19 package org.sleuthkit.autopsy.keywordsearch;
21 import org.openide.util.NbBundle;
23 import java.io.BufferedReader;
24 import java.io.FileInputStream;
25 import java.io.FileNotFoundException;
26 import java.io.IOException;
27 import java.io.InputStreamReader;
28 import java.util.ArrayList;
29 import java.util.Date;
30 import java.util.List;
31 import java.util.logging.Level;
44 class EnCaseKeywordSearchList
extends KeywordSearchList{
46 ArrayList<EncaseFileEntry> entriesUnsorted;
47 EncaseFileEntry rootEntry;
49 public EnCaseKeywordSearchList(String encasePath) {
59 private void doCreateListsFromEntries(EncaseFileEntry entry, String parentPath) {
61 if(parentPath.isEmpty()) {
64 name = parentPath +
"/" + entry.name;
67 List<Keyword> children =
new ArrayList<>();
68 for(EncaseFileEntry child : entry.children) {
71 doCreateListsFromEntries(child, name);
74 if(child.flags.contains(EncaseFlag.pg)) {
77 children.add(
new Keyword(child.value,
true));
82 if(theLists.containsKey(name)) {
84 while(theLists.containsKey(name +
"(" + i +
")")) {
87 name = name +
"(" + i +
")";
90 if (!children.isEmpty()) {
91 KeywordList newList =
new KeywordList(name,
new Date(),
new Date(),
92 true,
true, children);
93 theLists.put(name, newList);
100 private void doCreateEntryStructure(EncaseFileEntry parent) {
101 if (!parent.isFull()) {
102 EncaseFileEntry child = entriesUnsorted.remove(0);
103 child.hasParent =
true;
104 child.parent = parent;
105 parent.addChild(child);
106 if(!child.isFull()) {
107 doCreateEntryStructure(child);
109 if (!parent.isFull()) {
110 doCreateEntryStructure(parent);
113 if (parent.hasParent) {
114 doCreateEntryStructure(parent.parent);
119 public boolean save() {
120 throw new UnsupportedOperationException(
121 NbBundle.getMessage(
this.getClass(),
"KeywordSearchListsEncase.save.exception.msg"));
125 public boolean save(
boolean isExport) {
126 throw new UnsupportedOperationException(
127 NbBundle.getMessage(
this.getClass(),
"KeywordSearchListsEncase.save2.exception.msg"));
131 public boolean load() {
133 BufferedReader readBuffer =
new BufferedReader(
new InputStreamReader(
new FileInputStream(filePath),
"utf-16"));
136 entriesUnsorted =
new ArrayList<>();
137 for(
int line = 1; line < 6; line++) {
138 readBuffer.readLine();
140 while ((structLine = readBuffer.readLine()) != null && (metaLine = readBuffer.readLine()) != null) {
141 String[] structArr = structLine.split(
"\t");
142 String[] metaArr = metaLine.split(
"\t");
143 EncaseMetaType type = EncaseMetaType.getType(metaArr[0]);
144 String childCount = structArr[1];
145 String name = metaArr[1];
146 String value = metaArr[2];
147 ArrayList<EncaseFlag> flags =
new ArrayList<>();
148 for(
int i = 0; i < 17; i++) {
149 if(metaArr.length < i+4) {
152 if(!metaArr[i+3].equals(
"")) {
153 flags.add(EncaseFlag.getFlag(i));
156 entriesUnsorted.add(
new EncaseFileEntry(name, value, Integer.parseInt(childCount),
false, null, type, flags));
158 if (entriesUnsorted.isEmpty()) {
162 this.rootEntry = entriesUnsorted.remove(0);
163 doCreateEntryStructure(this.rootEntry);
164 doCreateListsFromEntries(this.rootEntry,
"");
167 }
catch (FileNotFoundException ex) {
168 logger.log(Level.INFO,
"File at " + filePath +
" does not exist!", ex);
169 }
catch (IOException ex) {
170 logger.log(Level.INFO,
"Failed to read file at " + filePath, ex);
179 if(type.equals(
"5")) {
181 }
else if(type.equals(
"")) {
184 throw new IllegalArgumentException(
185 NbBundle.getMessage(EnCaseKeywordSearchList.class,
186 "KeywordSearchListsEncase.encaseMetaType.exception.msg",
199 pc, pu, pb, p8, p7, pg, an, ph, or, di, um, st,
ww, pr, lo, ta, cp;
213 List<EncaseFileEntry> children;
217 ArrayList<EncaseFlag> flags;
221 this.childCount = childCount;
222 this.children =
new ArrayList<>();
223 this.hasParent = hasParent;
224 this.parent = parent;
229 return children.size() == childCount;
static EncaseFlag getFlag(int i)