ImageDSProcessor.java

Go to the documentation of this file.

/*
 * Autopsy Forensic Browser
 *
 * Copyright 2013-2021 Basis Technology Corp.
 * Contact: carrier <at> sleuthkit <dot> org
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.sleuthkit.autopsy.casemodule;

import java.io.File;
import java.nio.file.Path;
import javax.swing.JPanel;
import java.util.ArrayList;
import java.util.Calendar;
import java.util.List;
import java.util.logging.Level;
import java.util.UUID;
import javax.swing.filechooser.FileFilter;
import org.openide.util.NbBundle;
import org.openide.util.lookup.ServiceProvider;
import org.openide.util.lookup.ServiceProviders;
import org.sleuthkit.autopsy.corecomponentinterfaces.DataSourceProcessorProgressMonitor;
import org.sleuthkit.autopsy.corecomponentinterfaces.DataSourceProcessorCallback;
import org.sleuthkit.autopsy.corecomponentinterfaces.DataSourceProcessor;
import org.sleuthkit.autopsy.coreutils.DataSourceUtils;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.datasourceprocessors.AutoIngestDataSourceProcessor;
import org.sleuthkit.autopsy.ingest.IngestJobSettings;
import org.sleuthkit.autopsy.ingest.IngestManager;
import org.sleuthkit.autopsy.ingest.IngestStream;
import org.sleuthkit.datamodel.Host;
import org.sleuthkit.datamodel.Image;
import org.sleuthkit.datamodel.SleuthkitJNI;
import org.sleuthkit.datamodel.TskCoreException;

@ServiceProviders(value = {
    @ServiceProvider(service = DataSourceProcessor.class),
    @ServiceProvider(service = AutoIngestDataSourceProcessor.class)}
)
public class ImageDSProcessor implements DataSourceProcessor, AutoIngestDataSourceProcessor {

    private final static String DATA_SOURCE_TYPE = NbBundle.getMessage(ImageDSProcessor.class, "ImageDSProcessor.dsType.text");
    private final Logger logger = Logger.getLogger(ImageDSProcessor.class.getName());
    private static final List<String> allExt = new ArrayList<>();
    private static final GeneralFilter rawFilter = new GeneralFilter(GeneralFilter.RAW_IMAGE_EXTS, GeneralFilter.RAW_IMAGE_DESC);
    private static final GeneralFilter encaseFilter = new GeneralFilter(GeneralFilter.ENCASE_IMAGE_EXTS, GeneralFilter.ENCASE_IMAGE_DESC);
    private static final GeneralFilter virtualMachineFilter = new GeneralFilter(GeneralFilter.VIRTUAL_MACHINE_EXTS, GeneralFilter.VIRTUAL_MACHINE_DESC);
    private static final String ALL_DESC = NbBundle.getMessage(ImageDSProcessor.class, "ImageDSProcessor.allDesc.text");
    private static final GeneralFilter allFilter = new GeneralFilter(allExt, ALL_DESC);
    private static final List<FileFilter> filtersList = new ArrayList<>();
    private final ImageFilePanel configPanel;
    private AddImageTask addImageTask;
    private IngestStream ingestStream = null;
    private Image image = null;
    /*
     * TODO: Remove the setDataSourceOptionsCalled flag and the settings fields
     * when the deprecated method setDataSourceOptions is removed.
     */
    private String deviceId;
    private String imagePath;
    private int sectorSize;
    private String timeZone;
    private boolean ignoreFatOrphanFiles;
    private String md5;
    private String sha1;
    private String sha256;
    private Host host = null;

    static {
        filtersList.add(allFilter);
        filtersList.add(rawFilter);
        filtersList.add(encaseFilter);
        allExt.addAll(GeneralFilter.RAW_IMAGE_EXTS);
        allExt.addAll(GeneralFilter.ENCASE_IMAGE_EXTS);
        if (!System.getProperty("os.name").toLowerCase().contains("mac")) {
            filtersList.add(virtualMachineFilter);
            allExt.addAll(GeneralFilter.VIRTUAL_MACHINE_EXTS);
        }
    }

    public ImageDSProcessor() {
        configPanel = ImageFilePanel.createInstance(ImageDSProcessor.class.getName(), filtersList);
    }

    static List<FileFilter> getFileFiltersList() {
        return filtersList;
    }

    public static String getType() {
        return DATA_SOURCE_TYPE;
    }

    @Override
    public String getDataSourceType() {
        return getType();
    }

