FilesSet.java

Go to the documentation of this file.

/*
 * Autopsy Forensic Browser
 *
 * Copyright 2014 Basis Technology Corp.
 * Contact: carrier <at> sleuthkit <dot> org
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.sleuthkit.autopsy.modules.interestingitems;

import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.UUID;
import java.util.regex.Pattern;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.TskData;

final class FilesSet {

    private final String name;
    private final String description;
    private final boolean ignoreKnownFiles;
    private final Map<String, Rule> rules = new HashMap<>();

    FilesSet(String name, String description, boolean ignoreKnownFiles, Map<String, Rule> rules) {
        if ((name == null) || (name.isEmpty())) {
            throw new IllegalArgumentException("Interesting files set name cannot be null or empty");
        }
        this.name = name;
        this.description = (description != null ? description : "");
        this.ignoreKnownFiles = ignoreKnownFiles;
        if (rules != null) {
            this.rules.putAll(rules);
        }
    }

    String getName() {
        return this.name;
    }

    String getDescription() {
        return this.description;
    }

    boolean ignoresKnownFiles() {
        return this.ignoreKnownFiles;
    }

    Map<String, Rule> getRules() {
        return new HashMap<>(this.rules);
    }

    String fileIsMemberOf(AbstractFile file) {
        if ((this.ignoreKnownFiles) && (file.getKnown() == TskData.FileKnown.KNOWN)) {
            return null;
        }
        for (Rule rule : rules.values()) {
            if (rule.isSatisfied(file)) {
                return rule.getName();
            }
        }
        return null;
    }

    @Override
    public String toString() {
        // This override is designed to provide a display name for use with 
        // javax.swing.DefaultListModel<E>.
        return this.name;
    }

    static class Rule {

        private final String uuid;
        private final String ruleName;
        private final FileNameFilter fileNameFilter;
        private final MetaTypeFilter metaTypeFilter;
        private final ParentPathFilter pathFilter;
        private final List<FileAttributeFilter> filters = new ArrayList<>();

        Rule(String ruleName, FileNameFilter fileNameFilter, MetaTypeFilter metaTypeFilter, ParentPathFilter pathFilter) {
            // since ruleName is optional, ruleUUID can be used to uniquely identify a rule.
            this.uuid = UUID.randomUUID().toString();

            if (ruleName == null) {
                throw new IllegalArgumentException("Interesting files set rule name cannot be null");
            }
            if (fileNameFilter == null) {
                throw new IllegalArgumentException("Interesting files set rule file name filter cannot be null");
            }
            if (metaTypeFilter == null) {
                throw new IllegalArgumentException("Interesting files set rule meta-type filter cannot be null");
            }
            this.ruleName = ruleName;
            
            /* The rules are evaluated in the order added.  MetaType check is fastest, so do it first */
            this.metaTypeFilter = metaTypeFilter;
            this.filters.add(this.metaTypeFilter);
            
            this.fileNameFilter = fileNameFilter;
            this.filters.add(fileNameFilter);
            
            this.pathFilter = pathFilter;
            if (this.pathFilter != null) {
                this.filters.add(this.pathFilter);
            }
        }

        String getName() {
            return ruleName;
        }

        FileNameFilter getFileNameFilter() {
            return this.fileNameFilter;
        }

        MetaTypeFilter getMetaTypeFilter() {
            return this.metaTypeFilter;
        }

        ParentPathFilter getPathFilter() {
            return this.pathFilter;
        }

        boolean isSatisfied(AbstractFile file) {
            for (FileAttributeFilter filter : filters) {
                if (!filter.passes(file)) {
                    return false;
                }
            }
            return true;
        }

        @Override
        public String toString() {
            // This override is designed to provide a display name for use with 
            // javax.swing.DefaultListModel<E>.
            return this.ruleName + " (" + fileNameFilter.getTextToMatch() + ")";
        }

        public String getUuid() {
            return this.uuid;
        }

        static interface FileAttributeFilter {

            boolean passes(AbstractFile file);
        }

        static final class MetaTypeFilter implements FileAttributeFilter {

            enum Type {

                FILES,
                DIRECTORIES,
                FILES_AND_DIRECTORIES
            }

            private final Type type;

