InterestingItemsFilesSetSettings.java

Go to the documentation of this file.

/*
 * Autopsy Forensic Browser
 *
 * Copyright 2011-2018 Basis Technology Corp.
 * Contact: carrier <at> sleuthkit <dot> org
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.sleuthkit.autopsy.modules.interestingitems;

import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.Serializable;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.logging.Level;
import java.util.regex.Pattern;
import java.util.regex.PatternSyntaxException;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;
import org.openide.util.io.NbObjectInputStream;
import org.openide.util.io.NbObjectOutputStream;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.coreutils.PlatformUtil;
import org.sleuthkit.autopsy.coreutils.XMLUtil;
import org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.FileNameCondition;
import org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.FileSizeCondition;
import org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.MetaTypeCondition;
import org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.MimeTypeCondition;
import org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.ParentPathCondition;
import org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.DateCondition;
import org.w3c.dom.Document;
import org.w3c.dom.Element;
import org.w3c.dom.NodeList;

class InterestingItemsFilesSetSettings implements Serializable {

    private static final long serialVersionUID = 1L;
    // The following tags and attributes are identical to those used in the
    // TSK Framework FilesSet definitions file schema.
    private static final String FILE_SETS_ROOT_TAG = "INTERESTING_FILE_SETS"; //NON-NLS
    private static final String DESC_ATTR = "description"; //NON-NLS
    private static final String IGNORE_KNOWN_FILES_ATTR = "ignoreKnown"; //NON-NLS
    private static final String PATH_REGEX_ATTR = "pathRegex"; //NON-NLS
    private static final String TYPE_FILTER_VALUE_ALL = "all";
    private static final String TYPE_FILTER_VALUE_FILES_AND_DIRS = "files_and_dirs"; //NON-NLS
    private static final String IGNORE_UNALLOCATED_SPACE = "ingoreUnallocated"; //NON-NLS
    private static final String PATH_FILTER_ATTR = "pathFilter"; //NON-NLS
    private static final String TYPE_FILTER_VALUE_DIRS = "dir"; //NON-NLS
    private static final String REGEX_ATTR = "regex"; //NON-NLS
    private static final List<String> illegalFileNameChars = FilesSetsManager.getIllegalFileNameChars();
    private static final String FILE_SET_TAG = "INTERESTING_FILE_SET"; //NON-NLS
    private static final String NAME_RULE_TAG = "NAME"; //NON-NLS
    private static final String NAME_ATTR = "name"; //NON-NLS
    private static final String DAYS_INCLUDED_ATTR = "daysIncluded";
    private static final String MIME_ATTR = "mimeType";
    private static final String FS_COMPARATOR_ATTR = "comparatorSymbol";
    private static final String FS_SIZE_ATTR = "sizeValue";
    private static final String FS_UNITS_ATTR = "sizeUnits";
    private static final String TYPE_FILTER_VALUE_FILES = "file"; //NON-NLS
    private static final String XML_ENCODING = "UTF-8"; //NON-NLS
    private static final Logger logger = Logger.getLogger(InterestingItemsFilesSetSettings.class.getName());
    private static final String TYPE_FILTER_ATTR = "typeFilter"; //NON-NLS
    private static final String EXTENSION_RULE_TAG = "EXTENSION"; //NON-NLS

    private Map<String, FilesSet> filesSets;

    InterestingItemsFilesSetSettings(Map<String, FilesSet> filesSets) {
        this.filesSets = filesSets;
    }

    Map<String, FilesSet> getFilesSets() {
        return filesSets;
    }

    private static String readRuleName(Element elem) {
        // The rule must have a name.
        String ruleName = elem.getAttribute(NAME_ATTR);
        return ruleName;
    }

    private static Map<String, FilesSet> readSerializedDefinitions(String serialFileName) throws FilesSetsManager.FilesSetsManagerException {
        Path filePath = Paths.get(PlatformUtil.getUserConfigDirectory(), serialFileName);
        File fileSetFile = filePath.toFile();
        String filePathStr = filePath.toString();
        if (fileSetFile.exists()) {
            try {
                try (final NbObjectInputStream in = new NbObjectInputStream(new FileInputStream(filePathStr))) {
                    InterestingItemsFilesSetSettings filesSetsSettings = (InterestingItemsFilesSetSettings) in.readObject();
                    return filesSetsSettings.getFilesSets();
                }
            } catch (IOException | ClassNotFoundException ex) {
                throw new FilesSetsManager.FilesSetsManagerException(String.format("Failed to read settings from %s", filePathStr), ex);
            }
        } else {
            return new HashMap<>();
        }
    }

