19 package org.sleuthkit.autopsy.modules.photoreccarver;
22 import java.io.IOException;
23 import java.lang.ProcessBuilder.Redirect;
24 import java.nio.file.DirectoryStream;
25 import java.nio.file.FileAlreadyExistsException;
26 import java.nio.file.Files;
27 import java.nio.file.Path;
28 import java.nio.file.Paths;
29 import java.text.DateFormat;
30 import java.text.SimpleDateFormat;
31 import java.util.ArrayList;
32 import java.util.Date;
33 import java.util.HashMap;
34 import java.util.List;
36 import java.util.concurrent.ConcurrentHashMap;
37 import java.util.concurrent.atomic.AtomicLong;
38 import java.util.logging.Level;
39 import org.openide.modules.InstalledFileLocator;
40 import org.openide.util.NbBundle;
62 import org.
sleuthkit.datamodel.ReadContentInputStream.ReadContentInputStreamException;
70 "PhotoRecIngestModule.PermissionsNotSufficient=Insufficient permissions accessing",
71 "PhotoRecIngestModule.PermissionsNotSufficientSeeReference=See 'Shared Drive Authentication' in Autopsy help.",
72 "# {0} - output directory name",
"cannotCreateOutputDir.message=Unable to create output directory: {0}.",
73 "unallocatedSpaceProcessingSettingsError.message=The selected file ingest filter ignores unallocated space. This module carves unallocated space. Please choose a filter which does not ignore unallocated space or disable this module.",
74 "unsupportedOS.message=PhotoRec module is supported on Windows platforms only.",
75 "missingExecutable.message=Unable to locate PhotoRec executable.",
76 "cannotRunExecutable.message=Unable to execute PhotoRec.",
77 "PhotoRecIngestModule.nonHostnameUNCPathUsed=PhotoRec cannot operate with a UNC path containing IP addresses."
81 static final boolean DEFAULT_CONFIG_KEEP_CORRUPTED_FILES =
false;
83 private static final String PHOTOREC_DIRECTORY =
"photorec_exec";
84 private static final String PHOTOREC_EXECUTABLE =
"photorec_win.exe";
85 private static final String PHOTOREC_LINUX_EXECUTABLE =
"photorec";
86 private static final String PHOTOREC_RESULTS_BASE =
"results";
87 private static final String PHOTOREC_RESULTS_EXTENDED =
"results.1";
88 private static final String PHOTOREC_REPORT =
"report.xml";
89 private static final String LOG_FILE =
"run_log.txt";
90 private static final String TEMP_DIR_NAME =
"temp";
91 private static final String SEP = System.getProperty(
"line.separator");
92 private static final Logger logger =
Logger.
getLogger(PhotoRecCarverFileIngestModule.class.getName());
93 private static final HashMap<Long, IngestJobTotals> totalsForIngestJobs =
new HashMap<>();
95 private static final Map<Long, WorkingPaths> pathsByJob =
new ConcurrentHashMap<>();
97 private Path rootOutputDirPath;
98 private File executableFile;
103 private final boolean keepCorruptedFiles;
106 private final AtomicLong totalItemsRecovered =
new AtomicLong(0);
107 private final AtomicLong totalItemsWithErrors =
new AtomicLong(0);
108 private final AtomicLong totalWritetime =
new AtomicLong(0);
109 private final AtomicLong totalParsetime =
new AtomicLong(0);
116 PhotoRecCarverFileIngestModule(PhotoRecCarverIngestJobSettings settings) {
117 keepCorruptedFiles = settings.isKeepCorruptedFiles();
120 private static synchronized IngestJobTotals getTotalsForIngestJobs(
long ingestJobId) {
121 IngestJobTotals totals = totalsForIngestJobs.get(ingestJobId);
122 if (totals == null) {
123 totals =
new PhotoRecCarverFileIngestModule.IngestJobTotals();
124 totalsForIngestJobs.put(ingestJobId, totals);
