AddMultipleImagesTask.java

Go to the documentation of this file.

/*
 * Autopsy
 *
 * Copyright 2019 Basis Technology Corp.
 * Contact: carrier <at> sleuthkit <dot> org
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.sleuthkit.autopsy.logicalimager.dsp;

import java.util.ArrayList;
import java.util.List;
import java.util.logging.Level;
import javax.annotation.concurrent.GuardedBy;
import org.openide.util.NbBundle.Messages;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
import org.sleuthkit.autopsy.corecomponentinterfaces.DataSourceProcessorCallback.DataSourceProcessorResult;
import org.sleuthkit.autopsy.corecomponentinterfaces.DataSourceProcessorProgressMonitor;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.datamodel.Content;
import org.sleuthkit.datamodel.Image;
import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.SleuthkitJNI;
import org.sleuthkit.datamodel.TskCoreException;
import org.sleuthkit.datamodel.TskDataException;
import org.sleuthkit.datamodel.TskFileRange;

@Messages({
    "AddMultipleImagesTask.fsTypeUnknownErr=Cannot determine file system type"
})
class AddMultipleImagesTask implements Runnable {

    private static final Logger LOGGER = Logger.getLogger(AddMultipleImagesTask.class.getName());
    public static final String TSK_FS_TYPE_UNKNOWN_ERR_MSG = Bundle.AddMultipleImagesTask_fsTypeUnknownErr();
    private static final long TWO_GB = 2000000000L;
    private final String deviceId;
    private final List<String> imageFilePaths;
    private final String timeZone;
    private final long chunkSize = TWO_GB;
    private final DataSourceProcessorProgressMonitor progressMonitor;
    private final Case currentCase;
    private boolean criticalErrorOccurred;
    private SleuthkitJNI.CaseDbHandle.AddImageProcess addImageProcess = null;
    private List<String> errorMessages = new ArrayList<>();
    private DataSourceProcessorResult result;
    private List<Content> newDataSources = new ArrayList<>();

    /*
     * The cancellation requested flag and SleuthKit add image process are
     * guarded by a lock to synchronize cancelling the process (setting the flag
     * and calling its stop method) and calling either its commit or revert
     * method. 
     */
    private final Object tskAddImageProcessLock;
    @GuardedBy("tskAddImageProcessLock")
    private boolean tskAddImageProcessStopped;

    @Messages({
        "# {0} - file", "AddMultipleImagesTask.addingFileAsLogicalFile=Adding: {0} as an unallocated space file.",
        "# {0} - deviceId", "# {1} - exceptionMessage",
        "AddMultipleImagesTask.errorAddingImgWithoutFileSystem=Error adding images without file systems for device {0}: {1}",})
    AddMultipleImagesTask(String deviceId, List<String> imageFilePaths, String timeZone,
            DataSourceProcessorProgressMonitor progressMonitor) throws NoCurrentCaseException {
        this.deviceId = deviceId;
        this.imageFilePaths = imageFilePaths;
        this.timeZone = timeZone;
        this.progressMonitor = progressMonitor;
        currentCase = Case.getCurrentCaseThrows();
        this.criticalErrorOccurred = false;
        tskAddImageProcessLock = new Object();
    }

    @Messages({
        "AddMultipleImagesTask.cancelled=Cancellation: Add image process reverted",
    })
    @Override
    public void run() {
        errorMessages = new ArrayList<>();
        newDataSources = new ArrayList<>();
        List<Content> emptyDataSources = new ArrayList<>();
        
