19 package org.sleuthkit.datamodel;
21 import java.io.BufferedReader;
22 import java.io.FileReader;
23 import java.io.IOException;
24 import java.text.DateFormat;
25 import java.text.SimpleDateFormat;
26 import java.util.ArrayList;
27 import java.util.Arrays;
28 import java.util.GregorianCalendar;
29 import java.util.HashMap;
30 import java.util.HashSet;
31 import java.util.List;
34 import java.util.TimeZone;
35 import java.util.UUID;
73 private static final Object
cacheLock =
new Object();
85 private static final Map<Long, Map<Long, Long>>
fsHandleCache =
new HashMap<Long, Map<Long, Long>>();
106 fileHandleCache.add(fileHandle);
109 if (fileSystemToFileHandles.containsKey(fsHandle)) {
110 fileSystemToFileHandles.get(fsHandle).add(fileHandle);
112 fileSystemToFileHandles.put(fsHandle,
new ArrayList<Long>(Arrays.asList(fileHandle)));
120 fileHandleCache.remove(fileHandle);
126 return fileHandleCache.contains(fileHandle);
135 for (Map<Long, Long> imageToFsMap : fsHandleCache.values()) {
136 for (Long fsHandle : imageToFsMap.values()) {
138 for (Long fileHandle : fileSystemToFileHandles.get(fsHandle)) {
149 for (Long imageHandle : imageHandleCache.values()) {
153 fsHandleCache.clear();
154 imageHandleCache.clear();
155 fileHandleCache.clear();
156 fileSystemToFileHandles.clear();
217 long addImageInfo(
long deviceObjId, List<String> imageFilePaths, String timeZone)
throws TskCoreException {
220 runOpenAndAddImgNat(tskAutoDbPointer, UUID.randomUUID().toString(), imageFilePaths.toArray(
new String[0]), imageFilePaths.size(), timeZone);
222 }
catch (TskDataException ex) {
223 throw new TskCoreException(
"Error adding image to case database", ex);
243 AddImageProcess initAddImageProcess(String timeZone,
boolean addUnallocSpace,
boolean skipFatFsOrphans, String imageCopyPath) {
244 return new AddImageProcess(timeZone, addUnallocSpace, skipFatFsOrphans, imageCopyPath);
273 private AddImageProcess(String timeZone,
boolean addUnallocSpace,
boolean skipFatFsOrphans, String imageWriterPath) {
278 tskAutoDbPointer = 0;
279 this.isCanceled =
false;
300 long imageHandle = 0;
301 synchronized (
this) {
302 if (0 != tskAutoDbPointer) {
303 throw new TskCoreException(
"Add image process already started");
306 imageHandle =
openImage(imageFilePaths,
false);
309 if (0 == tskAutoDbPointer) {
310 throw new TskCoreException(
"initAddImgNat returned a NULL TskAutoDb pointer");
313 if (imageHandle != 0) {
314 runAddImgNat(tskAutoDbPointer, deviceId, imageHandle, timeZone, imageWriterPath);
327 public synchronized void stop() throws TskCoreException {
329 if (tskAutoDbPointer != 0) {
341 public synchronized void revert() throws TskCoreException {
342 if (tskAutoDbPointer == 0) {
343 throw new TskCoreException(
"AddImgProcess::revert: AutoDB pointer is NULL");
348 tskAutoDbPointer = 0;
360 public synchronized long commit() throws TskCoreException {
361 if (tskAutoDbPointer == 0) {
362 throw new TskCoreException(
"AddImgProcess::commit: AutoDB pointer is NULL");
367 tskAutoDbPointer = 0;
378 return tskAutoDbPointer == 0 ?