129 private static synchronized void initTotalsForIngestJob(
long ingestJobId) {
130 IngestJobTotals totals =
new PhotoRecCarverFileIngestModule.IngestJobTotals();
131 totalsForIngestJobs.put(ingestJobId, totals);
138 public void startUp(IngestJobContext context)
throws IngestModule.IngestModuleException {
139 this.context = context;
141 this.jobId = this.context.getJobId();
147 if (!this.context.processingUnallocatedSpace()) {
148 throw new IngestModule.IngestModuleException(Bundle.unallocatedSpaceProcessingSettingsError_message());
151 this.rootOutputDirPath = createModuleOutputDirectoryForCase();
154 executableFile = locateExecutable();
156 if (PhotoRecCarverFileIngestModule.refCounter.incrementAndGet(
this.jobId) == 1) {
159 DateFormat dateFormat =
new SimpleDateFormat(
"MM-dd-yyyy-HH-mm-ss-SSSS");
160 Date date =
new Date();
161 String folder = this.context.getDataSource().getId() +
"_" + dateFormat.format(date);
162 Path outputDirPath = Paths.get(this.rootOutputDirPath.toAbsolutePath().toString(), folder);
163 Files.createDirectories(outputDirPath);
166 Path tempDirPath = Paths.get(outputDirPath.toString(), PhotoRecCarverFileIngestModule.TEMP_DIR_NAME);
167 Files.createDirectory(tempDirPath);
170 PhotoRecCarverFileIngestModule.pathsByJob.put(this.jobId,
new WorkingPaths(outputDirPath, tempDirPath));
173 initTotalsForIngestJob(jobId);
174 }
catch (SecurityException | IOException | UnsupportedOperationException ex) {
175 throw new IngestModule.IngestModuleException(Bundle.cannotCreateOutputDir_message(ex.getLocalizedMessage()), ex);
184 public IngestModule.ProcessResult process(AbstractFile file) {
186 if (file.getType() != TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS) {
187 return IngestModule.ProcessResult.OK;
191 IngestJobTotals totals = getTotalsForIngestJobs(jobId);
193 Path tempFilePath = null;
196 if (null == this.executableFile) {
197 logger.log(Level.SEVERE,
"PhotoRec carver called after failed start up");
198 return IngestModule.ProcessResult.ERROR;
204 long freeDiskSpace = IngestServices.getInstance().getFreeDiskSpace();
205 if ((freeDiskSpace != IngestMonitor.DISK_FREE_SPACE_UNKNOWN) && ((file.getSize() * 1.2) > freeDiskSpace)) {
206 logger.log(Level.SEVERE,
"PhotoRec error processing {0} with {1} Not enough space on primary disk to save unallocated space.",
207 new Object[]{file.getName(), PhotoRecCarverIngestModuleFactory.getModuleName()});
208 MessageNotifyUtil.Notify.error(NbBundle.getMessage(
this.getClass(),
"PhotoRecIngestModule.UnableToCarve", file.getName()),
209 NbBundle.getMessage(
this.getClass(),
"PhotoRecIngestModule.NotEnoughDiskSpace"));
210 return IngestModule.ProcessResult.ERROR;
212 if (this.context.fileIngestIsCancelled() ==
true) {
214 logger.log(Level.INFO,
"PhotoRec cancelled by user");
215 MessageNotifyUtil.Notify.info(PhotoRecCarverIngestModuleFactory.getModuleName(), NbBundle.getMessage(PhotoRecCarverFileIngestModule.class,
"PhotoRecIngestModule.cancelledByUser"));
216 return IngestModule.ProcessResult.OK;
220 long writestart = System.currentTimeMillis();
221 WorkingPaths paths = PhotoRecCarverFileIngestModule.pathsByJob.get(this.jobId);
222 tempFilePath = Paths.get(paths.getTempDirPath().toString(), file.getName());
223 ContentUtils.writeToFile(file, tempFilePath.toFile(), context::fileIngestIsCancelled);
225 if (this.context.fileIngestIsCancelled() ==
true) {
227 logger.log(Level.INFO,
"PhotoRec cancelled by user");
