getSize();
398  // Database files qualify at 64 KB minimum for SQLCipher detection.
399  if (fileExtension.equalsIgnoreCase(DATABASE_FILE_EXTENSION)) {
400  if (contentSize >= MINIMUM_DATABASE_FILE_SIZE) {
401  fileSizeQualified = true;
402  }
403  } else if (contentSize >= minimumFileSize) {
404  if (!fileSizeMultipleEnforced || (contentSize % FILE_SIZE_MODULUS) == 0) {
405  fileSizeQualified = true;
406  }
407  }
408 
409  if (fileSizeQualified) {
410  /*
411  * Qualify the entropy.
412  */
413  calculatedEntropy = EncryptionDetectionTools.calculateEntropy(file, context);
414  if (calculatedEntropy >= minimumEntropy) {
415  possiblyEncrypted = true;
416  }
417  }
418 
419  return possiblyEncrypted;
420  }
421 }

Copyright © 2012-2022 Basis Technology. Generated on: Thu Sep 29 2022
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.