"" :
getCurDirNat(tskAutoDbPointer);
398 run(null, imageFilePaths);
415 static CaseDbHandle newCaseDb(String path)
throws TskCoreException {
431 static CaseDbHandle newCaseDb(String databaseName, CaseDbConnectionInfo info)
throws TskCoreException {
432 return new CaseDbHandle(
newCaseDbMultiNat(info.getHost(), info.getPort(), info.getUserName(), info.getPassword(), info.getDbType().ordinal(), databaseName));
446 static CaseDbHandle openCaseDb(String path)
throws TskCoreException {
462 static CaseDbHandle openCaseDb(String databaseName, CaseDbConnectionInfo info)
throws TskCoreException {
463 return new CaseDbHandle(
openCaseDbMultiNat(info.getHost(), info.getPort(), info.getUserName(), info.getPassword(), info.getDbType().ordinal(), databaseName));
492 public static long openImage(String[] imageFiles)
throws TskCoreException {
511 private static long openImage(String[] imageFiles,
boolean useCache)
throws TskCoreException {
515 StringBuilder keyBuilder =
new StringBuilder();
516 for (
int i = 0; i < imageFiles.length; ++i) {
517 keyBuilder.append(imageFiles[i]);
519 final String imageKey = keyBuilder.toString();
534 imageHandle =
openImgNat(imageFiles, imageFiles.length);
554 public static long openVs(
long imgHandle,
long vsOffset)
throws TskCoreException {
570 public static long openVsPart(
long vsHandle,
long volId)
throws TskCoreException {
587 public static long openFs(
long imgHandle,
long fsOffset)
throws TskCoreException {
591 if (imgOffSetToFsHandle.containsKey(fsOffset)) {
593 fsHandle = imgOffSetToFsHandle.get(fsOffset);
595 fsHandle =
openFsNat(imgHandle, fsOffset);
597 imgOffSetToFsHandle.put(fsOffset, fsHandle);
663 public static int readImg(
long imgHandle, byte[] readBuffer,
long offset,
long len)
throws TskCoreException {
665 return readImgNat(imgHandle, readBuffer, offset, len);
682 public static int readVs(
long vsHandle, byte[] readBuffer,
long offset,
long len)
throws TskCoreException {
683 return readVsNat(vsHandle, readBuffer, offset, len);
700 public static int readVsPart(
long volHandle, byte[] readBuffer,
long offset,
long len)
throws TskCoreException {
702 return readVolNat(volHandle, readBuffer, offset, len);
719 public static int readFs(
long fsHandle, byte[] readBuffer,
long offset,
long len)
throws TskCoreException {
721 return readFsNat(fsHandle, readBuffer, offset, len);
757 public static int readFile(
long fileHandle, byte[] readBuffer,
long offset,
long len)
throws TskCoreException {
779 public static int readFileSlack(
long fileHandle, byte[] readBuffer,
long offset,
long len)
throws TskCoreException {
803 java.io.File tmp = java.io.File.createTempFile(
"tsk",
".txt");
807 FileReader fr =
new FileReader(tmp.getAbsolutePath());
808 BufferedReader textReader =
new BufferedReader(fr);
810 List<String> lines =
new ArrayList<String>();
812 String line = textReader.readLine();
822 }
catch (IOException ex) {
823 throw new TskCoreException(
"Error reading istat output: " + ex.getLocalizedMessage());
1029 public static void addToHashDatabase(String filename, String md5, String sha1, String sha256, String comment,
int dbHandle)
throws TskCoreException {
1033 public static void addToHashDatabase(List<HashEntry> hashes,
int dbHandle)
throws TskCoreException {
1037 hashDbAddEntryNat(entry.getFileName(), entry.getMd5Hash(), entry.getSha1Hash(), entry.getSha256Hash(), entry.getComment(), dbHandle);
1040 }
catch (TskCoreException ex) {
1043 }
catch (TskCoreException ex2) {
1069 if (timezoneLongForm == null || timezoneLongForm.isEmpty()) {
1073 String timezoneShortForm;
1074 TimeZone zone = TimeZone.getTimeZone(timezoneLongForm);
1075 int offset = zone.getRawOffset() / 1000;
1076 int hour = offset / 3600;
1077 int min = (offset % 3600) / 60;
1078 DateFormat dfm =
new SimpleDateFormat(
"z");
1079 dfm.setTimeZone(zone);
1080 boolean hasDaylight = zone.useDaylightTime();
1081 String first = dfm.format(
new GregorianCalendar(2010, 1, 1).getTime()).substring(0, 3);
1082 String second = dfm.format(
new GregorianCalendar(2011, 6, 6).getTime()).substring(0, 3);
1083 int mid = hour * -1;
1084 timezoneShortForm = first + Integer.toString(mid);
1086 timezoneShortForm = timezoneShortForm +
":" + (min < 10 ?