        /*
         * Try to add the input image files as images.
         */
        List<String> corruptedImageFilePaths = new ArrayList<>();
        try {
            currentCase.getSleuthkitCase().acquireSingleUserCaseWriteLock();
            progressMonitor.setIndeterminate(true);
            for (String imageFilePath : imageFilePaths) {
                synchronized (tskAddImageProcessLock) {
                    if (!tskAddImageProcessStopped) {
                        addImageProcess = currentCase.getSleuthkitCase().makeAddImageProcess(timeZone, false, false, "");
                    } else {
                        return;
                    }
                }
                run(imageFilePath, corruptedImageFilePaths, errorMessages);
                commitOrRevertAddImageProcess(imageFilePath, errorMessages, newDataSources);
                synchronized (tskAddImageProcessLock) {
                    if (tskAddImageProcessStopped) {
                        errorMessages.add(Bundle.AddMultipleImagesTask_cancelled());
                        result = DataSourceProcessorResult.CRITICAL_ERRORS;
                        newDataSources = emptyDataSources;
                        return;
                    }
                }
            }
        } finally {
            currentCase.getSleuthkitCase().releaseSingleUserCaseWriteLock();
        }
    
        /*
         * Try to add any input image files that did not have file systems as a
         * single an unallocated space file with the device id as the root virtual
         * directory name.
         */
        if (!tskAddImageProcessStopped && !corruptedImageFilePaths.isEmpty()) {
            SleuthkitCase caseDatabase;
            caseDatabase = currentCase.getSleuthkitCase();
            try {
                progressMonitor.setProgressText(Bundle.AddMultipleImagesTask_addingFileAsLogicalFile(corruptedImageFilePaths.toString()));

                caseDatabase.acquireSingleUserCaseWriteLock();

                Image dataSource = caseDatabase.addImageInfo(0, corruptedImageFilePaths, timeZone);
                newDataSources.add(dataSource);
                List<TskFileRange> fileRanges = new ArrayList<>();

                long imageSize = dataSource.getSize();
                int sequence = 0;
                //start byte and end byte
                long start = 0;
                if (chunkSize > 0 && imageSize >= TWO_GB) {
                    for (double size = TWO_GB; size < dataSource.getSize(); size += TWO_GB) {
                        fileRanges.add(new TskFileRange(start, TWO_GB, sequence));
                        start += TWO_GB;
                        sequence++;
                    }
                } 
                double leftoverSize = imageSize - sequence * TWO_GB;
                fileRanges.add(new TskFileRange(start, (long)leftoverSize, sequence));

                caseDatabase.addLayoutFiles(dataSource, fileRanges);
            } catch (TskCoreException ex) {
                errorMessages.add(Bundle.AddMultipleImagesTask_errorAddingImgWithoutFileSystem(deviceId, ex.getLocalizedMessage()));
                criticalErrorOccurred = true;
            } finally {
                caseDatabase.releaseSingleUserCaseWriteLock();
            }
        }

        /*
         * This appears to be the best that can be done to indicate completion
         * with the DataSourceProcessorProgressMonitor in its current form.
         */
        progressMonitor.setProgress(0);
        progressMonitor.setProgress(100);

        if (criticalErrorOccurred) {
            result = DataSourceProcessorResult.CRITICAL_ERRORS;
        } else if (!errorMessages.isEmpty()) {
            result = DataSourceProcessorResult.NONCRITICAL_ERRORS;
        } else {
            result = DataSourceProcessorResult.NO_ERRORS;
        }
    }

    void cancelTask() {
        LOGGER.log(Level.WARNING, "AddMultipleImagesTask cancelled, processing may be incomplete"); // NON-NLS
        synchronized (tskAddImageProcessLock) {
            tskAddImageProcessStopped = true;
            if (addImageProcess != null) {
                try {
                    /*
                     * All this does is set a flag that will make the TSK add
                     * image process exit when the flag is checked between
                     * processing steps. The state of the flag is not
                     * accessible, so record it here so that it is known that
                     * the revert method of the process object needs to be
                     * called.
                     */
                    addImageProcess.stop();
                } catch (TskCoreException ex) {
                    LOGGER.log(Level.SEVERE, "Cancellation: addImagePRocess.stop failed", ex); // NON-NLS
                }
            }
        }
    }