228 MessageNotifyUtil.Notify.info(PhotoRecCarverIngestModuleFactory.getModuleName(), NbBundle.getMessage(PhotoRecCarverFileIngestModule.class,
"PhotoRecIngestModule.cancelledByUser"));
229 return IngestModule.ProcessResult.OK;
233 Path outputDirPath = Paths.get(paths.getOutputDirPath().toString(), file.getName());
234 Files.createDirectory(outputDirPath);
235 File log =
new File(Paths.get(outputDirPath.toString(), LOG_FILE).toString());
238 ProcessBuilder processAndSettings =
new ProcessBuilder(
239 executableFile.toString(),
241 outputDirPath.toAbsolutePath().toString() + File.separator + PHOTOREC_RESULTS_BASE,
243 tempFilePath.toFile().toString());
244 if (keepCorruptedFiles) {
245 processAndSettings.command().add(
"options,keep_corrupted_file,search");
247 processAndSettings.command().add(
"search");
251 processAndSettings.environment().put(
"__COMPAT_LAYER",
"RunAsInvoker");
252 processAndSettings.redirectErrorStream(
true);
253 processAndSettings.redirectOutput(Redirect.appendTo(log));
255 FileIngestModuleProcessTerminator terminator =
new FileIngestModuleProcessTerminator(this.context,
true);
256 int exitValue = ExecUtil.execute(processAndSettings, terminator);
258 if (this.context.fileIngestIsCancelled() ==
true) {
260 cleanup(outputDirPath, tempFilePath);
261 logger.log(Level.INFO,
"PhotoRec cancelled by user");
262 MessageNotifyUtil.Notify.info(PhotoRecCarverIngestModuleFactory.getModuleName(), NbBundle.getMessage(PhotoRecCarverFileIngestModule.class,
"PhotoRecIngestModule.cancelledByUser"));
263 return IngestModule.ProcessResult.OK;
264 }
else if (terminator.getTerminationCode() == ProcTerminationCode.TIME_OUT) {
265 cleanup(outputDirPath, tempFilePath);
266 String msg = NbBundle.getMessage(this.getClass(),
"PhotoRecIngestModule.processTerminated") + file.getName();
267 MessageNotifyUtil.Notify.error(NbBundle.getMessage(
this.getClass(),
"PhotoRecIngestModule.moduleError"), msg);
268 logger.log(Level.SEVERE, msg);
269 return IngestModule.ProcessResult.ERROR;
270 }
else if (0 != exitValue) {
272 cleanup(outputDirPath, tempFilePath);
273 totals.totalItemsWithErrors.incrementAndGet();
274 logger.log(Level.SEVERE,
"PhotoRec carver returned error exit value = {0} when scanning {1}",
275 new Object[]{exitValue, file.getName()});
276 MessageNotifyUtil.Notify.error(PhotoRecCarverIngestModuleFactory.getModuleName(), NbBundle.getMessage(PhotoRecCarverFileIngestModule.class,
"PhotoRecIngestModule.error.exitValue",
277 new Object[]{exitValue, file.getName()}));
278 return IngestModule.ProcessResult.ERROR;
282 java.io.File oldAuditFile =
new java.io.File(Paths.get(outputDirPath.toString(), PHOTOREC_RESULTS_EXTENDED, PHOTOREC_REPORT).toString());
283 java.io.File newAuditFile =
new java.io.File(Paths.get(outputDirPath.toString(), PHOTOREC_REPORT).toString());
284 oldAuditFile.renameTo(newAuditFile);
286 if (this.context.fileIngestIsCancelled() ==
true) {
288 logger.log(Level.INFO,
"PhotoRec cancelled by user");
289 MessageNotifyUtil.Notify.info(PhotoRecCarverIngestModuleFactory.getModuleName(), NbBundle.getMessage(PhotoRecCarverFileIngestModule.class,
"PhotoRecIngestModule.cancelledByUser"));
290 return IngestModule.ProcessResult.OK;
292 Path pathToRemove = Paths.get(outputDirPath.toAbsolutePath().toString());
293 try (DirectoryStream<Path> stream = Files.newDirectoryStream(pathToRemove)) {
294 for (Path entry : stream) {
295 if (Files.isDirectory(entry)) {
296 FileUtil.deleteDir(
new File(entry.toString()));
