19 package org.sleuthkit.autopsy.modules.filetypeid;
21 import java.util.Arrays;
22 import java.util.HashMap;
23 import java.util.List;
24 import java.util.logging.Level;
25 import org.openide.util.NbBundle;
40 import static org.
sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY;
41 import static org.
sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME;
49 @NbBundle.Messages({
"CannotRunFileTypeDetection=Unable to run file type detection."})
53 private static final HashMap<Long, IngestJobTotals> totalsForIngestJobs =
new HashMap<>();
73 logger.log(Level.SEVERE,
"Failed to create file type detector", ex);
87 jobId = context.getJobId();
104 long startTime = System.currentTimeMillis();
105 String mimeType = fileTypeDetector.
getMIMEType(file);
106 file.setMIMEType(mimeType);
107 FileType fileType = detectUserDefinedFileType(file);
108 if (fileType != null && fileType.shouldCreateInterestingFileHit()) {
109 createInterestingFileHit(file, fileType);
111 addToTotals(jobId, (System.currentTimeMillis() - startTime));
113 }
catch (Exception e) {
114 logger.log(Level.WARNING, String.format(
"Error while attempting to determine file type of file %d", file.getId()), e);
131 if (CustomFileTypesManager.getInstance().getUserDefinedFileTypes().isEmpty()) {
138 byte[] buf =
new byte[1024];
141 bufLen = file.read(buf, 0, 1024);
142 }
catch (TskCoreException ex) {
146 return detectUserDefinedFileType(file, buf, bufLen);
161 private FileType
detectUserDefinedFileType(AbstractFile file, byte[] startOfFileBuffer,
int bufLen)
throws CustomFileTypesManager.CustomFileTypesException {
162 FileType retValue = null;
164 CustomFileTypesManager customFileTypesManager = CustomFileTypesManager.getInstance();
165 List<FileType> fileTypesList = customFileTypesManager.getUserDefinedFileTypes();
166 for (FileType fileType : fileTypesList) {
167 if (fileType.matches(file, startOfFileBuffer, bufLen)) {
184 List<BlackboardAttribute> attributes = Arrays.asList(
185 new BlackboardAttribute(
187 fileType.getInterestingFilesSetName()),
188 new BlackboardAttribute(
190 fileType.getMimeType()));
196 if (!tskBlackboard.artifactExists(file, BlackboardArtifact.Type.TSK_INTERESTING_ITEM, attributes)) {
197 BlackboardArtifact artifact = file.newAnalysisResult(
198 BlackboardArtifact.Type.TSK_INTERESTING_ITEM, Score.SCORE_LIKELY_NOTABLE,
199 null, fileType.getInterestingFilesSetName(), null,
201 .getAnalysisResult();
209 }
catch (Blackboard.BlackboardException ex) {
210 logger.log(Level.SEVERE, String.format(
"Unable to index TSK_INTERESTING_ITEM blackboard artifact %d (file obj_id=%d)", artifact.getArtifactID(), file.getId()), ex);
214 }
catch (TskCoreException ex) {
215 logger.log(Level.SEVERE, String.format(
"Unable to create TSK_INTERESTING_ITEM artifact for file (obj_id=%d)", file.getId()), ex);
217 logger.log(Level.SEVERE,
"Exception while getting open case.", ex);
229 synchronized (
this) {
230 jobTotals = totalsForIngestJobs.remove(jobId);
232 if (jobTotals != null) {
233 StringBuilder detailsSb =
new StringBuilder();
234 detailsSb.append(
"<table border='0' cellpadding='4' width='280'>");
236 detailsSb.append(
"<tr><td>")
237 .append(NbBundle.getMessage(
this.getClass(),
"FileTypeIdIngestModule.complete.totalProcTime"))
238 .append(
"</td><td>").append(jobTotals.matchTime).append(
"</td></tr>\n");
239 detailsSb.append(
"<tr><td>")
240 .append(NbBundle.getMessage(
this.getClass(),
"FileTypeIdIngestModule.complete.totalFiles"))
241 .append(
"</td><td>").append(jobTotals.numFiles).append(
"</td></tr>\n");
242 detailsSb.append(
"</table>");
244 NbBundle.getMessage(this.getClass(),
245 "FileTypeIdIngestModule.complete.srvMsg.text"),
246 detailsSb.toString()));
258 private static synchronized void addToTotals(
long jobId,
long matchTimeInc) {
260 if (ingestJobTotals == null) {
262 totalsForIngestJobs.put(jobId, ingestJobTotals);
265 ingestJobTotals.matchTime += matchTimeInc;
266 ingestJobTotals.numFiles++;
267 totalsForIngestJobs.put(jobId, ingestJobTotals);
synchronized long decrementAndGet(long jobId)
boolean isDetectable(String mimeType)
FileTypeDetector fileTypeDetector
synchronized long incrementAndGet(long jobId)
static IngestMessage createMessage(MessageType messageType, String source, String subject, String detailsHtml)
void startUp(IngestJobContext context)
String getMIMEType(AbstractFile file)
ProcessResult process(AbstractFile file)
void postMessage(final IngestMessage message)
void createInterestingFileHit(AbstractFile file, FileType fileType)
static boolean isMimeTypeDetectable(String mimeType)
SleuthkitCase getSleuthkitCase()
synchronized static Logger getLogger(String name)
FileType detectUserDefinedFileType(AbstractFile file, byte[] startOfFileBuffer, int bufLen)
FileType detectUserDefinedFileType(AbstractFile file)
static Case getCurrentCaseThrows()
static synchronized void addToTotals(long jobId, long matchTimeInc)
static String getModuleName()
static synchronized IngestServices getInstance()