            MetaTypeFilter(Type type) {
                this.type = type;
            }

            @Override
            public boolean passes(AbstractFile file) {
                switch (this.type) {
                    case FILES:
                        return file.getMetaType() == TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_REG;
                    case DIRECTORIES:
                        return file.getMetaType() == TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR;
                    default:
                        return file.getMetaType() == TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_REG
                                || file.getMetaType() == TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR;
                }
            }

            Type getMetaType() {
                return this.type;
            }
        }

        static interface TextFilter extends FileAttributeFilter {

            String getTextToMatch();

            boolean isRegex();

            boolean textMatches(String textToMatch);

        }

        private static abstract class AbstractTextFilter implements TextFilter {

            private final TextMatcher textMatcher;

            AbstractTextFilter(String text, Boolean partialMatch) {
                if(partialMatch)
                    this.textMatcher = new FilesSet.Rule.CaseInsensitivePartialStringComparisionMatcher(text);
                else
                    this.textMatcher = new FilesSet.Rule.CaseInsensitiveStringComparisionMatcher(text);
            }

            AbstractTextFilter(Pattern regex) {
                this.textMatcher = new FilesSet.Rule.RegexMatcher(regex);
            }

            @Override
            public String getTextToMatch() {
                return this.textMatcher.getTextToMatch();
            }

            @Override
            public boolean isRegex() {
                return this.textMatcher.isRegex();
            }

            @Override
            public boolean textMatches(String textToMatch) {
                return this.textMatcher.textMatches(textToMatch);
            }

            @Override
            public abstract boolean passes(AbstractFile file);

        }

        static final class ParentPathFilter extends AbstractTextFilter {

            ParentPathFilter(String path) {
                super(path, true);
            }

            ParentPathFilter(Pattern path) {
                super(path);
            }

            @Override
            public boolean passes(AbstractFile file) {
                return this.textMatches(file.getParentPath() + "/");
            }

        }

        static interface FileNameFilter extends TextFilter {
        }

        static final class FullNameFilter extends AbstractTextFilter implements FileNameFilter {

            FullNameFilter(String name) {
                super(name, false);
            }

            FullNameFilter(Pattern name) {
                super(name);
            }

            @Override
            public boolean passes(AbstractFile file) {
                return this.textMatches(file.getName());
            }

        }

        static final class ExtensionFilter extends AbstractTextFilter implements FileNameFilter {

            ExtensionFilter(String extension) {
                // If there is a leading ".", strip it since 
                // AbstractFile.getFileNameExtension() returns just the 
                // extension chars and not the dot.
                super(extension.startsWith(".") ? extension.substring(1) : extension, false);
            }

            ExtensionFilter(Pattern extension) {
                super(extension.pattern(), false);
            }

            @Override
            public boolean passes(AbstractFile file) {
                return this.textMatches(file.getNameExtension());
            }

        }

        private static interface TextMatcher {

            String getTextToMatch();

            boolean isRegex();

            boolean textMatches(String subject);

        }

        private static class CaseInsensitiveStringComparisionMatcher implements TextMatcher {

            private final String textToMatch;

            CaseInsensitiveStringComparisionMatcher(String textToMatch) {
                this.textToMatch = textToMatch;
            }

            @Override
            public String getTextToMatch() {
                return this.textToMatch;
            }

            @Override
            public boolean isRegex() {
                return false;
            }

            @Override
            public boolean textMatches(String subject) {
                return subject.equalsIgnoreCase(textToMatch);
            }

        }

        private static class CaseInsensitivePartialStringComparisionMatcher implements TextMatcher {

            private final String textToMatch;
            private final Pattern pattern;

            CaseInsensitivePartialStringComparisionMatcher(String textToMatch) {
                this.textToMatch = textToMatch;
                this.pattern = Pattern.compile(Pattern.quote(textToMatch), Pattern.CASE_INSENSITIVE);
            }

            @Override
            public String getTextToMatch() {
                return this.textToMatch;
            }

            @Override
            public boolean isRegex() {
                return false;
            }

            @Override
            public boolean textMatches(String subject) {
                return pattern.matcher(subject).find();
            }
        }

        private static class RegexMatcher implements TextMatcher {

            private final Pattern regex;

            RegexMatcher(Pattern regex) {
                this.regex = regex;
            }

            @Override
            public String getTextToMatch() {
                return this.regex.pattern();
            }

            @Override
            public boolean isRegex() {
                return true;
            }

            @Override
            public boolean textMatches(String subject) {
                // A single match is sufficient.
                return this.regex.matcher(subject).find();
            }

        }

    }

}