    private static ParentPathCondition readPathCondition(Element ruleElement) throws FilesSetsManager.FilesSetsManagerException {
        // Read in the optional path condition. Null is o.k., but if the attribute
        // is there, be sure it is not malformed.
        ParentPathCondition pathCondition = null;
        if (!ruleElement.getAttribute(PATH_FILTER_ATTR).isEmpty() || !ruleElement.getAttribute(PATH_REGEX_ATTR).isEmpty()) {
            String path = ruleElement.getAttribute(PATH_FILTER_ATTR);
            String pathRegex = ruleElement.getAttribute(PATH_REGEX_ATTR);
            if (!pathRegex.isEmpty() && path.isEmpty()) {
                try {
                    Pattern pattern = Pattern.compile(pathRegex);
                    pathCondition = new ParentPathCondition(pattern);
                } catch (PatternSyntaxException ex) {
                    logger.log(Level.SEVERE, "Error compiling " + PATH_REGEX_ATTR + " regex, ignoring malformed path condition definition", ex); // NON-NLS
                    throw new FilesSetsManager.FilesSetsManagerException(String.format("error compiling %s regex", PATH_REGEX_ATTR), ex);
                }
            } else if (!path.isEmpty() && pathRegex.isEmpty()) {
                pathCondition = new ParentPathCondition(path);
            }
            if (pathCondition == null) {
                // Malformed attribute.
                throw new FilesSetsManager.FilesSetsManagerException(String.format("Error creating path condition for rule %s", readRuleName(ruleElement)));
            }
        }
        return pathCondition;
    }

    private static DateCondition readDateCondition(Element ruleElement) throws FilesSetsManager.FilesSetsManagerException {
        // Read in the optional path condition. Null is o.k., but if the attribute
        // is there, be sure it is not malformed.
        DateCondition dateCondition = null;
        if (!ruleElement.getAttribute(DAYS_INCLUDED_ATTR).isEmpty()) {
            String daysIncluded = ruleElement.getAttribute(DAYS_INCLUDED_ATTR);
            if (!daysIncluded.isEmpty()) {
                try {
                    dateCondition = new DateCondition(Integer.parseInt(daysIncluded));
                } catch (NumberFormatException ex) {
                    logger.log(Level.SEVERE, "Error creating condition for " + daysIncluded + ", ignoring malformed date condition definition", ex); // NON-NLS
                    throw new FilesSetsManager.FilesSetsManagerException(String.format("error compiling %s regex", DAYS_INCLUDED_ATTR), ex);
                }
            }
        }
        return dateCondition;
    }

    private static Pattern compileRegex(String regex) {
        try {
            return Pattern.compile(regex);
        } catch (PatternSyntaxException ex) {
            logger.log(Level.SEVERE, "Error compiling rule regex: " + ex.getMessage(), ex); // NON-NLS
            return null;
        }
    }

    private static FilesSet.Rule readRule(Element elem) throws FilesSetsManager.FilesSetsManagerException {
        String ruleName = readRuleName(elem);
        FileNameCondition nameCondition = readNameCondition(elem);
        MetaTypeCondition metaCondition = readMetaTypeCondition(elem);
        ParentPathCondition pathCondition = readPathCondition(elem);
        MimeTypeCondition mimeCondition = readMimeCondition(elem);
        FileSizeCondition sizeCondition = readSizeCondition(elem);
        DateCondition dateCondition = readDateCondition(elem); //if meta type condition or all four types of conditions the user can create are all null then don't make the rule
        if (metaCondition == null || (nameCondition == null && pathCondition == null && mimeCondition == null && sizeCondition == null && dateCondition == null)) {
            logger.log(Level.WARNING, "Error Reading Rule, " + ruleName + " was either missing a meta condition or contained only a meta condition. No rule was imported."); // NON-NLS
            throw new FilesSetsManager.FilesSetsManagerException(String.format("Invalid Rule in FilesSet xml, missing necessary conditions for %s", ruleName));
        }
        return new FilesSet.Rule(ruleName, nameCondition, metaCondition, pathCondition, mimeCondition, sizeCondition, dateCondition);
    }

