19 package org.sleuthkit.autopsy.recentactivity;
21 import java.io.FileNotFoundException;
22 import java.io.IOException;
23 import java.util.ArrayList;
24 import java.util.Arrays;
25 import java.util.Collection;
26 import java.util.HashSet;
27 import java.util.List;
28 import java.util.Properties;
30 import java.util.logging.Level;
31 import org.openide.util.NbBundle.Messages;
38 import static org.
sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_ASSOCIATED_OBJECT;
39 import static org.
sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD;
41 import static org.
sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT;
42 import static org.
sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID;
52 final class ExtractZoneIdentifier
extends Extract {
54 private static final Logger LOG = Logger.getLogger(ExtractEdge.class.getName());
56 private static final String ZONE_IDENTIFIER_FILE =
"%:Zone.Identifier";
57 private static final String ZONE_IDENTIFIER =
":Zone.Identifier";
60 "ExtractZone_process_errMsg_find=A failure occured while searching for :Zone.Indentifier files.",
61 "ExtractZone_process_errMsg=An error occured processing ':Zone.Indentifier' files.",
62 "ExtractZone_progress_Msg=Extracting :Zone.Identifer files"
66 void process(Content dataSource, IngestJobContext context, DataSourceIngestModuleProgress progressBar) {
68 progressBar.progress(Bundle.ExtractZone_progress_Msg());
70 List<AbstractFile> zoneFiles = null;
72 zoneFiles = currentCase.getServices().getFileManager().findFiles(dataSource, ZONE_IDENTIFIER_FILE);
73 }
catch (TskCoreException ex) {
74 addErrorMessage(Bundle.ExtractZone_process_errMsg_find());
75 LOG.log(Level.SEVERE,
"Unable to find zone identifier files, exception thrown. ", ex);
78 if (zoneFiles == null || zoneFiles.isEmpty()) {
82 Set<Long> knownPathIDs = null;
84 knownPathIDs = getPathIDsForType(TSK_WEB_DOWNLOAD);
85 }
catch (TskCoreException ex) {
86 addErrorMessage(Bundle.ExtractZone_process_errMsg());
87 LOG.log(Level.SEVERE,
"Failed to build PathIDs List for TSK_WEB_DOWNLOAD", ex);
90 if (knownPathIDs == null) {
94 Collection<BlackboardArtifact> associatedObjectArtifacts =
new ArrayList<>();
95 Collection<BlackboardArtifact> downloadArtifacts =
new ArrayList<>();
97 for (AbstractFile zoneFile : zoneFiles) {
99 if (context.dataSourceIngestIsCancelled()) {
104 processZoneFile(context, dataSource, zoneFile, associatedObjectArtifacts, downloadArtifacts, knownPathIDs);
105 }
catch (TskCoreException ex) {
106 addErrorMessage(Bundle.ExtractZone_process_errMsg());
107 String message = String.format(
"Failed to process zone identifier file %s", zoneFile.getName());
108 LOG.log(Level.WARNING, message, ex);
112 postArtifacts(associatedObjectArtifacts);
113 postArtifacts(downloadArtifacts);
127 private void processZoneFile(IngestJobContext context, Content dataSource,
128 AbstractFile zoneFile, Collection<BlackboardArtifact> associatedObjectArtifacts,
129 Collection<BlackboardArtifact> downloadArtifacts,
130 Set<Long> knownPathIDs)
throws TskCoreException {
132 ZoneIdentifierInfo zoneInfo = null;
135 zoneInfo =
new ZoneIdentifierInfo(zoneFile);
136 }
catch (IOException ex) {
137 String message = String.format(
"Unable to parse temporary File for %s", zoneFile.getName());
138 LOG.log(Level.WARNING, message, ex);
141 if (zoneInfo == null) {
145 AbstractFile downloadFile = getDownloadFile(dataSource, zoneFile);
147 if (downloadFile != null) {
149 if (!knownPathIDs.contains(downloadFile.getDataSourceObjectId())) {
152 BlackboardArtifact downloadBba = createDownloadArtifact(zoneFile, zoneInfo, downloadFile);
153 if (downloadBba != null) {
154 downloadArtifacts.add(downloadBba);
156 if (downloadFile.getArtifactsCount(TSK_ASSOCIATED_OBJECT) == 0) {
157 BlackboardArtifact associatedObjectBba = createAssociatedObjectArtifact(downloadFile, downloadBba);
158 if (associatedObjectBba != null) {
159 associatedObjectArtifacts.add(associatedObjectBba);
178 private AbstractFile getDownloadFile(Content dataSource, AbstractFile zoneFile)
throws TskCoreException {
179 AbstractFile downloadFile = null;
182 = currentCase.getServices().getFileManager();
184 String downloadFileName = zoneFile.getName().replace(ZONE_IDENTIFIER,
"");