300 long writedelta = (System.currentTimeMillis() - writestart);
301 totals.totalWritetime.addAndGet(writedelta);
304 long calcstart = System.currentTimeMillis();
305 PhotoRecCarverOutputParser parser =
new PhotoRecCarverOutputParser(outputDirPath);
306 if (this.context.fileIngestIsCancelled() ==
true) {
308 logger.log(Level.INFO,
"PhotoRec cancelled by user");
309 MessageNotifyUtil.Notify.info(PhotoRecCarverIngestModuleFactory.getModuleName(), NbBundle.getMessage(PhotoRecCarverFileIngestModule.class,
"PhotoRecIngestModule.cancelledByUser"));
310 return IngestModule.ProcessResult.OK;
312 List<LayoutFile> carvedItems = parser.parse(newAuditFile, file, context);
313 long calcdelta = (System.currentTimeMillis() - calcstart);
314 totals.totalParsetime.addAndGet(calcdelta);
315 if (carvedItems != null && !carvedItems.isEmpty()) {
316 totals.totalItemsRecovered.addAndGet(carvedItems.size());
317 context.addFilesToJob(
new ArrayList<>(carvedItems));
320 }
catch (ReadContentInputStreamException ex) {
321 totals.totalItemsWithErrors.incrementAndGet();
322 logger.log(Level.WARNING, String.format(
"Error reading file '%s' (id=%d) with the PhotoRec carver.", file.getName(), file.getId()), ex);
323 MessageNotifyUtil.Notify.error(PhotoRecCarverIngestModuleFactory.getModuleName(), NbBundle.getMessage(PhotoRecCarverFileIngestModule.class,
"PhotoRecIngestModule.error.msg", file.getName()));
324 return IngestModule.ProcessResult.ERROR;
325 }
catch (IOException ex) {
326 totals.totalItemsWithErrors.incrementAndGet();
327 logger.log(Level.SEVERE, String.format(
"Error writing file '%s' (id=%d) to '%s' with the PhotoRec carver.", file.getName(), file.getId(), tempFilePath), ex);
328 MessageNotifyUtil.Notify.error(PhotoRecCarverIngestModuleFactory.getModuleName(), NbBundle.getMessage(PhotoRecCarverFileIngestModule.class,
"PhotoRecIngestModule.error.msg", file.getName()));
329 return IngestModule.ProcessResult.ERROR;
331 if (null != tempFilePath && Files.exists(tempFilePath)) {
333 tempFilePath.toFile().delete();
336 return IngestModule.ProcessResult.OK;
340 private void cleanup(Path outputDirPath, Path tempFilePath) {
342 FileUtil.deleteDir(
new File(outputDirPath.toString()));
343 if (null != tempFilePath && Files.exists(tempFilePath)) {
344 tempFilePath.toFile().delete();
348 private static synchronized void postSummary(
long jobId) {
349 IngestJobTotals jobTotals = totalsForIngestJobs.remove(jobId);
351 StringBuilder detailsSb =
new StringBuilder();
353 detailsSb.append(
"<table border='0' cellpadding='4' width='280'>");
355 detailsSb.append(
"<tr><td>")
356 .append(NbBundle.getMessage(PhotoRecCarverFileIngestModule.class,
"PhotoRecIngestModule.complete.numberOfCarved"))
358 detailsSb.append(
"<td>").append(jobTotals.totalItemsRecovered.get()).append(
"</td></tr>");
360 detailsSb.append(
"<tr><td>")
361 .append(NbBundle.getMessage(PhotoRecCarverFileIngestModule.class,
"PhotoRecIngestModule.complete.numberOfErrors"))
363 detailsSb.append(
"<td>").append(jobTotals.totalItemsWithErrors.get()).append(
"</td></tr>");
365 detailsSb.append(
"<tr><td>")
366 .append(NbBundle.getMessage(PhotoRecCarverFileIngestModule.class,
"PhotoRecIngestModule.complete.totalWritetime"))
367 .append(
"</td><td>").append(jobTotals.totalWritetime.get()).append(
"</td></tr>\n");
368 detailsSb.append(
"<tr><td>")
369 .append(NbBundle.getMessage(PhotoRecCarverFileIngestModule.class,
"PhotoRecIngestModule.complete.totalParsetime"))
370 .append(