    @Override
    public JPanel getPanel() {
        configPanel.reset();
        configPanel.readSettings();
        configPanel.select();
        return configPanel;
    }

    @Override
    public boolean isPanelValid() {
        return configPanel.validatePanel();
    }

    @Override
    public void run(DataSourceProcessorProgressMonitor progressMonitor, DataSourceProcessorCallback callback) {
        run(null, progressMonitor, callback);
    }

    @Override
    public void run(Host host, DataSourceProcessorProgressMonitor progressMonitor, DataSourceProcessorCallback callback) {
        ingestStream = new DefaultIngestStream();
        readConfigSettings();
        this.host = host;
        try {
            image = SleuthkitJNI.addImageToDatabase(Case.getCurrentCase().getSleuthkitCase(),
                    new String[]{imagePath}, sectorSize, timeZone, md5, sha1, sha256, deviceId, this.host);
        } catch (TskCoreException ex) {
            logger.log(Level.SEVERE, "Error adding data source with path " + imagePath + " to database", ex);
            final List<String> errors = new ArrayList<>();
            errors.add(ex.getMessage());
            callback.done(DataSourceProcessorCallback.DataSourceProcessorResult.CRITICAL_ERRORS, errors, new ArrayList<>());
            return;
        }

        doAddImageProcess(deviceId, imagePath, sectorSize, timeZone, ignoreFatOrphanFiles, md5, sha1, sha256, progressMonitor, callback);
    }

    @Override
    public void runWithIngestStream(IngestJobSettings settings, DataSourceProcessorProgressMonitor progress,
            DataSourceProcessorCallback callBack) {
        runWithIngestStream(null, settings, progress, callBack);
    }

    @Override
    public void runWithIngestStream(Host host, IngestJobSettings settings, DataSourceProcessorProgressMonitor progress,
            DataSourceProcessorCallback callBack) {

        // Read the settings from the wizard 
        readConfigSettings();
        this.host = host;

        // Set up the data source before creating the ingest stream
        try {
            image = SleuthkitJNI.addImageToDatabase(Case.getCurrentCase().getSleuthkitCase(),
                    new String[]{imagePath}, sectorSize, timeZone, md5, sha1, sha256, deviceId, this.host);
        } catch (TskCoreException ex) {
            logger.log(Level.SEVERE, "Error adding data source with path " + imagePath + " to database", ex);
            final List<String> errors = new ArrayList<>();
            errors.add(ex.getMessage());
            callBack.done(DataSourceProcessorCallback.DataSourceProcessorResult.CRITICAL_ERRORS, errors, new ArrayList<>());
            return;
        }

        // Now initialize the ingest stream
        try {
            ingestStream = IngestManager.getInstance().openIngestStream(image, settings);
        } catch (TskCoreException ex) {
            logger.log(Level.SEVERE, "Error starting ingest modules", ex);
            // There was an error with ingest, but the data source has already been added
            // so proceed with the defaultIngestStream. Code in openIngestStream
            // should have caused a dialog to popup with the errors.
            ingestStream = new DefaultIngestStream();
        }

        doAddImageProcess(deviceId, imagePath, sectorSize, timeZone, ignoreFatOrphanFiles, md5, sha1, sha256, progress, callBack);
    }

    private void readConfigSettings() {
        configPanel.storeSettings();
        deviceId = UUID.randomUUID().toString();
        imagePath = configPanel.getContentPaths();
        sectorSize = configPanel.getSectorSize();
        timeZone = configPanel.getTimeZone();
        ignoreFatOrphanFiles = configPanel.getNoFatOrphans();
        md5 = configPanel.getMd5();
        if (md5.isEmpty()) {
            md5 = null;
        }
        sha1 = configPanel.getSha1();
        if (sha1.isEmpty()) {
            sha1 = null;
        }
        sha256 = configPanel.getSha256();
        if (sha256.isEmpty()) {
            sha256 = null;
        }
    }

