Autopsy  4.6.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
FileManager.java
Go to the documentation of this file.
1 /*
2  *
3  * Autopsy Forensic Browser
4  *
5  * Copyright 2011-2018 Basis Technology Corp.
6  *
7  * Copyright 2012 42six Solutions.
8  * Contact: aebadirad <at> 42six <dot> com
9  * Project Contact/Architect: carrier <at> sleuthkit <dot> org
10  *
11  * Licensed under the Apache License, Version 2.0 (the "License");
12  * you may not use this file except in compliance with the License.
13  * You may obtain a copy of the License at
14  *
15  * http://www.apache.org/licenses/LICENSE-2.0
16  *
17  * Unless required by applicable law or agreed to in writing, software
18  * distributed under the License is distributed on an "AS IS" BASIS,
19  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
20  * See the License for the specific language governing permissions and
21  * limitations under the License.
22  */
23 package org.sleuthkit.autopsy.casemodule.services;
24 
25 import java.io.Closeable;
26 import java.io.IOException;
27 import java.util.ArrayList;
28 import java.util.Collection;
29 import java.util.List;
30 import java.util.logging.Level;
31 import org.openide.util.NbBundle;
35 import org.sleuthkit.datamodel.AbstractFile;
36 import org.sleuthkit.datamodel.Content;
37 import org.sleuthkit.datamodel.DerivedFile;
38 import org.sleuthkit.datamodel.LayoutFile;
39 import org.sleuthkit.datamodel.LocalDirectory;
40 import org.sleuthkit.datamodel.SleuthkitCase;
41 import org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction;
42 import org.sleuthkit.datamodel.SpecialDirectory;
43 import org.sleuthkit.datamodel.TskCoreException;
44 import org.sleuthkit.datamodel.TskFileRange;
45 import org.sleuthkit.datamodel.VirtualDirectory;
46 import org.sleuthkit.datamodel.LocalFilesDataSource;
47 import org.sleuthkit.datamodel.TskDataException;
48 import org.apache.commons.lang3.StringUtils;
50 import org.sleuthkit.datamodel.CarvingResult;
51 import org.sleuthkit.datamodel.TskData;
52 
58 public class FileManager implements Closeable {
59 
60  private static final Logger LOGGER = Logger.getLogger(FileManager.class.getName());
61  private SleuthkitCase caseDb;
62 
70  public FileManager(SleuthkitCase caseDb) {
71  this.caseDb = caseDb;
72  }
73 
84  public synchronized List<AbstractFile> findFilesByMimeType(Collection<String> mimeTypes) throws TskCoreException {
85  if (null == caseDb) {
86  throw new TskCoreException("File manager has been closed");
87  }
88  return caseDb.findAllFilesWhere(createFileTypeInCondition(mimeTypes));
89  }
90 
102  public synchronized List<AbstractFile> findFilesByParentPath(long dataSourceObjectID, String parentPath) throws TskCoreException {
103  if (null == caseDb) {
104  throw new TskCoreException("File manager has been closed");
105  }
106  return caseDb.findAllFilesWhere(createParentPathCondition(dataSourceObjectID,parentPath));
107  }
108 
121  public synchronized List<AbstractFile> findFilesByMimeType(Content dataSource, Collection<String> mimeTypes) throws TskCoreException {
122  if (null == caseDb) {
123  throw new TskCoreException("File manager has been closed");
124  }
125  return caseDb.findAllFilesWhere("data_source_obj_id = " + dataSource.getId() + " AND " + createFileTypeInCondition(mimeTypes));
126  }
127 
135  private static String createFileTypeInCondition(Collection<String> mimeTypes) {
136  String types = StringUtils.join(mimeTypes, "', '");
137  return "mime_type IN ('" + types + "')";
138  }
139 
148  private static String createParentPathCondition(long dataSourceObjectID, String parentPath){
149  return "data_source_obj_id = " + dataSourceObjectID +" AND parent_path LIKE '" + parentPath +"%'";
150  }
151 
152 
165  public synchronized List<AbstractFile> findFiles(String fileName) throws TskCoreException {
166  if (null == caseDb) {
167  throw new TskCoreException("File manager has been closed");
168  }
169  List<AbstractFile> result = new ArrayList<>();
170  List<Content> dataSources = caseDb.getRootObjects();
171  for (Content dataSource : dataSources) {
172  result.addAll(findFiles(dataSource, fileName));
173  }
174  return result;
175  }
176 
191  public synchronized List<AbstractFile> findFiles(String fileName, String parentSubString) throws TskCoreException {
192  if (null == caseDb) {
193  throw new TskCoreException("File manager has been closed");
