FileManager.java

Go to the documentation of this file.

/*
 *
 * Autopsy Forensic Browser
 *
 * Copyright 2011-2018 Basis Technology Corp.
 *
 * Copyright 2012 42six Solutions.
 * Contact: aebadirad <at> 42six <dot> com
 * Project Contact/Architect: carrier <at> sleuthkit <dot> org
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.sleuthkit.autopsy.casemodule.services;

import java.io.Closeable;
import java.io.IOException;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;
import java.util.logging.Level;
import org.openide.util.NbBundle;
import org.sleuthkit.autopsy.datamodel.VirtualDirectoryNode;
import org.sleuthkit.autopsy.ingest.IngestServices;
import org.sleuthkit.autopsy.ingest.ModuleContentEvent;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.Content;
import org.sleuthkit.datamodel.DerivedFile;
import org.sleuthkit.datamodel.LayoutFile;
import org.sleuthkit.datamodel.LocalDirectory;
import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction;
import org.sleuthkit.datamodel.SpecialDirectory;
import org.sleuthkit.datamodel.TskCoreException;
import org.sleuthkit.datamodel.TskFileRange;
import org.sleuthkit.datamodel.VirtualDirectory;
import org.sleuthkit.datamodel.LocalFilesDataSource;
import org.sleuthkit.datamodel.TskDataException;
import org.apache.commons.lang3.StringUtils;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.datamodel.CarvingResult;
import org.sleuthkit.datamodel.TskData;

public class FileManager implements Closeable {

    private static final Logger LOGGER = Logger.getLogger(FileManager.class.getName());
    private SleuthkitCase caseDb;

    public FileManager(SleuthkitCase caseDb) {
        this.caseDb = caseDb;
    }

    public synchronized List<AbstractFile> findFilesByMimeType(Collection<String> mimeTypes) throws TskCoreException {
        if (null == caseDb) {
            throw new TskCoreException("File manager has been closed");
        }
        return caseDb.findAllFilesWhere(createFileTypeInCondition(mimeTypes));
    }
   
    public synchronized List<AbstractFile> findFilesByParentPath(long dataSourceObjectID, String parentPath) throws TskCoreException {
        if (null == caseDb) {
            throw new TskCoreException("File manager has been closed");
        }
        return caseDb.findAllFilesWhere(createParentPathCondition(dataSourceObjectID,parentPath));
    }
  
    public synchronized List<AbstractFile> findFilesByMimeType(Content dataSource, Collection<String> mimeTypes) throws TskCoreException {
        if (null == caseDb) {
            throw new TskCoreException("File manager has been closed");
        }
        return caseDb.findAllFilesWhere("data_source_obj_id = " + dataSource.getId() + " AND " + createFileTypeInCondition(mimeTypes));
    }

    private static String createFileTypeInCondition(Collection<String> mimeTypes) {
        String types = StringUtils.join(mimeTypes, "', '");
        return "mime_type IN ('" + types + "')";
    }

    private static String createParentPathCondition(long dataSourceObjectID, String parentPath){
        return "data_source_obj_id = " + dataSourceObjectID +" AND parent_path LIKE '" + parentPath +"%'";
    }
    
    
    public synchronized List<AbstractFile> findFiles(String fileName) throws TskCoreException {
        if (null == caseDb) {
            throw new TskCoreException("File manager has been closed");
        }
        List<AbstractFile> result = new ArrayList<>();
        List<Content> dataSources = caseDb.getRootObjects();
        for (Content dataSource : dataSources) {
            result.addAll(findFiles(dataSource, fileName));
        }
        return result;
    }

    public synchronized List<AbstractFile> findFiles(String fileName, String parentSubString) throws TskCoreException {
        if (null == caseDb) {
            throw new TskCoreException("File manager has been closed");
        }
        List<AbstractFile> result = new ArrayList<>();
        List<Content> dataSources = caseDb.getRootObjects();
        for (Content dataSource : dataSources) {
            result.addAll(findFiles(dataSource, fileName, parentSubString));
        }
        return result;
    }

    public synchronized List<AbstractFile> findFiles(String fileName, AbstractFile parent) throws TskCoreException {
        if (null == caseDb) {
            throw new TskCoreException("File manager has been closed");
        }
        List<AbstractFile> result = new ArrayList<>();
        List<Content> dataSources = caseDb.getRootObjects();
        for (Content dataSource : dataSources) {
            result.addAll(findFiles(dataSource, fileName, parent));
        }
        return result;
    }

    public synchronized List<AbstractFile> findFiles(Content dataSource, String fileName) throws TskCoreException {
        if (null == caseDb) {
            throw new TskCoreException("File manager has been closed");
        }
        return caseDb.findFiles(dataSource, fileName);
    }