    private static FileNameCondition readNameCondition(Element elem) throws FilesSetsManager.FilesSetsManagerException {
        FileNameCondition nameCondition = null;
        String content = elem.getTextContent();
        String regex = elem.getAttribute(REGEX_ATTR);
        if (content != null && !content.isEmpty()) {  //if there isn't content this is not a valid name condition
            if ((!regex.isEmpty() && regex.equalsIgnoreCase("true")) || content.contains("*")) { // NON-NLS
                Pattern pattern = compileRegex(content);
                if (pattern != null) {
                    if (elem.getTagName().equals(NAME_RULE_TAG)) {
                        nameCondition = new FilesSet.Rule.FullNameCondition(pattern);
                    } else if (elem.getTagName().equals(EXTENSION_RULE_TAG)) {
                        nameCondition = new FilesSet.Rule.ExtensionCondition(pattern);
                    } else {
                        throw new FilesSetsManager.FilesSetsManagerException(String.format("Name condition has invalid tag name of %s for rule %s", elem.getTagName(), readRuleName(elem)));
                    }
                } else {
                    logger.log(Level.SEVERE, "Error compiling " + elem.getTagName() + " regex, ignoring malformed '{0}' rule definition", readRuleName(elem)); // NON-NLS
                    throw new FilesSetsManager.FilesSetsManagerException(String.format("error compiling %s regex in rule %s", REGEX_ATTR, readRuleName(elem)));
                }
            } else {
                for (String illegalChar : illegalFileNameChars) {
                    if (content.contains(illegalChar)) {
                        logger.log(Level.SEVERE, elem.getTagName() + " content has illegal chars, ignoring malformed '{0}' rule definition", new Object[]{elem.getTagName(), readRuleName(elem)}); // NON-NLS
                        throw new FilesSetsManager.FilesSetsManagerException(String.format("File name has illegal character of %s in rule %s", illegalChar, readRuleName(elem)));
                    }
                }
                if (elem.getTagName().equals(NAME_RULE_TAG)) {
                    nameCondition = new FilesSet.Rule.FullNameCondition(content);
                } else if (elem.getTagName().equals(EXTENSION_RULE_TAG)) {
                    nameCondition = new FilesSet.Rule.ExtensionCondition(content);
                }
            }
        }
        return nameCondition;
    }

    private static MimeTypeCondition readMimeCondition(Element elem) {
        MimeTypeCondition mimeCondition = null;
        if (!elem.getAttribute(MIME_ATTR).isEmpty()) {
            mimeCondition = new MimeTypeCondition(elem.getAttribute(MIME_ATTR));
            //no checks on mime type here which means
            //if they import a rule with a custom MIME type they don't have
            //the rule will not get any hits
        }
        return mimeCondition;
    }

    private static FileSizeCondition readSizeCondition(Element elem) throws FilesSetsManager.FilesSetsManagerException {
        FileSizeCondition sizeCondition = null;
        if (!elem.getAttribute(FS_COMPARATOR_ATTR).isEmpty() && !elem.getAttribute(FS_SIZE_ATTR).isEmpty() && !elem.getAttribute(FS_UNITS_ATTR).isEmpty()) {
            try {  //incase they modified the xml manually to invalid comparator, size unit, or non integer string for size
                FileSizeCondition.COMPARATOR comparator = FileSizeCondition.COMPARATOR.fromSymbol(elem.getAttribute(FS_COMPARATOR_ATTR));
                FileSizeCondition.SIZE_UNIT sizeUnit = FileSizeCondition.SIZE_UNIT.fromName(elem.getAttribute(FS_UNITS_ATTR));
                int size = Integer.parseInt(elem.getAttribute(FS_SIZE_ATTR));
                sizeCondition = new FileSizeCondition(comparator, sizeUnit, size);
            } catch (NumberFormatException nfEx) {
                logger.log(Level.SEVERE, "Value in file size attribute was not an integer, unable to create FileSizeCondition for rule: " + readRuleName(elem), nfEx);
                throw new FilesSetsManager.FilesSetsManagerException(String.format("Non integer size in FilesSet XML for rule %s", readRuleName(elem)), nfEx);
            } catch (IllegalArgumentException iaEx) {
                logger.log(Level.SEVERE, "Invalid Comparator symbol or Size Unit set in FilesSet xml, unable to create FileSizeCondition for rule: " + readRuleName(elem), iaEx);
                throw new FilesSetsManager.FilesSetsManagerException(String.format("Invalid Comparator or Size unit in FilesSet XML for rule %s", readRuleName(elem)), iaEx);
            }
        } //if all of them aren't populated but some of them are this is a malformed xml
        else if (!elem.getAttribute(FS_COMPARATOR_ATTR).isEmpty() || !elem.getAttribute(FS_SIZE_ATTR).isEmpty() || !elem.getAttribute(FS_UNITS_ATTR).isEmpty()) {
            logger.log(Level.SEVERE, "Invalid Comparator symbol or Size Unit set in FilesSet xml, unable to create FileSizeCondition for rule: " + readRuleName(elem));
            throw new FilesSetsManager.FilesSetsManagerException(String.format("XML malformed missing at least one fileSize attribute for rule %s", readRuleName(elem)));
        }
        return sizeCondition;
    }

