Autopsy  3.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
BrowserLocationAnalyzer.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2014 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.modules.android;
20 
21 import java.io.File;
22 import java.sql.Connection;
23 import java.sql.DriverManager;
24 import java.sql.ResultSet;
25 import java.sql.SQLException;
26 import java.sql.Statement;
27 import java.util.List;
28 import java.util.logging.Level;
29 
30 import org.openide.util.NbBundle;
41 
45 class BrowserLocationAnalyzer {
46 
47  private static final String moduleName = AndroidModuleFactory.getModuleName();
48  private static final Logger logger = Logger.getLogger(BrowserLocationAnalyzer.class.getName());
49 
50  public static void findGeoLocations(Content dataSource, FileManager fileManager) {
51  try {
52  List<AbstractFile> abstractFiles = fileManager.findFiles(dataSource, "CachedGeoposition%.db"); //NON-NLS
53 
54  for (AbstractFile abstractFile : abstractFiles) {
55  try {
56  if (abstractFile.getSize() == 0) {
57  continue;
58  }
59  File jFile = new File(Case.getCurrentCase().getTempDirectory(), abstractFile.getName());
60  ContentUtils.writeToFile(abstractFile, jFile);
61  findGeoLocationsInDB(jFile.toString(), abstractFile);
62  } catch (Exception e) {
63  logger.log(Level.SEVERE, "Error parsing Browser Location files", e); //NON-NLS
64  }
65  }
66  } catch (TskCoreException e) {
67  logger.log(Level.SEVERE, "Error finding Browser Location files", e); //NON-NLS
68 
69  }
70  }
71 
72  private static void findGeoLocationsInDB(String DatabasePath, AbstractFile f) {
73  Connection connection = null;
74  ResultSet resultSet = null;
75  Statement statement = null;
76  if (DatabasePath == null || DatabasePath.isEmpty()) {
77  return;
78  }
79  try {
80  Class.forName("org.sqlite.JDBC"); //NON-NLS //load JDBC driver
81  connection = DriverManager.getConnection("jdbc:sqlite:" + DatabasePath); //NON-NLS
82  statement = connection.createStatement();
83  } catch (ClassNotFoundException | SQLException e) {
84  logger.log(Level.SEVERE, "Error connecting to sql database", e); //NON-NLS
85  return;
86  }
87 
88  try {
89  resultSet = statement.executeQuery(
90  "Select timestamp, latitude, longitude, accuracy FROM CachedPosition;"); //NON-NLS
91 
92  while (resultSet.next()) {
93  Long timestamp = Long.valueOf(resultSet.getString("timestamp")) / 1000; //NON-NLS
94  double latitude = Double.valueOf(resultSet.getString("latitude")); //NON-NLS
95  double longitude = Double.valueOf(resultSet.getString("longitude")); //NON-NLS
96 
97  BlackboardArtifact bba = f.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_TRACKPOINT);
98  bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE.getTypeID(), moduleName, latitude));
99  bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE.getTypeID(), moduleName, longitude));
100  bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID(), moduleName, timestamp));
101  bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME.getTypeID(), moduleName,
102  NbBundle.getMessage(BrowserLocationAnalyzer.class,
103  "BrowserLocationAnalyzer.bbAttribute.browserLocationHistory")));
104  // bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_VALUE.getTypeID(),moduleName, accuracy));
105  }
106  } catch (Exception e) {
107  logger.log(Level.SEVERE, "Error Putting artifacts to Blackboard", e); //NON-NLS
108  } finally {
109  try {
110  if (resultSet != null) {
111  resultSet.close();
112  }
113  statement.close();
114  connection.close();
115  } catch (Exception e) {
116  logger.log(Level.SEVERE, "Error closing database", e); //NON-NLS
117  }
118  }
119 
120  }
121 }

Copyright © 2012-2015 Basis Technology. Generated on: Mon Oct 19 2015
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.