    public synchronized List<AbstractFile> findFiles(Content dataSource, String fileName, String parentSubString) throws TskCoreException {
        if (null == caseDb) {
            throw new TskCoreException("File manager has been closed");
        }
        return caseDb.findFiles(dataSource, fileName, parentSubString);
    }

    public synchronized List<AbstractFile> findFiles(Content dataSource, String fileName, AbstractFile parent) throws TskCoreException {
        if (null == caseDb) {
            throw new TskCoreException("File manager has been closed");
        }
        return findFiles(dataSource, fileName, parent.getName());
    }

    public synchronized List<AbstractFile> openFiles(Content dataSource, String filePath) throws TskCoreException {
        if (null == caseDb) {
            throw new TskCoreException("File manager has been closed");
        }
        return caseDb.openFiles(dataSource, filePath);
    }

    public synchronized DerivedFile addDerivedFile(String fileName,
            String localPath,
            long size,
            long ctime, long crtime, long atime, long mtime,
            boolean isFile,
            Content parentObj,
            String rederiveDetails, String toolName, String toolVersion, String otherDetails,
            TskData.EncodingType encodingType) throws TskCoreException {
        if (null == caseDb) {
            throw new TskCoreException("File manager has been closed");
        }
        return caseDb.addDerivedFile(fileName, localPath, size,
                ctime, crtime, atime, mtime,
                isFile, parentObj, rederiveDetails, toolName, toolVersion, otherDetails, encodingType);
    }
    public synchronized DerivedFile updateDerivedFile(DerivedFile derivedFile, String localPath,
            long size,
            long ctime, long crtime, long atime, long mtime,
            boolean isFile, String mimeType,
            String rederiveDetails, String toolName, String toolVersion, String otherDetails,
            TskData.EncodingType encodingType) throws TskCoreException {
        if (null == caseDb) {
            throw new TskCoreException("File manager has been closed");
        }
        return caseDb.updateDerivedFile(derivedFile, localPath, size,
                ctime, crtime, atime, mtime,
                isFile, mimeType, rederiveDetails, toolName, toolVersion, otherDetails, encodingType);
    }

    public synchronized List<LayoutFile> addCarvedFiles(CarvingResult carvingResult) throws TskCoreException {
        if (null == caseDb) {
            throw new TskCoreException("File manager has been closed");
        }
        return caseDb.addCarvedFiles(carvingResult);
    }

    public interface FileAddProgressUpdater {

        void fileAdded(AbstractFile newFile);
    }

    public synchronized LocalFilesDataSource addLocalFilesDataSource(String deviceId, String rootVirtualDirectoryName, String timeZone, List<String> localFilePaths, FileAddProgressUpdater progressUpdater) throws TskCoreException, TskDataException {
        if (null == caseDb) {
            throw new TskCoreException("File manager has been closed");
        }
        List<java.io.File> localFiles = getFilesAndDirectories(localFilePaths);
        CaseDbTransaction trans = null;
        try {
            String rootDirectoryName = rootVirtualDirectoryName;
            if (rootDirectoryName.isEmpty()) {
                rootDirectoryName = generateFilesDataSourceName(caseDb);
            }

            /*
             * Add the root virtual directory and its local/logical file
             * children to the case database.
             */
            trans = caseDb.beginTransaction();
            LocalFilesDataSource dataSource = caseDb.addLocalFilesDataSource(deviceId, rootDirectoryName, timeZone, trans);
            List<AbstractFile> filesAdded = new ArrayList<>();
            for (java.io.File localFile : localFiles) {
                AbstractFile fileAdded = addLocalFile(trans, dataSource, localFile, TskData.EncodingType.NONE, progressUpdater);
                if (null != fileAdded) {
                    filesAdded.add(fileAdded);
                } else {
                    throw new TskCoreException(NbBundle.getMessage(this.getClass(), "FileManager.addLocalFilesDirs.exception.cantAdd.msg", localFile.getAbsolutePath()));
                }
            }
            trans.commit();
            trans = null;

            /*
             * Publish content added events for the added files and directories.
             */
            for (AbstractFile fileAdded : filesAdded) {
                IngestServices.getInstance().fireModuleContentEvent(new ModuleContentEvent(fileAdded));
            }

            return dataSource;