    @Messages({
        "# {0} - imageFilePath", "AddMultipleImagesTask.adding=Adding: {0}",
        "# {0} - imageFilePath", "# {1} - deviceId", "# {2} - exceptionMessage", "AddMultipleImagesTask.criticalErrorAdding=Critical error adding {0} for device {1}: {2}",
        "# {0} - imageFilePath", "# {1} - deviceId", "# {2} - exceptionMessage", "AddMultipleImagesTask.criticalErrorReverting=Critical error reverting add image process for {0} for device {1}: {2}",
        "# {0} - imageFilePath", "# {1} - deviceId", "# {2} - exceptionMessage", "AddMultipleImagesTask.nonCriticalErrorAdding=Non-critical error adding {0} for device {1}: {2}",})
    private void run(String imageFilePath, List<String> corruptedImageFilePaths, List<String> errorMessages) {
        /*
         * Try to add the image to the case database as a data source.
         */
        progressMonitor.setProgressText(Bundle.AddMultipleImagesTask_adding(imageFilePath));
        try {
            addImageProcess.run(deviceId, new String[]{imageFilePath});
        } catch (TskCoreException ex) {
            if (ex.getMessage().contains(TSK_FS_TYPE_UNKNOWN_ERR_MSG)) {
                /*
                 * If Sleuth Kit failed to add the image because it did not find
                 * a file system, save the image path so it can be added to the
                 * case as an unallocated space file. All other
                 * errors are critical.
                 */
                corruptedImageFilePaths.add(imageFilePath);
            } else {
                errorMessages.add(Bundle.AddMultipleImagesTask_criticalErrorAdding(imageFilePath, deviceId, ex.getLocalizedMessage()));
                criticalErrorOccurred = true;
            }
        } catch (TskDataException ex) {
            errorMessages.add(Bundle.AddMultipleImagesTask_nonCriticalErrorAdding(imageFilePath, deviceId, ex.getLocalizedMessage()));
        }
    }
    
    private void commitOrRevertAddImageProcess(String imageFilePath, List<String> errorMessages, List<Content> newDataSources) {
        synchronized (tskAddImageProcessLock) {
            if (tskAddImageProcessStopped || criticalErrorOccurred) {
                try {
                    addImageProcess.revert();
                } catch (TskCoreException ex) {
                    errorMessages.add(Bundle.AddMultipleImagesTask_criticalErrorReverting(imageFilePath, deviceId, ex.getLocalizedMessage()));
                    criticalErrorOccurred = true;
                }
                return;
            }
        
            /*
                * Try to commit the results of the add image process, retrieve the new
                * image from the case database, and add it to the list of new data
                * sources to be returned via the getter method.
             */
            try {
                long imageId = addImageProcess.commit();
                Image dataSource = currentCase.getSleuthkitCase().getImageById(imageId);
                newDataSources.add(dataSource);

                /*
                     * Verify the size of the new image. Note that it may not be what is
                     * expected, but at least part of it was added to the case.
                 */
                String verificationError = dataSource.verifyImageSize();
                if (!verificationError.isEmpty()) {
                    errorMessages.add(Bundle.AddMultipleImagesTask_nonCriticalErrorAdding(imageFilePath, deviceId, verificationError));
                }
            } catch (TskCoreException ex) {
                /*
                     * The add image process commit failed or querying the case database
                     * for the newly added image failed. Either way, this is a critical
                     * error.
                 */
                errorMessages.add(Bundle.AddMultipleImagesTask_criticalErrorAdding(imageFilePath, deviceId, ex.getLocalizedMessage()));
                criticalErrorOccurred = true;
            }
        }
    }

    public List<String> getErrorMessages() {
        return errorMessages;
    }

    public DataSourceProcessorResult getResult() {
        return result;
    }

    public List<Content> getNewDataSources() {
        return newDataSources;
    }    
}