19 package org.sleuthkit.autopsy.modules.vmextractor;
22 import java.io.IOException;
23 import java.nio.file.Files;
24 import java.nio.file.Path;
25 import java.nio.file.Paths;
26 import java.text.SimpleDateFormat;
27 import java.util.ArrayList;
28 import java.util.Calendar;
29 import java.util.HashMap;
30 import java.util.List;
31 import java.util.UUID;
32 import java.util.logging.Level;
33 import org.openide.util.NbBundle;
34 import org.openide.util.NbBundle.Messages;
56 import org.
sleuthkit.datamodel.ReadContentInputStream.ReadContentInputStreamException;
65 @NbBundle.Messages({
"# {0} - output directory name",
"VMExtractorIngestModule.cannotCreateOutputDir.message=Unable to create output directory: {0}."
67 final class VMExtractorIngestModule extends DataSourceIngestModuleAdapter {
69 private static final Logger logger = Logger.getLogger(VMExtractorIngestModule.class.getName());
70 private IngestJobContext context;
71 private Path ingestJobOutputDir;
72 private String parentDeviceId;
73 private String parentTimeZone;
75 private final HashMap<String, String> imageFolderToOutputFolder =
new HashMap<>();
76 private int folderId = 0;
78 @Messages({
"# {0} - data source name",
"deviceIdQueryErrMsg=Data source {0} missing Device ID",
79 "VMExtractorIngestModule.noOpenCase.errMsg=No open case available."})
81 public void startUp(IngestJobContext context)
throws IngestModuleException {
82 this.context = context;
83 long dataSourceObjId = context.getDataSource().getId();
85 Case currentCase = Case.getCurrentCaseThrows();
86 SleuthkitCase caseDb = currentCase.getSleuthkitCase();
87 DataSource dataSource = caseDb.getDataSource(dataSourceObjId);
88 parentDeviceId = dataSource.getDeviceId();
89 parentTimeZone = dataSource.getTimeZone();
90 SimpleDateFormat dateFormat =
new SimpleDateFormat(
"yyyy_MM_dd_HH_mm_ss");
91 String timeStamp = dateFormat.format(Calendar.getInstance().getTime());
92 String ingestJobOutputDirName = context.getDataSource().getName() +
"_" + context.getDataSource().getId() +
"_" + timeStamp;
93 ingestJobOutputDirName = ingestJobOutputDirName.replace(
':',
'_');
94 ingestJobOutputDir = Paths.get(currentCase.getModuleDirectory(), VMExtractorIngestModuleFactory.getModuleName(), ingestJobOutputDirName);
96 Files.createDirectories(ingestJobOutputDir);
97 }
catch (IOException | SecurityException | UnsupportedOperationException ex) {
98 throw new IngestModule.IngestModuleException(Bundle.VMExtractorIngestModule_cannotCreateOutputDir_message(ex.getLocalizedMessage()), ex);
99 }
catch (TskDataException | TskCoreException ex) {
100 throw new IngestModule.IngestModuleException(Bundle.deviceIdQueryErrMsg(context.getDataSource().getName()), ex);
101 }
catch (NoCurrentCaseException ex) {
102 throw new IngestModule.IngestModuleException(Bundle.VMExtractorIngestModule_noOpenCase_errMsg(), ex);
107 public ProcessResult process(Content dataSource, DataSourceIngestModuleProgress progressBar) {
109 String outputFolderForThisVM;
110 List<AbstractFile> vmFiles;
113 progressBar.progress(NbBundle.getMessage(
this.getClass(),
"VMExtractorIngestModule.searchingImage.message"));
115 progressBar.switchToIndeterminate();
117 logger.log(Level.INFO,
"Looking for virtual machine files in data source {0}", dataSource.getName());
121 vmFiles = findVirtualMachineFiles(dataSource);
122 vmFiles = removeNonVMFiles(vmFiles);
123 }
catch (TskCoreException ex) {
124 logger.log(Level.SEVERE,
"Error querying case database", ex);
125 return ProcessResult.ERROR;
126 }
catch (NoCurrentCaseException ex) {
127 logger.log(Level.SEVERE,
"Exception while getting open case.", ex);
128 return ProcessResult.ERROR;
131 if (vmFiles.isEmpty()) {
133 logger.log(Level.INFO,
"No virtual machine files found in data source {0}", dataSource.getName());
134 return ProcessResult.OK;