    @Override
    public boolean supportsIngestStream() {
        return true;
    }

    public void run(String deviceId, String imagePath, String timeZone, boolean ignoreFatOrphanFiles, DataSourceProcessorProgressMonitor progressMonitor, DataSourceProcessorCallback callback) {
        ingestStream = new DefaultIngestStream();
        try {
            image = SleuthkitJNI.addImageToDatabase(Case.getCurrentCase().getSleuthkitCase(),
                    new String[]{imagePath}, sectorSize, timeZone, "", "", "", deviceId);
        } catch (TskCoreException ex) {
            logger.log(Level.SEVERE, "Error adding data source with path " + imagePath + " to database", ex);
            final List<String> errors = new ArrayList<>();
            errors.add(ex.getMessage());
            callback.done(DataSourceProcessorCallback.DataSourceProcessorResult.CRITICAL_ERRORS, errors, new ArrayList<>());
            return;
        }

        doAddImageProcess(deviceId, imagePath, 0, timeZone, ignoreFatOrphanFiles, null, null, null, progressMonitor, callback);
    }

    private void doAddImageProcess(String deviceId, String imagePath, int sectorSize, String timeZone, boolean ignoreFatOrphanFiles, String md5, String sha1, String sha256, DataSourceProcessorProgressMonitor progressMonitor, DataSourceProcessorCallback callback) {

        // If the data source or ingest stream haven't been initialized, stop processing
        if (ingestStream == null) {
            String message = "Ingest stream was not initialized before running the add image process on " + imagePath;
            logger.log(Level.SEVERE, message);
            final List<String> errors = new ArrayList<>();
            errors.add(message);
            callback.done(DataSourceProcessorCallback.DataSourceProcessorResult.CRITICAL_ERRORS, errors, new ArrayList<>());
            return;
        }
        if (image == null) {
            String message = "Image was not added to database before running the add image process on " + imagePath;
            logger.log(Level.SEVERE, message);
            final List<String> errors = new ArrayList<>();
            errors.add(message);
            callback.done(DataSourceProcessorCallback.DataSourceProcessorResult.CRITICAL_ERRORS, errors, new ArrayList<>());
            return;
        }

        AddImageTask.ImageDetails imageDetails = new AddImageTask.ImageDetails(deviceId, image, sectorSize, timeZone, ignoreFatOrphanFiles, md5, sha1, sha256, null);
        addImageTask = new AddImageTask(imageDetails,
                progressMonitor,
                new StreamingAddDataSourceCallbacks(ingestStream),
                new StreamingAddImageTaskCallback(ingestStream, callback));
        new Thread(addImageTask).start();
    }

    @Override
    public void cancel() {
        if (null != addImageTask) {
            addImageTask.cancelTask();
        }
        if (ingestStream != null) {
            ingestStream.stop();
        }
    }

    @Override
    public void reset() {
        deviceId = null;
        imagePath = null;
        timeZone = null;
        ignoreFatOrphanFiles = false;
        host = null;
        configPanel.reset();
    }

    private static boolean isAcceptedByFiler(File file, List<FileFilter> filters) {
        for (FileFilter filter : filters) {
            if (filter.accept(file)) {
                return true;
            }
        }
        return false;
    }

    @Override
    public int canProcess(Path dataSourcePath) throws AutoIngestDataSourceProcessorException {

        // check file extension for supported types
        if (!isAcceptedByFiler(dataSourcePath.toFile(), filtersList)) {
            return 0;
        }

        try {
            // verify that the image has a file system that TSK can process
            if (!DataSourceUtils.imageHasFileSystem(dataSourcePath)) {
                // image does not have a file system that TSK can process
                return 0;
            }
        } catch (Exception ex) {
            throw new AutoIngestDataSourceProcessorException("Exception inside canProcess() method", ex);
        }