186 List<AbstractFile> fileList = fileManager.
findFiles(dataSource, downloadFileName, zoneFile.getParentPath());
188 if (fileList.size() == 1) {
189 downloadFile = fileList.get(0);
192 if (!downloadFile.getParentPath().equals(zoneFile.getParentPath())) {
194 }
else if (zoneFile.getMetaAddr() != downloadFile.getMetaAddr()) {
212 private BlackboardArtifact createAssociatedObjectArtifact(AbstractFile downloadFile, BlackboardArtifact downloadBba) {
214 Collection<BlackboardAttribute> bbattributes =
new ArrayList<>();
216 bbattributes.addAll(Arrays.asList(
217 new BlackboardAttribute(TSK_ASSOCIATED_ARTIFACT,
218 RecentActivityExtracterModuleFactory.getModuleName(),
219 downloadBba.getArtifactID())
222 return createArtifactWithAttributes(TSK_ASSOCIATED_OBJECT, downloadFile, bbattributes);
234 private BlackboardArtifact createDownloadArtifact(AbstractFile zoneFile, ZoneIdentifierInfo zoneInfo, AbstractFile downloadFile) {
236 String downloadFilePath = downloadFile.getParentPath() + downloadFile.getName();
238 Collection<BlackboardAttribute> bbattributes = createDownloadAttributes(
239 downloadFilePath, null,
240 zoneInfo.getURL(), null,
241 (zoneInfo.getURL() != null ? NetworkUtils.extractDomain(zoneInfo.getURL()) :
""),
243 if (zoneInfo.getZoneIdAsString() != null) {
244 bbattributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT,
245 RecentActivityExtracterModuleFactory.getModuleName(),
246 zoneInfo.getZoneIdAsString()));
248 return createArtifactWithAttributes(TSK_WEB_DOWNLOAD, zoneFile, bbattributes);
260 private Set<Long> getPathIDsForType(BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException {
261 Set<Long> idList =
new HashSet<>();
262 for (BlackboardArtifact artifact : currentCase.getSleuthkitCase().getBlackboardArtifacts(type)) {
263 BlackboardAttribute pathIDAttribute = artifact.getAttribute(
new BlackboardAttribute.Type(TSK_PATH_ID));
265 if (pathIDAttribute != null) {
266 long contentID = pathIDAttribute.getValueLong();
267 if (contentID != -1) {
268 idList.add(contentID);
276 "ExtractZone_Local_Machine=Local Machine Zone",
277 "ExtractZone_Local_Intranet=Local Intranet Zone",
278 "ExtractZone_Trusted=Trusted Sites Zone",
279 "ExtractZone_Internet=Internet Zone",
280 "ExtractZone_Restricted=Restricted Sites Zone"
293 private static final String ZONE_ID =
"ZoneId";
294 private static final String REFERRER_URL =
"ReferrerUrl";
295 private static final String HOST_URL =
"HostUrl";
296 private static final String FAMILY_NAME =
"LastWriterPackageFamilyName";
299 private final Properties properties =
new Properties(null);
311 fileName = zoneFile.getName();
312 properties.load(
new ReadContentInputStream(zoneFile));
322 String value = properties.getProperty(ZONE_ID);
325 zoneValue = Integer.parseInt(value);
327 }
catch (NumberFormatException ex) {
328 String message = String.format(
"Unable to parse Zone Id for File %s", fileName);
329 LOG.log(Level.WARNING, message);
341 switch (getZoneId()) {
343 return Bundle.ExtractZone_Local_Machine();
345 return Bundle.ExtractZone_Local_Intranet();
347 return Bundle.ExtractZone_Trusted();
349 return Bundle.ExtractZone_Internet();
351 return Bundle.ExtractZone_Restricted();
363 return properties.getProperty(HOST_URL);
372 return properties.getProperty(REFERRER_URL);
381 return properties.getProperty(FAMILY_NAME);
synchronized List< AbstractFile > findFiles(String fileName)