        } finally {
            if (null != trans) {
                try {
                    trans.rollback();
                } catch (TskCoreException ex) {
                    LOGGER.log(Level.SEVERE, "Failed to rollback transaction after exception", ex);
                }
            }
        }
    }

    private static synchronized String generateFilesDataSourceName(SleuthkitCase caseDb) throws TskCoreException {
        int localFileDataSourcesCounter = 0;
        try {
            List<VirtualDirectory> localFileDataSources = caseDb.getVirtualDirectoryRoots();
            for (VirtualDirectory vd : localFileDataSources) {
                if (vd.getName().startsWith(VirtualDirectoryNode.LOGICAL_FILE_SET_PREFIX)) {
                    ++localFileDataSourcesCounter;
                }
            }
            return VirtualDirectoryNode.LOGICAL_FILE_SET_PREFIX + (localFileDataSourcesCounter + 1);
        } catch (TskCoreException ex) {
            throw new TskCoreException("Error querying for existing local file data sources with defualt names", ex);
        }
    }

    private List<java.io.File> getFilesAndDirectories(List<String> localFilePaths) throws TskDataException {
        List<java.io.File> localFiles = new ArrayList<>();
        for (String path : localFilePaths) {
            java.io.File localFile = new java.io.File(path);
            if (!localFile.exists() || !localFile.canRead()) {
                throw new TskDataException(String.format("File at %s does not exist or cannot be read", localFile.getAbsolutePath()));
            }
            localFiles.add(localFile);
        }
        return localFiles;
    }

    private AbstractFile addLocalFile(CaseDbTransaction trans, SpecialDirectory parentDirectory, java.io.File localFile,
            TskData.EncodingType encodingType, FileAddProgressUpdater progressUpdater) throws TskCoreException {
        if (localFile.isDirectory()) {
            /*
             * Add the directory as a local directory.
             */
            LocalDirectory localDirectory = caseDb.addLocalDirectory(parentDirectory.getId(), localFile.getName(), trans);
            progressUpdater.fileAdded(localDirectory);

            /*
             * Add its children, if any.
             */
            final java.io.File[] childFiles = localFile.listFiles();
            if (childFiles != null && childFiles.length > 0) {
                for (java.io.File childFile : childFiles) {
                    addLocalFile(trans, localDirectory, childFile, progressUpdater);
                }
            }

            return localDirectory;
        } else {
            return caseDb.addLocalFile(localFile.getName(), localFile.getAbsolutePath(), localFile.length(),
                    0, 0, 0, 0,
                    localFile.isFile(), encodingType, parentDirectory, trans);
        }
    }

    @Override
    public synchronized void close() throws IOException {
        caseDb = null;
    }

    @Deprecated
    public synchronized VirtualDirectory addLocalFilesDirs(List<String> localFilePaths, FileAddProgressUpdater progressUpdater) throws TskCoreException {
        if (null == caseDb) {
            throw new TskCoreException("File manager has been closed");
        }
        try {
            return addLocalFilesDataSource("", "", "", localFilePaths, progressUpdater).getRootDirectory();
        } catch (TskDataException ex) {
            throw new TskCoreException(ex.getLocalizedMessage(), ex);
        }
    }

    @Deprecated
    public synchronized LayoutFile addCarvedFile(String fileName, long fileSize, long parentObjId, List<TskFileRange> layout) throws TskCoreException {
        if (null == caseDb) {
            throw new TskCoreException("File manager has been closed");
        }
        Content parent = caseDb.getContentById(parentObjId);
        List<CarvingResult.CarvedFile> carvedFiles = new ArrayList<>();
        carvedFiles.add(new CarvingResult.CarvedFile(fileName, fileSize, layout));
        List<LayoutFile> layoutFiles = caseDb.addCarvedFiles(new CarvingResult(parent, carvedFiles));
        return layoutFiles.get(0);
    }

    @Deprecated
    public synchronized List<LayoutFile> addCarvedFiles(List<org.sleuthkit.datamodel.CarvedFileContainer> filesToAdd) throws TskCoreException {
        if (null == caseDb) {
            throw new TskCoreException("File manager has been closed");
        }
        return caseDb.addCarvedFiles(filesToAdd);
    }

    @Deprecated
    public synchronized DerivedFile addDerivedFile(String fileName,
            String localPath,
            long size,
            long ctime, long crtime, long atime, long mtime,
            boolean isFile,
            AbstractFile parentFile,
            String rederiveDetails, String toolName, String toolVersion, String otherDetails) throws TskCoreException {
        return addDerivedFile(fileName, localPath, size, ctime, crtime, atime, mtime, isFile, parentFile,
                rederiveDetails, toolName, toolVersion, otherDetails, TskData.EncodingType.NONE);
    }

    @Deprecated
    private AbstractFile addLocalFile(CaseDbTransaction trans, SpecialDirectory parentDirectory, java.io.File localFile, FileAddProgressUpdater progressUpdater) throws TskCoreException {
        return addLocalFile(trans, parentDirectory, localFile, TskData.EncodingType.NONE, progressUpdater);
    }

}