    private static void readFilesSet(Element setElem, Map<String, FilesSet> filesSets, String filePath) throws FilesSetsManager.FilesSetsManagerException {
        // The file set must have a unique name.
        String setName = setElem.getAttribute(NAME_ATTR);
        if (setName.isEmpty()) {
            logger.log(Level.SEVERE, "Found {0} element without required {1} attribute, ignoring malformed file set definition in FilesSet definition file at {2}", new Object[]{FILE_SET_TAG, NAME_ATTR, filePath}); // NON-NLS
            return;
        }
        if (filesSets.containsKey(setName)) {
            logger.log(Level.SEVERE, "Found duplicate definition of set named {0} in FilesSet definition file at {1}, discarding duplicate set", new Object[]{setName, filePath}); // NON-NLS
            return;
        }
        // The file set may have a description. The empty string is o.k.
        String description = setElem.getAttribute(DESC_ATTR);
        // The file set may or may not ignore known files. The default behavior
        // is to not ignore them.
        String ignoreKnown = setElem.getAttribute(IGNORE_KNOWN_FILES_ATTR);
        boolean ignoreKnownFiles = false;
        if (!ignoreKnown.isEmpty()) {
            ignoreKnownFiles = Boolean.parseBoolean(ignoreKnown);
        }
        // The file set may or may not skip unallocated space. The default behavior
        // is not to skip it.
        String ignoreUnallocated = setElem.getAttribute(IGNORE_UNALLOCATED_SPACE);
        boolean ignoreUnallocatedSpace = false;
        if (!ignoreUnallocated.isEmpty()) {
            ignoreUnallocatedSpace = Boolean.parseBoolean(ignoreUnallocated);
        }
        // Read the set membership rules, if any.
        Map<String, FilesSet.Rule> rules = new HashMap<>();
        NodeList allRuleElems = setElem.getChildNodes();
        for (int j = 0; j < allRuleElems.getLength(); ++j) {
            if (allRuleElems.item(j) instanceof Element) {  //All the children we need to parse here are elements
                Element elem = (Element) allRuleElems.item(j);
                FilesSet.Rule rule = readRule(elem);
                if (rule != null) {
                    if (!rules.containsKey(rule.getUuid())) {
                        rules.put(rule.getUuid(), rule);
                    } else {
                        logger.log(Level.SEVERE, "Found duplicate rule {0} for set named {1} in FilesSet definition file at {2}, discarding malformed set", new Object[]{rule.getUuid(), setName, filePath}); // NON-NLS
                        return;
                    }
                } else {
                    logger.log(Level.SEVERE, "Found malformed rule for set named {0} in FilesSet definition file at {1}, discarding malformed set", new Object[]{setName, filePath}); // NON-NLS
                    return;
                }
            }
        }
        // Make the files set. Note that degenerate sets with no rules are
        // allowed to facilitate the separation of set definition and rule
        // definitions. A set without rules is simply the empty set.
        FilesSet set = new FilesSet(setName, description, ignoreKnownFiles, ignoreUnallocatedSpace, rules);
        filesSets.put(set.getName(), set);
    }
    // Note: This method takes a file path to support the possibility of
    // multiple intersting files set definition files, e.g., one for
    // definitions that ship with Autopsy and one for user definitions.