194  }
195  List<AbstractFile> result = new ArrayList<>();
196  List<Content> dataSources = caseDb.getRootObjects();
197  for (Content dataSource : dataSources) {
198  result.addAll(findFiles(dataSource, fileName, parentSubString));
199  }
200  return result;
201  }
202 
217  public synchronized List<AbstractFile> findFiles(String fileName, AbstractFile parent) throws TskCoreException {
218  if (null == caseDb) {
219  throw new TskCoreException("File manager has been closed");
220  }
221  List<AbstractFile> result = new ArrayList<>();
222  List<Content> dataSources = caseDb.getRootObjects();
223  for (Content dataSource : dataSources) {
224  result.addAll(findFiles(dataSource, fileName, parent));
225  }
226  return result;
227  }
228 
243  public synchronized List<AbstractFile> findFiles(Content dataSource, String fileName) throws TskCoreException {
244  if (null == caseDb) {
245  throw new TskCoreException("File manager has been closed");
246  }
247  return caseDb.findFiles(dataSource, fileName);
248  }
249 
266  public synchronized List<AbstractFile> findFiles(Content dataSource, String fileName, String parentSubString) throws TskCoreException {
267  if (null == caseDb) {
268  throw new TskCoreException("File manager has been closed");
269  }
270  return caseDb.findFiles(dataSource, fileName, parentSubString);
271  }
272 
289  public synchronized List<AbstractFile> findFiles(Content dataSource, String fileName, AbstractFile parent) throws TskCoreException {
290  if (null == caseDb) {
291  throw new TskCoreException("File manager has been closed");
292  }
293  return findFiles(dataSource, fileName, parent.getName());
294  }
295 
312  public synchronized List<AbstractFile> openFiles(Content dataSource, String filePath) throws TskCoreException {
313  if (null == caseDb) {
314  throw new TskCoreException("File manager has been closed");
315  }
316  return caseDb.openFiles(dataSource, filePath);
317  }
318 
348  public synchronized DerivedFile addDerivedFile(String fileName,
349  String localPath,
350  long size,
351  long ctime, long crtime, long atime, long mtime,
352  boolean isFile,
353  Content parentObj,
354  String rederiveDetails, String toolName, String toolVersion, String otherDetails,
355  TskData.EncodingType encodingType) throws TskCoreException {
356  if (null == caseDb) {
357  throw new TskCoreException("File manager has been closed");
358  }
359  return caseDb.addDerivedFile(fileName, localPath, size,
360  ctime, crtime, atime, mtime,
361  isFile, parentObj, rederiveDetails, toolName, toolVersion, otherDetails, encodingType);
362  }
393  public synchronized DerivedFile updateDerivedFile(DerivedFile derivedFile, String localPath,
394  long size,
395  long ctime, long crtime, long atime, long mtime,
396  boolean isFile, String mimeType,
397  String rederiveDetails, String toolName, String toolVersion, String otherDetails,
398  TskData.EncodingType encodingType) throws TskCoreException {
399  if (null == caseDb) {
400  throw new TskCoreException("File manager has been closed");
401  }
402  return caseDb.updateDerivedFile(derivedFile, localPath, size,
403  ctime, crtime, atime, mtime,
404  isFile, mimeType, rederiveDetails, toolName, toolVersion, otherDetails, encodingType);
405  }
406 
418  public synchronized List<LayoutFile> addCarvedFiles(CarvingResult carvingResult) throws TskCoreException {
419  if (null == caseDb) {
420  throw new TskCoreException("File manager has been closed");
421  }
422  return caseDb.addCarvedFiles(carvingResult);
423  }
424 
429  public interface FileAddProgressUpdater {
430 
436  void fileAdded(AbstractFile newFile);
437  }
438 
467  public synchronized LocalFilesDataSource addLocalFilesDataSource(String deviceId, String rootVirtualDirectoryName, String timeZone, List<String> localFilePaths, FileAddProgressUpdater progressUpdater) throws TskCoreException, TskDataException {
468  if (null == caseDb) {
469  throw new TskCoreException("File manager has been closed");
470  }
471  List<java.io.File> localFiles = getFilesAndDirectories(localFilePaths);
472  CaseDbTransaction trans = null;
473  try {
474  String rootDirectoryName = rootVirtualDirectoryName;
475  if (rootDirectoryName.isEmpty()) {
476  rootDirectoryName = generateFilesDataSourceName(caseDb);
477  }
478 
479  /*
480  * Add the root virtual directory and its local/logical file
481  * children to the case database.