"0" :
"") + Integer.toString(min);
1089 timezoneShortForm += second;
1091 return timezoneShortForm;
1149 private static native
long newCaseDbNat(String dbPath)
throws TskCoreException;
1151 private static native
long newCaseDbMultiNat(String hostNameOrIP, String portNumber, String userName, String password,
int dbTypeOrdinal, String databaseName);
1153 private static native
long openCaseDbMultiNat(String hostNameOrIP, String portNumber, String userName, String password,
int dbTypeOrdinal, String databaseName);
1155 private static native
long openCaseDbNat(String path)
throws TskCoreException;
1157 private static native
void closeCaseDbNat(
long db)
throws TskCoreException;
1159 private static native
int hashDbOpenNat(String hashDbPath)
throws TskCoreException;
1161 private static native
int hashDbNewNat(String hashDbPath)
throws TskCoreException;
1169 private static native
int hashDbAddEntryNat(String filename, String hashMd5, String hashSha1, String hashSha256, String comment,
int dbHandle)
throws TskCoreException;
1181 private static native
void hashDbCloseAll() throws TskCoreException;
1183 private static native
void hashDbClose(
int dbHandle) throws TskCoreException;
1189 private static native
boolean hashDbIsIdxOnlyNat(
int dbHandle) throws TskCoreException;
1191 private static native
boolean hashDbLookup(String hash,
int dbHandle) throws TskCoreException;
1195 private static native
long initAddImgNat(
long db, String timezone,
boolean addUnallocSpace,
boolean skipFatFsOrphans) throws TskCoreException;
1197 private static native
long initializeAddImgNat(
long db, String timezone,
boolean addFileSystems,
boolean addUnallocSpace,
boolean skipFatFsOrphans) throws TskCoreException;
1201 private static native
void runAddImgNat(
long process, String deviceId,
long a_img_info, String timeZone, String imageWriterPath) throws TskCoreException, TskDataException;
1203 private static native
void stopAddImgNat(
long process) throws TskCoreException;
1205 private static native
void revertAddImgNat(
long process) throws TskCoreException;
1207 private static native
long commitAddImgNat(
long process) throws TskCoreException;
1209 private static native
long openImgNat(String[] imgPath,
int splits) throws TskCoreException;
1211 private static native
long openVsNat(
long imgHandle,
long vsOffset) throws TskCoreException;
1213 private static native
long openVolNat(
long vsHandle,
long volId) throws TskCoreException;
1215 private static native
long openFsNat(
long imgHandle,
long fsId) throws TskCoreException;
1217 private static native
long openFileNat(
long fsHandle,
long fileId,
int attrType,
int attrId) throws TskCoreException;
1219 private static native
int readImgNat(
long imgHandle, byte[] readBuffer,
long offset,
long len) throws TskCoreException;
1221 private static native
int readVsNat(
long vsHandle, byte[] readBuffer,
long offset,
long len) throws TskCoreException;
1223 private static native
int readVolNat(
long volHandle, byte[] readBuffer,
long offset,
long len) throws TskCoreException;
1225 private static native
int readFsNat(
long fsHandle, byte[] readBuffer,
long offset,
long len) throws TskCoreException;
1227 private static native
int readFileNat(
long fileHandle, byte[] readBuffer,
long offset,
int offset_type,
long len) throws TskCoreException;
1231 private static native
void closeImgNat(
long imgHandle);
1233 private static native
void closeVsNat(
long vsHandle);
1235 private static native
void closeFsNat(
long fsHandle);
1237 private static native
void closeFileNat(
long fileHandle);
1239 private static native
long findDeviceSizeNat(String devicePath) throws TskCoreException;
1241 private static native String
getCurDirNat(
long process);
static native boolean hashDbIsUpdateableNat(int dbHandle)
static int readImg(long imgHandle, byte[] readBuffer, long offset, long len)
static native long commitAddImgNat(long process)
static String getHashDatabaseIndexPath(int dbHandle)
static native void closeVsNat(long vsHandle)
static int readVs(long vsHandle, byte[] readBuffer, long offset, long len)
static void createLookupIndexForHashDatabase(int dbHandle)
static native void startVerboseLoggingNat(String logPath)
static long openImage(String[] imageFiles, boolean useCache)
static void addToHashDatabase(String filename, String md5, String sha1, String sha256, String comment, int dbHandle)
static final Map< String, Long > imageHandleCache
static native int readImgNat(long imgHandle, byte[] readBuffer, long offset, long len)
static int createHashDatabase(String path)
static native String getCurDirNat(long process)
static void closeFs(long fsHandle)
static void cancelFinishImage(long imgHandle)
static native int hashDbRollbackTransactionNat(int dbHandle)
static long openFile(long fsHandle, long fileId, TSK_FS_ATTR_TYPE_ENUM attrType, int attrId)
void run(String deviceId, String[] imageFilePaths)
static int readFile(long fileHandle, byte[] readBuffer, long offset, long len)
static native int hashDbAddEntryNat(String filename, String hashMd5, String hashSha1, String hashSha256, String comment, int dbHandle)
static native int readVsNat(long vsHandle, byte[] readBuffer, long offset, long len)
static native void revertAddImgNat(long process)
static int finishImageWriter(long imgHandle)
static native void runAddImgNat(long process, String deviceId, long a_img_info, String timeZone, String imageWriterPath)