        // able to process the data source
        return 100;
    }

    @Override
    public void process(String deviceId, Path dataSourcePath, DataSourceProcessorProgressMonitor progressMonitor, DataSourceProcessorCallback callBack) {
        process(deviceId, dataSourcePath, null, progressMonitor, callBack);
    }

    @Override
    public void process(String deviceId, Path dataSourcePath, Host host, DataSourceProcessorProgressMonitor progressMonitor, DataSourceProcessorCallback callBack) {
        // this method does not use the config panel
        this.deviceId = deviceId;
        this.imagePath = dataSourcePath.toString();
        this.sectorSize = 0;
        this.timeZone = Calendar.getInstance().getTimeZone().getID();
        this.host = host;
        this.ignoreFatOrphanFiles = false;

        ingestStream = new DefaultIngestStream();
        try {
            image = SleuthkitJNI.addImageToDatabase(Case.getCurrentCase().getSleuthkitCase(),
                    new String[]{imagePath}, sectorSize, timeZone, "", "", "", deviceId, host);
        } catch (TskCoreException ex) {
            logger.log(Level.SEVERE, "Error adding data source with path " + imagePath + " to database", ex);
            final List<String> errors = new ArrayList<>();
            errors.add(ex.getMessage());
            callBack.done(DataSourceProcessorCallback.DataSourceProcessorResult.CRITICAL_ERRORS, errors, new ArrayList<>());
            return;
        }

        doAddImageProcess(deviceId, dataSourcePath.toString(), sectorSize, timeZone, ignoreFatOrphanFiles, null, null, null, progressMonitor, callBack);
    }

    @Override
    public IngestStream processWithIngestStream(String deviceId, Path dataSourcePath, IngestJobSettings settings, DataSourceProcessorProgressMonitor progressMonitor, DataSourceProcessorCallback callBack) {
        return processWithIngestStream(deviceId, dataSourcePath, null, settings, progressMonitor, callBack);
    }

    @Override
    public IngestStream processWithIngestStream(String deviceId, Path dataSourcePath, Host host, IngestJobSettings settings, DataSourceProcessorProgressMonitor progressMonitor, DataSourceProcessorCallback callBack) {
        // this method does not use the config panel
        this.deviceId = deviceId;
        this.imagePath = dataSourcePath.toString();
        this.sectorSize = 0;
        this.timeZone = Calendar.getInstance().getTimeZone().getID();
        this.host = host;
        this.ignoreFatOrphanFiles = false;

        // Set up the data source before creating the ingest stream
        try {
            image = SleuthkitJNI.addImageToDatabase(Case.getCurrentCase().getSleuthkitCase(),
                    new String[]{imagePath}, sectorSize, timeZone, md5, sha1, sha256, deviceId, host);
        } catch (TskCoreException ex) {
            logger.log(Level.SEVERE, "Error adding data source with path " + imagePath + " to database", ex);
            final List<String> errors = new ArrayList<>();
            errors.add(ex.getMessage());
            callBack.done(DataSourceProcessorCallback.DataSourceProcessorResult.CRITICAL_ERRORS, errors, new ArrayList<>());
            return null;
        }

        // Now initialize the ingest stream
        try {
            ingestStream = IngestManager.getInstance().openIngestStream(image, settings);
        } catch (TskCoreException ex) {
            logger.log(Level.SEVERE, "Error starting ingest modules", ex);
            final List<String> errors = new ArrayList<>();
            errors.add(ex.getMessage());
            callBack.done(DataSourceProcessorCallback.DataSourceProcessorResult.CRITICAL_ERRORS, errors, new ArrayList<>());
            return null;
        }

        doAddImageProcess(deviceId, dataSourcePath.toString(), sectorSize, timeZone, ignoreFatOrphanFiles, null, null, null, progressMonitor, callBack);

        return ingestStream;
    }
}