"</td><td>").append(jobTotals.totalParsetime.get()).append(
"</td></tr>\n");
371 detailsSb.append(
"</table>");
373 IngestServices.getInstance().postMessage(IngestMessage.createMessage(
374 IngestMessage.MessageType.INFO,
375 PhotoRecCarverIngestModuleFactory.getModuleName(),
376 NbBundle.getMessage(PhotoRecCarverFileIngestModule.class,
377 "PhotoRecIngestModule.complete.photoRecResults"),
378 detailsSb.toString()));
386 public void shutDown() {
387 if (this.context != null && refCounter.decrementAndGet(
this.jobId) == 0) {
391 WorkingPaths paths = PhotoRecCarverFileIngestModule.pathsByJob.remove(this.jobId);
392 FileUtil.deleteDir(
new File(paths.getTempDirPath().toString()));
394 }
catch (SecurityException ex) {
395 logger.log(Level.SEVERE,
"Error shutting down PhotoRec carver module", ex);
406 this.outputDirPath = outputDirPath;
407 this.tempDirPath = tempDirPath;
410 Path getOutputDirPath() {
411 return this.outputDirPath;
414 Path getTempDirPath() {
415 return this.tempDirPath;
427 synchronized Path createModuleOutputDirectoryForCase() throws IngestModule.IngestModuleException {
430 path = Paths.get(Case.getOpenCase().getModuleDirectory(), PhotoRecCarverIngestModuleFactory.getModuleName());
431 }
catch (NoCurrentCaseException ex) {
432 throw new IngestModule.IngestModuleException(Bundle.cannotCreateOutputDir_message(ex.getLocalizedMessage()), ex);
435 Files.createDirectory(path);
436 if (UNCPathUtilities.isUNC(path)) {
440 throw new IngestModule.IngestModuleException(Bundle.PhotoRecIngestModule_nonHostnameUNCPathUsed());
442 if (
false == FileUtil.hasReadWriteAccess(path)) {
443 throw new IngestModule.IngestModuleException(
444 Bundle.PhotoRecIngestModule_PermissionsNotSufficient() + SEP + path.toString() + SEP
445 + Bundle.PhotoRecIngestModule_PermissionsNotSufficientSeeReference()
449 }
catch (FileAlreadyExistsException ex) {
451 }
catch (IOException | SecurityException | UnsupportedOperationException ex) {
452 throw new IngestModule.IngestModuleException(Bundle.cannotCreateOutputDir_message(ex.getLocalizedMessage()), ex);
466 public static File locateExecutable() throws IngestModule.IngestModuleException {
469 String photorec_linux_directory =
"/usr/bin";
470 if (PlatformUtil.isWindowsOS()) {
471 execName = Paths.get(PHOTOREC_DIRECTORY, PHOTOREC_EXECUTABLE);
472 exeFile = InstalledFileLocator.getDefault().locate(execName.toString(), PhotoRecCarverFileIngestModule.class.getPackage().getName(),
false);
474 File usrBin =
new File(
"/usr/bin/photorec");
475 File usrLocalBin =
new File(
"/usr/local/bin/photorec");
476 if (usrBin.canExecute() && usrBin.exists() && !usrBin.isDirectory()) {
477 photorec_linux_directory =
"/usr/bin";
478 }
else if(usrLocalBin.canExecute() && usrLocalBin.exists() && !usrLocalBin.isDirectory()){
479 photorec_linux_directory =
"/usr/local/bin";
481 throw new IngestModule.IngestModuleException(
"Photorec not found");
483 execName = Paths.get(photorec_linux_directory, PHOTOREC_LINUX_EXECUTABLE);
484 exeFile =
new File(execName.toString());
487 if (null == exeFile) {
488 throw new IngestModule.IngestModuleException(Bundle.missingExecutable_message());
492 if (!exeFile.canExecute()) {
493 throw new IngestModule.IngestModuleException(Bundle.cannotRunExecutable_message());
void fireModuleContentEvent(ModuleContentEvent moduleContentEvent)
synchronized static Logger getLogger(String name)
synchronized Path ipToHostName(Path inputPath)
static synchronized IngestServices getInstance()