137 progressBar.switchToDeterminate(vmFiles.size());
138 progressBar.progress(NbBundle.getMessage(
this.getClass(),
"VMExtractorIngestModule.exportingToDisk.message"));
140 int numFilesSaved = 0;
141 for (AbstractFile vmFile : vmFiles) {
142 if (context.dataSourceIngestIsCancelled()) {
146 logger.log(Level.INFO,
"Saving virtual machine file {0} to disk", vmFile.getName());
149 String vmFolderPathInsideTheImage = vmFile.getParentPath();
152 if (imageFolderToOutputFolder.containsKey(vmFolderPathInsideTheImage)) {
154 outputFolderForThisVM = imageFolderToOutputFolder.get(vmFolderPathInsideTheImage);
158 outputFolderForThisVM = Paths.get(ingestJobOutputDir.toString(), Integer.toString(folderId)).toString();
161 imageFolderToOutputFolder.put(vmFolderPathInsideTheImage, outputFolderForThisVM);
166 writeVirtualMachineToDisk(vmFile, outputFolderForThisVM);
167 }
catch (ReadContentInputStreamException ex) {
168 logger.log(Level.WARNING, String.format(
"Failed to read virtual machine file '%s' (id=%d).",
169 vmFile.getName(), vmFile.getId()), ex);
170 MessageNotifyUtil.Notify.error(NbBundle.getMessage(
this.getClass(),
"VMExtractorIngestModule.msgNotify.failedExtractVM.title.txt"),
171 NbBundle.getMessage(
this.getClass(),
"VMExtractorIngestModule.msgNotify.failedExtractVM.msg.txt", vmFile.getName()));
172 }
catch (Exception ex) {
173 logger.log(Level.SEVERE, String.format(
"Failed to write virtual machine file '%s' (id=%d) to folder '%s'.",
174 vmFile.getName(), vmFile.getId(), outputFolderForThisVM), ex);
175 MessageNotifyUtil.Notify.error(NbBundle.getMessage(
this.getClass(),
"VMExtractorIngestModule.msgNotify.failedExtractVM.title.txt"),
176 NbBundle.getMessage(
this.getClass(),
"VMExtractorIngestModule.msgNotify.failedExtractVM.msg.txt", vmFile.getName()));
181 progressBar.progress(NbBundle.getMessage(
this.getClass(),
"VMExtractorIngestModule.exportingToDisk.message"), numFilesSaved);
183 logger.log(Level.INFO,
"Finished saving virtual machine files to disk");
186 progressBar.switchToDeterminate(imageFolderToOutputFolder.size());
187 progressBar.progress(NbBundle.getMessage(
this.getClass(),
"VMExtractorIngestModule.queuingIngestJobs.message"));
189 int numJobsQueued = 0;
191 for (String folder : imageFolderToOutputFolder.values()) {
192 if (context.dataSourceIngestIsCancelled()) {
195 List<String> vmFilesToIngest = VirtualMachineFinder.identifyVirtualMachines(Paths.get(folder));
196 for (String file : vmFilesToIngest) {
198 logger.log(Level.INFO,
"Ingesting virtual machine file {0} in folder {1}",
new Object[]{file, folder});
202 ingestVirtualMachineImage(Paths.get(folder, file));
203 }
catch (InterruptedException ex) {
204 logger.log(Level.INFO,
"Interrupted while ingesting virtual machine file " + file +
" in folder " + folder, ex);
205 }
catch (IOException ex) {
206 logger.log(Level.SEVERE,
"Failed to ingest virtual machine file " + file +
" in folder " + folder, ex);
207 MessageNotifyUtil.Notify.error(NbBundle.getMessage(
this.getClass(),
"VMExtractorIngestModule.msgNotify.failedIngestVM.title.txt"),
208 NbBundle.getMessage(
this.getClass(),
"VMExtractorIngestModule.msgNotify.failedIngestVM.msg.txt", file));
209 }
catch (NoCurrentCaseException ex) {
210 logger.log(Level.SEVERE,
"Exception while getting open case.", ex);
211 MessageNotifyUtil.Notify.error(NbBundle.getMessage(
this.getClass(),
"VMExtractorIngestModule.msgNotify.failedIngestVM.title.txt"),
212 Bundle.VMExtractorIngestModule_noOpenCase_errMsg());
217 progressBar.progress(NbBundle.getMessage(
this.getClass(),
"VMExtractorIngestModule.queuingIngestJobs.message"), numJobsQueued);
219 logger.log(Level.INFO,
"VMExtractorIngestModule completed processing of data source {0}", dataSource.getName());
220 return ProcessResult.OK;
234 private static List<AbstractFile> findVirtualMachineFiles(Content dataSource)