static native void cancelFinishImageNat(long a_img_info)
static native int readFileNat(long fileHandle, byte[] readBuffer, long offset, int offset_type, long len)
static HashHitInfo lookupInHashDatabaseVerbose(String hash, int dbHandle)
static native String getVersionNat()
static native boolean hashDbIndexExistsNat(int dbHandle)
static native long findDeviceSizeNat(String devicePath)
static long openVs(long imgHandle, long vsOffset)
synchronized long commit()
static native int saveFileMetaDataTextNat(long fileHandle, String fileName)
static native boolean hashDbIsIdxOnlyNat(int dbHandle)
static native long openVolNat(long vsHandle, long volId)
volatile long tskAutoDbPointer
static native void closeFsNat(long fsHandle)
static native void hashDbClose(int dbHandle)
static final Map< Long, Map< Long, Long > > fsHandleCache
static int convertSignedToUnsigned(int val)
static native int readFsNat(long fsHandle, byte[] readBuffer, long offset, long len)
static boolean hashDatabaseIsIndexOnly(int dbHandle)
synchronized void revert()
static final Map< Long, List< Long > > fileSystemToFileHandles
static boolean isImageSupported(String imagePath)
static int readVsPart(long volHandle, byte[] readBuffer, long offset, long len)
static boolean loadSleuthkitJNI()
static native HashHitInfo hashDbLookupVerbose(String hash, int dbHandle)
static native int hashDbCommitTransactionNat(int dbHandle)
static native int hashDbOpenNat(String hashDbPath)
static void closeVs(long vsHandle)
static native long newCaseDbNat(String dbPath)
static long openImage(String[] imageFiles)
static native long openImgNat(String[] imgPath, int splits)
final boolean skipFatFsOrphans
static long findDeviceSize(String devPath)
static String getHashDatabaseDisplayName(int dbHandle)
static native long openFileNat(long fsHandle, long fileId, int attrType, int attrId)
static native void closeFileNat(long fileHandle)
static List< String > getFileMetaDataText(long fileHandle)
static void closeImg(long imgHandle)
TSK_FS_FILE_READ_OFFSET_TYPE_ENUM(int val)
static long openFs(long imgHandle, long fsOffset)
final boolean addUnallocSpace
final String imageWriterPath
static native long openVsNat(long imgHandle, long vsOffset)
static native boolean hashDbLookup(String hash, int dbHandle)
void run(String[] imageFilePaths)
static native int readVolNat(long volHandle, byte[] readBuffer, long offset, long len)
static String timezoneLongToShort(String timezoneLongForm)
static void addFileHandle(long fileHandle, long fsHandle)
synchronized String currentDirectory()
static native long newCaseDbMultiNat(String hostNameOrIP, String portNumber, String userName, String password, int dbTypeOrdinal, String databaseName)
static native void hashDbCloseAll()
static int getFinishImageProgress(long imgHandle)
static int openHashDatabase(String path)
static native int hashDbBeginTransactionNat(int dbHandle)
AddImageProcess(String timeZone, boolean addUnallocSpace, boolean skipFatFsOrphans, String imageWriterPath)
static void closeFile(long fileHandle)
static boolean lookupInHashDatabase(String hash, int dbHandle)
static boolean hashDatabaseHasLookupIndex(int dbHandle)
static native long openFsNat(long imgHandle, long fsId)
CaseDbHandle(long caseDbPointer)
static native void closeCaseDbNat(long db)
static native long initAddImgNat(long db, String timezone, boolean addUnallocSpace, boolean skipFatFsOrphans)
static native void runOpenAndAddImgNat(long process, String deviceId, String[] imgPath, int splits, String timezone)
static long openVsPart(long vsHandle, long volId)
static native int finishImageWriterNat(long a_img_info)
static native boolean isImageSupportedNat(String imagePath)
static native int getFinishImageProgressNat(long a_img_info)
static int readFileSlack(long fileHandle, byte[] readBuffer, long offset, long len)
static boolean isUpdateableHashDatabase(int dbHandle)
static native int hashDbNewNat(String hashDbPath)
static void addToHashDatabase(List< HashEntry > hashes, int dbHandle)
static native void stopAddImgNat(long process)
static void closeAllHashDatabases()
static native long initializeAddImgNat(long db, String timezone, boolean addFileSystems, boolean addUnallocSpace, boolean skipFatFsOrphans)
static native void closeImgNat(long imgHandle)
static boolean hashDatabaseCanBeReindexed(int dbHandle)
static final Set< Long > fileHandleCache
static native String hashDbGetDisplayName(int dbHandle)
static native String hashDbIndexPathNat(int dbHandle)
static void closeHandlesAndClearCache()
static String getVersion()
static final String INVALID_FILE_HANDLE
static final Object cacheLock
static native long openCaseDbMultiNat(String hostNameOrIP, String portNumber, String userName, String password, int dbTypeOrdinal, String databaseName)
static void startVerboseLogging(String logPath)
static native void hashDbCreateIndexNat(int dbHandle)
static native String hashDbPathNat(int dbHandle)
static void removeFileHandle(long fileHandle)
static int readFs(long fsHandle, byte[] readBuffer, long offset, long len)
static String getHashDatabasePath(int dbHandle)
static boolean isValidFileHandle(long fileHandle)
static void closeHashDatabase(int dbHandle)
static native long openCaseDbNat(String path)
static native boolean hashDbIsReindexableNat(int dbHandle)