Autopsy  4.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
TextMessageAnalyzer.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2014 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.modules.iOS;
20 
21 import java.sql.Connection;
22 import java.sql.DriverManager;
23 import java.sql.ResultSet;
24 import java.sql.SQLException;
25 import java.sql.Statement;
26 import java.util.List;
27 import java.util.logging.Level;
28 import org.openide.util.NbBundle;
29 import org.openide.util.NbBundle.Messages;
41 
42 class TextMessageAnalyzer {
43 
44  private Connection connection = null;
45  private ResultSet resultSet = null;
46  private Statement statement = null;
47  private String dbPath = "";
48  private long fileId = 0;
49  private java.io.File jFile = null;
50  List<AbstractFile> absFiles;
51  private String moduleName = iOSModuleFactory.getModuleName();
52  private static final Logger logger = Logger.getLogger(TextMessageAnalyzer.class.getName());
53  private Blackboard blackboard;
54 
55  void findTexts(IngestJobContext context) {
56  blackboard = Case.getCurrentCase().getServices().getBlackboard();
57  try {
58  SleuthkitCase skCase = Case.getCurrentCase().getSleuthkitCase();
59  absFiles = skCase.findAllFilesWhere("name ='mmssms.db'"); //NON-NLS //get exact file name
60  if (absFiles.isEmpty()) {
61  return;
62  }
63  for (AbstractFile AF : absFiles) {
64  try {
65  jFile = new java.io.File(Case.getCurrentCase().getTempDirectory(), AF.getName().replaceAll("[<>%|\"/:*\\\\]", ""));
66  ContentUtils.writeToFile(AF, jFile, context::dataSourceIngestIsCancelled);
67  dbPath = jFile.toString(); //path of file as string
68  fileId = AF.getId();
69  findTextsInDB(dbPath, fileId);
70  } catch (Exception e) {
71  logger.log(Level.SEVERE, "Error parsing text messages", e); //NON-NLS
72  }
73  }
74  } catch (TskCoreException e) {
75  logger.log(Level.SEVERE, "Error finding text messages", e); //NON-NLS
76  }
77  }
78 
79  @Messages({"TextMessageAnalyzer.indexError.message=Failed to index text message artifact for keyword search."})
80  private void findTextsInDB(String DatabasePath, long fId) {
81  if (DatabasePath == null || DatabasePath.isEmpty()) {
82  return;
83  }
84  try {
85  Class.forName("org.sqlite.JDBC"); //NON-NLS //load JDBC driver
86  connection = DriverManager.getConnection("jdbc:sqlite:" + DatabasePath); //NON-NLS
87  statement = connection.createStatement();
88  } catch (ClassNotFoundException | SQLException e) {
89  logger.log(Level.SEVERE, "Error opening database", e); //NON-NLS
90  }
91 
92  Case currentCase = Case.getCurrentCase();
93  SleuthkitCase skCase = currentCase.getSleuthkitCase();
94  try {
95  AbstractFile f = skCase.getAbstractFileById(fId);
96  if (f == null) {
97  logger.log(Level.SEVERE, "Error getting abstract file " + fId); //NON-NLS
98  return;
99  }
100 
101  try {
102  resultSet = statement.executeQuery(
103  "SELECT address,date,type,subject,body FROM sms;"); //NON-NLS
104 
105  BlackboardArtifact bba;
106  String address; // may be phone number, or other addresses
107  String date;//unix time
108  String type; // message received in inbox = 1, message sent = 2
109  String subject;//message subject
110  String body; //message body
111  while (resultSet.next()) {
112  address = resultSet.getString("address"); //NON-NLS
113  date = resultSet.getString("date"); //NON-NLS
114  type = resultSet.getString("type"); //NON-NLS
115  subject = resultSet.getString("subject"); //NON-NLS
116  body = resultSet.getString("body"); //NON-NLS
117 
118  bba = f.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE); //create Message artifact and then add attributes from result set.
119 
120  // @@@ NEed to put into more specific TO or FROM
121  if (type.equals("1")) {
122  bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DIRECTION, moduleName, NbBundle.getMessage(this.getClass(), "TextMessageAnalyzer.bbAttribute.incoming")));
123  bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM, moduleName, address));
124  } else {
125  bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DIRECTION, moduleName, NbBundle.getMessage(this.getClass(), "TextMessageAnalyzer.bbAttribute.outgoing")));
126  bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO, moduleName, address));
127  }
128  bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, moduleName, date));
129  bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DIRECTION, moduleName, type));
130  bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SUBJECT, moduleName, subject));
131  bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT, moduleName, body));
132  bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE, moduleName, NbBundle.getMessage(this.getClass(), "TextMessageAnalyzer.bbAttribute.smsMessage")));
133 
134  try {
135  // index the artifact for keyword search
136  blackboard.indexArtifact(bba);
137  } catch (Blackboard.BlackboardException ex) {
138  logger.log(Level.SEVERE, "Unable to index blackboard artifact " + bba.getArtifactID(), ex); //NON-NLS
139  MessageNotifyUtil.Notify.error(
140  Bundle.TextMessageAnalyzer_indexError_message(), bba.getDisplayName());
141  }
142  }
143 
144  } catch (Exception e) {
145  logger.log(Level.SEVERE, "Error parsing text messages to Blackboard", e); //NON-NLS
146  } finally {
147  try {
148  resultSet.close();
149  statement.close();
150  connection.close();
151  } catch (Exception e) {
152  logger.log(Level.SEVERE, "Error closing database", e); //NON-NLS
153  }
154  }
155  } catch (Exception e) {
156  logger.log(Level.SEVERE, "Error parsing text messages to Blackboard", e); //NON-NLS
157  }
158 
159  }
160 
161 }

Copyright © 2012-2016 Basis Technology. Generated on: Mon Apr 24 2017
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.