482  */
483  trans = caseDb.beginTransaction();
484  LocalFilesDataSource dataSource = caseDb.addLocalFilesDataSource(deviceId, rootDirectoryName, timeZone, trans);
485  List<AbstractFile> filesAdded = new ArrayList<>();
486  for (java.io.File localFile : localFiles) {
487  AbstractFile fileAdded = addLocalFile(trans, dataSource, localFile, TskData.EncodingType.NONE, progressUpdater);
488  if (null != fileAdded) {
489  filesAdded.add(fileAdded);
490  } else {
491  throw new TskCoreException(NbBundle.getMessage(this.getClass(), "FileManager.addLocalFilesDirs.exception.cantAdd.msg", localFile.getAbsolutePath()));
492  }
493  }
494  trans.commit();
495 
496  /*
497  * Publish content added events for the added files and directories.
498  */
499  for (AbstractFile fileAdded : filesAdded) {
501  }
502 
503  return dataSource;
504 
505  } catch (TskCoreException ex) {
506  if (null != trans) {
507  try {
508  trans.rollback();
509  } catch (TskCoreException ex2) {
510  LOGGER.log(Level.SEVERE, String.format("Failed to rollback transaction after exception: %s", ex.getMessage()), ex2);
511  }
512  }
513  throw ex;
514  }
515  }
516 
530  private static synchronized String generateFilesDataSourceName(SleuthkitCase caseDb) throws TskCoreException {
531  int localFileDataSourcesCounter = 0;
532  try {
533  List<VirtualDirectory> localFileDataSources = caseDb.getVirtualDirectoryRoots();
534  for (VirtualDirectory vd : localFileDataSources) {
535  if (vd.getName().startsWith(VirtualDirectoryNode.LOGICAL_FILE_SET_PREFIX)) {
536  ++localFileDataSourcesCounter;
537  }
538  }
539  return VirtualDirectoryNode.LOGICAL_FILE_SET_PREFIX + (localFileDataSourcesCounter + 1);
540  } catch (TskCoreException ex) {
541  throw new TskCoreException("Error querying for existing local file data sources with defualt names", ex);
542  }
543  }
544 
557  private List<java.io.File> getFilesAndDirectories(List<String> localFilePaths) throws TskDataException {
558  List<java.io.File> localFiles = new ArrayList<>();
559  for (String path : localFilePaths) {
560  java.io.File localFile = new java.io.File(path);
561  if (!localFile.exists() || !localFile.canRead()) {
562  throw new TskDataException(String.format("File at %s does not exist or cannot be read", localFile.getAbsolutePath()));
563  }
564  localFiles.add(localFile);
565  }
566  return localFiles;
567  }
568 
586  private AbstractFile addLocalFile(CaseDbTransaction trans, SpecialDirectory parentDirectory, java.io.File localFile,
587  TskData.EncodingType encodingType, FileAddProgressUpdater progressUpdater) throws TskCoreException {
588  if (localFile.isDirectory()) {
589  /*
590  * Add the directory as a local directory.
591  */
592  LocalDirectory localDirectory = caseDb.addLocalDirectory(parentDirectory.getId(), localFile.getName(), trans);
593  progressUpdater.fileAdded(localDirectory);
594 
595  /*
596  * Add its children, if any.
597  */
598  final java.io.File[] childFiles = localFile.listFiles();
599  if (childFiles != null && childFiles.length > 0) {
600  for (java.io.File childFile : childFiles) {
601  addLocalFile(trans, localDirectory, childFile, progressUpdater);
602  }
603  }
604 
605  return localDirectory;
606  } else {
607  return caseDb.addLocalFile(localFile.getName(), localFile.getAbsolutePath(), localFile.length(),
608  0, 0, 0, 0,
609  localFile.isFile(), encodingType, parentDirectory, trans);
610  }
611  }
612 
618  @Override
619  public synchronized void close() throws IOException {
620  caseDb = null;
621  }
622 
641  @Deprecated
642  public synchronized VirtualDirectory addLocalFilesDirs(List<String> localFilePaths, FileAddProgressUpdater progressUpdater) throws TskCoreException {
643  if (null == caseDb) {
644  throw new TskCoreException("File manager has been closed");
645  }
646  try {
647  return addLocalFilesDataSource("", "", "", localFilePaths, progressUpdater).getRootDirectory();
648  } catch (TskDataException ex) {
649  throw new TskCoreException(ex.getLocalizedMessage(), ex);
650  }
651  }
652 
671  @Deprecated
672  public synchronized LayoutFile addCarvedFile(String fileName, long fileSize, long parentObjId, List<TskFileRange> layout) throws TskCoreException {
673  if (null == caseDb) {
674  throw new TskCoreException("File manager has been closed");
675  }
676  Content parent = caseDb.getContentById(parentObjId);
677  List<CarvingResult.CarvedFile> carvedFiles = new ArrayList<>();
