Autopsy  3.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
EvaluatableObject.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2013 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.modules.stix;
20 
21 import java.util.ArrayList;
22 import java.util.List;
23 import org.mitre.cybox.common_2.ConditionApplicationEnum;
24 import org.mitre.cybox.common_2.ConditionTypeEnum;
25 import org.mitre.cybox.common_2.StringObjectPropertyType;
31 
35 abstract class EvaluatableObject {
36 
37  private String warnings;
38  protected String id;
39  protected String spacing;
40 
41  abstract public ObservableResult evaluate();
42 
48  public void setWarnings(String a_warnings) {
49  warnings = a_warnings;
50  }
51 
58  public String getWarnings() {
59  return warnings;
60  }
61 
67  public void addWarning(String a_newWarning) {
68  if ((warnings == null) || warnings.isEmpty()) {
69  warnings = a_newWarning;
70  return;
71  }
72  warnings = warnings + ", " + a_newWarning;
73  }
74 
85  public List<BlackboardArtifact> findArtifactsBySubstring(StringObjectPropertyType item,
86  BlackboardAttribute.ATTRIBUTE_TYPE attrType) throws TskCoreException {
87 
88  if (item.getValue() == null) {
89  throw new TskCoreException("Error: Value field is null"); //NON-NLS
90  }
91 
92  if (item.getCondition() == null) {
93  addWarning("Warning: No condition given for " + attrType.getDisplayName() + " field, using substring comparison"); //NON-NLS
94  } else if (item.getCondition() != ConditionTypeEnum.CONTAINS) {
95  addWarning("Warning: Ignoring condition " + item.getCondition() + " for " //NON-NLS
96  + attrType.getDisplayName() + " field and doing substring comparison"); //NON-NLS
97  }
98 
99  List<BlackboardArtifact> hits = null;
100  try {
101  Case case1 = Case.getCurrentCase();
102  SleuthkitCase sleuthkitCase = case1.getSleuthkitCase();
103 
104  String[] parts = item.getValue().toString().split("##comma##"); //NON-NLS
105 
106  if ((item.getApplyCondition() == null)
107  || (item.getApplyCondition() == ConditionApplicationEnum.ANY)) {
108 
109  for (String part : parts) {
110  if (hits == null) {
111  // Note that this searches for artifacts with "part" as a substring
112  hits = sleuthkitCase.getBlackboardArtifacts(
113  attrType,
114  part, false);
115  } else {
116  hits.addAll(sleuthkitCase.getBlackboardArtifacts(
117  attrType,
118  part, false));
119  }
120  }
121  } else if ((item.getApplyCondition() != null)
122  || (item.getApplyCondition() == ConditionApplicationEnum.ALL)) {
123 
124  boolean firstRound = true;
125  for (String part : parts) {
126  if (firstRound) {
127  hits = sleuthkitCase.getBlackboardArtifacts(
128  attrType,
129  part, false);
130  firstRound = false;
131  } else if (hits != null) {
132  hits.retainAll(sleuthkitCase.getBlackboardArtifacts(
133  attrType,
134  part, false));
135  } else {
136  // After first round; hits is still null
137  // I don't think this should happen but if it does we're done
138  return new ArrayList<BlackboardArtifact>();
139  }
140  }
141  } else {
142  throw new TskCoreException("Error: Can not apply NONE condition in search"); //NON-NLS
143  }
144  } catch (TskCoreException ex) {
145  addWarning(ex.getLocalizedMessage());
146  }
147 
148  return hits;
149  }
150 
159  public static boolean compareStringObject(StringObjectPropertyType stringObj, String strField)
160  throws TskCoreException {
161  if (stringObj.getValue() == null) {
162  throw new TskCoreException("Error: Value field is null"); //NON-NLS
163  }
164 
165  String valueStr = stringObj.getValue().toString();
166  ConditionTypeEnum condition = stringObj.getCondition();
167  ConditionApplicationEnum applyCondition = stringObj.getApplyCondition();
168 
169  return compareStringObject(valueStr, condition, applyCondition, strField);
170  }
171 
182  public static boolean compareStringObject(String valueStr, ConditionTypeEnum condition,
183  ConditionApplicationEnum applyCondition, String strField)
184  throws TskCoreException {
185 
186  if (valueStr == null) {
187  throw new TskCoreException("Error: Value field is null"); //NON-NLS
188  }
189 
190  String[] parts = valueStr.split("##comma##"); //NON-NLS
191  String lowerFieldName = strField.toLowerCase();
192 
193  for (String value : parts) {
194  boolean partialResult;
195  if ((condition == null)
196  || (condition == ConditionTypeEnum.EQUALS)) {
197  partialResult = value.equalsIgnoreCase(strField);
198  } else if (condition == ConditionTypeEnum.DOES_NOT_EQUAL) {
199  partialResult = !value.equalsIgnoreCase(strField);
200  } else if (condition == ConditionTypeEnum.CONTAINS) {
201  partialResult = lowerFieldName.contains(value.toLowerCase());
202  } else if (condition == ConditionTypeEnum.DOES_NOT_CONTAIN) {
203  partialResult = !lowerFieldName.contains(value.toLowerCase());
204  } else if (condition == ConditionTypeEnum.STARTS_WITH) {
205  partialResult = lowerFieldName.startsWith(value.toLowerCase());
206  } else if (condition == ConditionTypeEnum.ENDS_WITH) {
207  partialResult = lowerFieldName.endsWith(value.toLowerCase());
208  } else {
209  throw new TskCoreException("Could not process condition " + condition.value() + " on " + value); //NON-NLS
210  }
211 
212  // Do all the short-circuiting
213  if (applyCondition == ConditionApplicationEnum.NONE) {
214  if (partialResult == true) {
215  // Failed
216  return false;
217  }
218  } else if (applyCondition == ConditionApplicationEnum.ALL) {
219  if (partialResult == false) {
220  // Failed
221  return false;
222  }
223  } else {
224  // Default is "any"
225  if (partialResult == true) {
226  return true;
227  }
228  }
229  }
230 
231  // At this point we're done and didn't short-circuit, so ALL or NONE conditions were true,
232  // and ANY was false
233  if ((applyCondition == ConditionApplicationEnum.NONE)
234  || (applyCondition == ConditionApplicationEnum.ALL)) {
235  return true;
236  }
237  return false;
238  }
239 
246  public String getPrintableWarnings() {
247  String warningsToPrint = "";
248  if ((getWarnings() != null)
249  && (!getWarnings().isEmpty())) {
250  warningsToPrint = " (" + getWarnings() + ")";
251  }
252  return warningsToPrint;
253  }
254 }

Copyright © 2012-2015 Basis Technology. Generated on: Mon Oct 19 2015
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.