    static Map<String, FilesSet> readDefinitionsFile(String fileName, String legacyFileName) throws FilesSetsManager.FilesSetsManagerException {
        Map<String, FilesSet> filesSets = readSerializedDefinitions(fileName);
        if (!filesSets.isEmpty()) {
            return filesSets;
        }
        // Check if the legacy xml file exists.
        if (!legacyFileName.isEmpty()) {
            return readDefinitionsXML(Paths.get(PlatformUtil.getUserConfigDirectory(), legacyFileName).toFile());
        }
        return filesSets;
    }

    static Map<String, FilesSet> readDefinitionsXML(File xmlFile) throws FilesSetsManager.FilesSetsManagerException {
        Map<String, FilesSet> filesSets = new HashMap<>();
        if (!xmlFile.exists()) {
            return filesSets;
        }
        // Check if the file can be read.
        if (!xmlFile.canRead()) {
            logger.log(Level.SEVERE, "FilesSet definition file at {0} exists, but cannot be read", xmlFile.getPath()); // NON-NLS
            return filesSets;
        }
        // Parse the XML in the file.
        Document doc = XMLUtil.loadDoc(InterestingItemsFilesSetSettings.class, xmlFile.getPath());
        if (doc == null) {
            logger.log(Level.SEVERE, "FilesSet definition file at {0}", xmlFile.getPath()); // NON-NLS
            return filesSets;
        }
        // Get the root element.
        Element root = doc.getDocumentElement();
        if (root == null) {
            logger.log(Level.SEVERE, "Failed to get root {0} element tag of FilesSet definition file at {1}", new Object[]{FILE_SETS_ROOT_TAG, xmlFile.getPath()}); // NON-NLS
            return filesSets;
        }
        // Read in the files set definitions.
        NodeList setElems = root.getElementsByTagName(FILE_SET_TAG);
        for (int i = 0; i < setElems.getLength(); ++i) {
            readFilesSet((Element) setElems.item(i), filesSets, xmlFile.getPath());
        }
        return filesSets;
    }

    // Note: This method takes a file path to support the possibility of
    // multiple intersting files set definition files, e.g., one for
    // definitions that ship with Autopsy and one for user definitions.
    static boolean writeDefinitionsFile(String fileName, Map<String, FilesSet> interestingFilesSets) throws FilesSetsManager.FilesSetsManagerException {
        try (final NbObjectOutputStream out = new NbObjectOutputStream(new FileOutputStream(Paths.get(PlatformUtil.getUserConfigDirectory(), fileName).toString()))) {
            out.writeObject(new InterestingItemsFilesSetSettings(interestingFilesSets));
        } catch (IOException ex) {
            throw new FilesSetsManager.FilesSetsManagerException(String.format("Failed to write settings to %s", fileName), ex);
        }
        return true;
    }

    static boolean exportXmlDefinitionsFile(File xmlFile, List<FilesSet> interestingFilesSets) {
        DocumentBuilderFactory docBuilderFactory = DocumentBuilderFactory.newInstance();
        try {
            // Create the new XML document.
            DocumentBuilder docBuilder = docBuilderFactory.newDocumentBuilder();
            Document doc = docBuilder.newDocument();
            Element rootElement = doc.createElement(FILE_SETS_ROOT_TAG);
            doc.appendChild(rootElement);
            // Add the interesting files sets to the document.
            for (FilesSet set : interestingFilesSets) {
                // Add the files set element and its attributes.
                Element setElement = doc.createElement(FILE_SET_TAG);
                setElement.setAttribute(NAME_ATTR, set.getName());
                setElement.setAttribute(DESC_ATTR, set.getDescription());
                setElement.setAttribute(IGNORE_KNOWN_FILES_ATTR, Boolean.toString(set.ignoresKnownFiles()));
                // Add the child elements for the set membership rules.
                // All conditions of a rule will be written as a single element in the xml
                for (FilesSet.Rule rule : set.getRules().values()) {
                    // Add a rule element with the appropriate name Condition 
                    // type tag.
                    Element ruleElement;