678  carvedFiles.add(new CarvingResult.CarvedFile(fileName, fileSize, layout));
679  List<LayoutFile> layoutFiles = caseDb.addCarvedFiles(new CarvingResult(parent, carvedFiles));
680  return layoutFiles.get(0);
681  }
682 
698  @Deprecated
699  public synchronized List<LayoutFile> addCarvedFiles(List<org.sleuthkit.datamodel.CarvedFileContainer> filesToAdd) throws TskCoreException {
700  if (null == caseDb) {
701  throw new TskCoreException("File manager has been closed");
702  }
703  return caseDb.addCarvedFiles(filesToAdd);
704  }
705 
736  @Deprecated
737  public synchronized DerivedFile addDerivedFile(String fileName,
738  String localPath,
739  long size,
740  long ctime, long crtime, long atime, long mtime,
741  boolean isFile,
742  AbstractFile parentFile,
743  String rederiveDetails, String toolName, String toolVersion, String otherDetails) throws TskCoreException {
744  return addDerivedFile(fileName, localPath, size, ctime, crtime, atime, mtime, isFile, parentFile,
745  rederiveDetails, toolName, toolVersion, otherDetails, TskData.EncodingType.NONE);
746  }
747 
768  @Deprecated
769  private AbstractFile addLocalFile(CaseDbTransaction trans, SpecialDirectory parentDirectory, java.io.File localFile, FileAddProgressUpdater progressUpdater) throws TskCoreException {
770  return addLocalFile(trans, parentDirectory, localFile, TskData.EncodingType.NONE, progressUpdater);
771  }
772 
773 }
static String createFileTypeInCondition(Collection< String > mimeTypes)
synchronized VirtualDirectory addLocalFilesDirs(List< String > localFilePaths, FileAddProgressUpdater progressUpdater)
synchronized LayoutFile addCarvedFile(String fileName, long fileSize, long parentObjId, List< TskFileRange > layout)
synchronized List< AbstractFile > findFiles(String fileName, String parentSubString)
synchronized List< AbstractFile > findFiles(Content dataSource, String fileName)
synchronized DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, Content parentObj, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType)
synchronized DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parentFile, String rederiveDetails, String toolName, String toolVersion, String otherDetails)
AbstractFile addLocalFile(CaseDbTransaction trans, SpecialDirectory parentDirectory, java.io.File localFile, FileAddProgressUpdater progressUpdater)
synchronized List< AbstractFile > findFilesByMimeType(Collection< String > mimeTypes)
synchronized List< LayoutFile > addCarvedFiles(List< org.sleuthkit.datamodel.CarvedFileContainer > filesToAdd)
synchronized List< AbstractFile > openFiles(Content dataSource, String filePath)
static String createParentPathCondition(long dataSourceObjectID, String parentPath)
synchronized LocalFilesDataSource addLocalFilesDataSource(String deviceId, String rootVirtualDirectoryName, String timeZone, List< String > localFilePaths, FileAddProgressUpdater progressUpdater)
static synchronized String generateFilesDataSourceName(SleuthkitCase caseDb)
synchronized List< AbstractFile > findFilesByMimeType(Content dataSource, Collection< String > mimeTypes)
synchronized List< AbstractFile > findFilesByParentPath(long dataSourceObjectID, String parentPath)
void fireModuleContentEvent(ModuleContentEvent moduleContentEvent)
synchronized List< AbstractFile > findFiles(String fileName)
AbstractFile addLocalFile(CaseDbTransaction trans, SpecialDirectory parentDirectory, java.io.File localFile, TskData.EncodingType encodingType, FileAddProgressUpdater progressUpdater)
synchronized static Logger getLogger(String name)
Definition: Logger.java:124
synchronized List< LayoutFile > addCarvedFiles(CarvingResult carvingResult)
synchronized DerivedFile updateDerivedFile(DerivedFile derivedFile, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, String mimeType, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType)
synchronized List< AbstractFile > findFiles(Content dataSource, String fileName, String parentSubString)
synchronized List< AbstractFile > findFiles(Content dataSource, String fileName, AbstractFile parent)
synchronized List< AbstractFile > findFiles(String fileName, AbstractFile parent)
List< java.io.File > getFilesAndDirectories(List< String > localFilePaths)
static synchronized IngestServices getInstance()

Copyright © 2012-2016 Basis Technology. Generated on: Mon May 7 2018
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.