throws TskCoreException, NoCurrentCaseException {
235 List<AbstractFile> vmFiles =
new ArrayList<>();
236 for (String vmExtension : GeneralFilter.VIRTUAL_MACHINE_EXTS) {
237 String searchString =
"%" + vmExtension;
238 vmFiles.addAll(Case.getCurrentCaseThrows().getServices().getFileManager().findFiles(dataSource, searchString));
251 private static List<AbstractFile> removeNonVMFiles(List<AbstractFile> vmFiles) {
252 List<AbstractFile> vFile =
new ArrayList<>();
253 FileTypeDetector fileTypeDetector = null;
254 for (AbstractFile vmFile : vmFiles) {
255 if (vmFile.getNameExtension().equalsIgnoreCase(
"vhd")) {
256 String fileMimeType = vmFile.getMIMEType();
257 if (fileMimeType == null) {
259 fileTypeDetector =
new FileTypeDetector();
260 }
catch (FileTypeDetector.FileTypeDetectorInitException ex) {
261 logger.log(Level.WARNING, String.format(
"Unable to create file type detector for determining MIME type for file %s with id of %d", vmFile.getName(), vmFile.getId()));
265 fileMimeType = fileTypeDetector.getMIMEType(vmFile);
267 vmFile.setMIMEType(fileMimeType);
269 }
catch (TskCoreException ex) {
270 logger.log(Level.WARNING, String.format(
"Unable to save mimetype of %s for file %s with id of %d", fileMimeType, vmFile.getName(), vmFile.getId()));
273 if (fileMimeType.equalsIgnoreCase(
"application/x-vhd")) {
293 private void writeVirtualMachineToDisk(AbstractFile vmFile, String outputFolderForThisVM)
throws ReadContentInputStreamException, IOException {
297 File destinationFolder = Paths.get(outputFolderForThisVM).toFile();
298 if (!destinationFolder.exists()) {
299 destinationFolder.mkdirs();
304 File localFile = Paths.get(outputFolderForThisVM, vmFile.getName()).toFile();
305 ContentUtils.writeToFile(vmFile, localFile, context::dataSourceIngestIsCancelled);
314 private void ingestVirtualMachineImage(Path vmFile)
throws InterruptedException, IOException, NoCurrentCaseException {
319 UUID taskId = UUID.randomUUID();
320 Case.getCurrentCaseThrows().notifyAddingDataSource(taskId);
321 ImageDSProcessor dataSourceProcessor =
new ImageDSProcessor();
322 AddDataSourceCallback dspCallback =
new AddDataSourceCallback(vmFile);
323 synchronized (
this) {
324 dataSourceProcessor.run(parentDeviceId, vmFile.toString(), parentTimeZone,
false,
new AddDataSourceProgressMonitor(), dspCallback);
335 if (!dspCallback.vmDataSources.isEmpty()) {
336 Case.getCurrentCaseThrows().notifyDataSourceAdded(dspCallback.vmDataSources.get(0), taskId);
337 List<Content> dataSourceContent =
new ArrayList<>(dspCallback.vmDataSources);
338 IngestJobSettings ingestJobSettings =
new IngestJobSettings(context.getExecutionContext());
339 for (String warning : ingestJobSettings.getWarnings()) {
340 logger.log(Level.WARNING, String.format(
"Ingest job settings warning for virtual machine file %s : %s", vmFile.toString(), warning));
342 IngestServices.getInstance().postMessage(IngestMessage.createMessage(IngestMessage.MessageType.INFO,
343 VMExtractorIngestModuleFactory.getModuleName(),
344 NbBundle.getMessage(this.getClass(),
"VMExtractorIngestModule.addedVirtualMachineImage.message", vmFile.toString())));
345 IngestManager.getInstance().beginIngestJob(dataSourceContent, ingestJobSettings);
347 Case.getCurrentCaseThrows().notifyFailedAddingDataSource(taskId);
385 this.vmFile = vmFile;
386 vmDataSources =
new ArrayList<>();
391 for (String error : errList) {
392 String logMessage = String.format(
"Data source processor error for virtual machine file %s: %s", vmFile.toString(), error);
394 logger.log(Level.SEVERE, logMessage);
396 logger.log(Level.WARNING, logMessage);
404 if (!content.isEmpty()) {
405 vmDataSources.add(content.get(0));
411 synchronized (VMExtractorIngestModule.this) {
412 VMExtractorIngestModule.this.notify();
418 done(result, errList, newContents);