                    FileNameCondition nameCondition = rule.getFileNameCondition();
                    //The element type is just being used as another attribute for 
                    //the name condition in legacy xmls.
                    //For rules which don't contain a name condition it doesn't matter
                    //what type of element it is 
                    if (nameCondition instanceof FilesSet.Rule.FullNameCondition) {
                        ruleElement = doc.createElement(NAME_RULE_TAG);
                    } else {
                        ruleElement = doc.createElement(EXTENSION_RULE_TAG);
                    }
                    // Add the optional rule name attribute.
                    ruleElement.setAttribute(NAME_ATTR, rule.getName());
                    if (nameCondition != null) {
                        // Add the name Condition regex attribute
                        ruleElement.setAttribute(REGEX_ATTR, Boolean.toString(nameCondition.isRegex()));
                        // Add the name Condition text as the rule element content.
                        ruleElement.setTextContent(nameCondition.getTextToMatch());
                    }
                    // Add the type Condition attribute.
                    MetaTypeCondition typeCondition = rule.getMetaTypeCondition();
                    switch (typeCondition.getMetaType()) {
                        case FILES:
                            ruleElement.setAttribute(TYPE_FILTER_ATTR, TYPE_FILTER_VALUE_FILES);
                            break;
                        case DIRECTORIES:
                            ruleElement.setAttribute(TYPE_FILTER_ATTR, TYPE_FILTER_VALUE_DIRS);
                            break;
                        default:
                            ruleElement.setAttribute(TYPE_FILTER_ATTR, TYPE_FILTER_VALUE_ALL);
                            break;
                    }
                    // Add the optional path Condition.
                    ParentPathCondition pathCondition = rule.getPathCondition();
                    if (pathCondition != null) {
                        if (pathCondition.isRegex()) {
                            ruleElement.setAttribute(PATH_REGEX_ATTR, pathCondition.getTextToMatch());
                        } else {
                            ruleElement.setAttribute(PATH_FILTER_ATTR, pathCondition.getTextToMatch());
                        }
                    }
                    //Add the optional MIME type condition
                    MimeTypeCondition mimeCondition = rule.getMimeTypeCondition();
                    if (mimeCondition != null) {
                        ruleElement.setAttribute(MIME_ATTR, mimeCondition.getMimeType());
                    }
                    //Add the optional file size condition
                    FileSizeCondition sizeCondition = rule.getFileSizeCondition();
                    if (sizeCondition != null) {
                        ruleElement.setAttribute(FS_COMPARATOR_ATTR, sizeCondition.getComparator().getSymbol());
                        ruleElement.setAttribute(FS_SIZE_ATTR, Integer.toString(sizeCondition.getSizeValue()));
                        ruleElement.setAttribute(FS_UNITS_ATTR, sizeCondition.getUnit().getName());
                    }
                    
                     //Add the optional date condition
                    DateCondition dateCondition = rule.getDateCondition();
                    if (dateCondition != null) {
                        ruleElement.setAttribute(DAYS_INCLUDED_ATTR, Integer.toString(dateCondition.getDaysIncluded()));
                    }
                    
                    setElement.appendChild(ruleElement);
                }
                rootElement.appendChild(setElement);
            }
            // Overwrite the previous definitions file. Note that the utility 
            // method logs an error on failure.
            return XMLUtil.saveDoc(InterestingItemsFilesSetSettings.class, xmlFile.getPath(), XML_ENCODING, doc);
        } catch (ParserConfigurationException ex) {
            logger.log(Level.SEVERE, "Error writing interesting files definition file to " + xmlFile.getPath(), ex); // NON-NLS
            return false;
        }
    }

    private static MetaTypeCondition readMetaTypeCondition(Element ruleElement) throws FilesSetsManager.FilesSetsManagerException {
        MetaTypeCondition metaCondition = null;
        // The rule must have a meta-type condition, unless a TSK Framework
        // definitions file is being read.
        if (!ruleElement.getAttribute(TYPE_FILTER_ATTR).isEmpty()) {
            String conditionAttribute = ruleElement.getAttribute(TYPE_FILTER_ATTR);
            if (!conditionAttribute.isEmpty()) {
                switch (conditionAttribute) {
                    case TYPE_FILTER_VALUE_FILES:
                        metaCondition = new MetaTypeCondition(MetaTypeCondition.Type.FILES);
                        break;
                    case TYPE_FILTER_VALUE_DIRS:
                        metaCondition = new MetaTypeCondition(MetaTypeCondition.Type.DIRECTORIES);
                        break;
                    case TYPE_FILTER_VALUE_ALL:
                    case TYPE_FILTER_VALUE_FILES_AND_DIRS:  //converts legacy xmls to current metaCondition terms
                        metaCondition = new MetaTypeCondition(MetaTypeCondition.Type.ALL);
                        break;
                    default:
                        logger.log(Level.SEVERE, "Found {0} " + TYPE_FILTER_ATTR + " attribute with unrecognized value ''{0}'', ignoring malformed rule definition", conditionAttribute); // NON-NLS
                        // Malformed attribute.
                        throw new FilesSetsManager.FilesSetsManagerException(String.format("Malformed XML for Metatype condition, %s, in rule %s", conditionAttribute, readRuleName(ruleElement)));
                }
            }
        }
        if (metaCondition == null) {
            // Accept TSK Framework FilesSet definitions,
            // default to files.
            metaCondition = new MetaTypeCondition(MetaTypeCondition.Type.FILES);
        }
        return metaCondition;
    }
}