Autopsy  4.21.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
IdxHashSetParser.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011 - 2017 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.modules.hashdatabase;
20 
21 import java.io.BufferedReader;
22 import java.io.File;
23 import java.io.FileReader;
24 import java.io.FileNotFoundException;
25 import java.io.IOException;
26 import java.util.logging.Level;
28 import org.sleuthkit.datamodel.TskCoreException;
29 
34 class IdxHashSetParser implements HashSetParser {
35 
36  private final String filename; // Name of the input file (saved for logging)
37  private BufferedReader reader; // Input file
38  private final long totalHashes; // Estimated number of hashes
39  private boolean doneReading = false; // Flag for if we've hit the end of the file
40 
41  IdxHashSetParser(String filename) throws TskCoreException {
42  this.filename = filename;
43  try {
44  reader = new BufferedReader(new FileReader(filename));
45  } catch (FileNotFoundException ex) {
46  throw new TskCoreException("Error opening file " + filename, ex);
47  }
48 
49  // Estimate the total number of hashes in the file since counting them all can be slow
50  File importFile = new File(filename);
51  long fileSize = importFile.length();
52  totalHashes = fileSize / 0x33 + 1; // IDX file lines are generally 0x33 bytes long. We add one to prevent this from being zero
53  // MD5sum output lines should be close enough to that (0x20 byte hash + filename)
54  }
55 
63  @Override
64  public String getNextHash() throws TskCoreException {
65  String line;
66 
67  try {
68  while ((line = reader.readLine()) != null) {
69 
70  // idx files have a pipe after the hash, md5sum files should have a space
71  String[] parts = line.split("\\|| ");
72 
73  String hashStr = parts[0].toLowerCase();
74  if (!hashStr.matches("^[0-9a-f]{32}$")) {
75  continue;
76  }
77 
78  return hashStr;
79  }
80  } catch (IOException ex) {
81  throw new TskCoreException("Error reading file " + filename, ex);
82  }
83 
84  // We've run out of data
85  doneReading = true;
86  return null;
87  }
88 
94  @Override
95  public boolean doneReading() {
96  return doneReading;
97  }
98 
105  @Override
106  public long getExpectedHashCount() {
107  return totalHashes;
108  }
109 
113  @Override
114  public void close() {
115  try {
116  reader.close();
117  } catch (IOException ex) {
118  Logger.getLogger(IdxHashSetParser.class.getName()).log(Level.SEVERE, "Error closing file " + filename, ex);
119  }
120  }
121 }

Copyright © 2012-2022 Basis Technology. Generated on: Tue Feb 6 2024
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.