Autopsy  4.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
BrowserLocationAnalyzer.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2014 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.modules.android;
20 
21 import java.io.File;
22 import java.sql.Connection;
23 import java.sql.DriverManager;
24 import java.sql.ResultSet;
25 import java.sql.SQLException;
26 import java.sql.Statement;
27 import java.util.List;
28 import java.util.logging.Level;
29 
30 import org.openide.util.NbBundle;
37 import org.sleuthkit.datamodel.AbstractFile;
38 import org.sleuthkit.datamodel.BlackboardArtifact;
39 import org.sleuthkit.datamodel.BlackboardAttribute;
40 import org.sleuthkit.datamodel.Content;
41 import org.sleuthkit.datamodel.TskCoreException;
42 
46 class BrowserLocationAnalyzer {
47 
48  private static final String moduleName = AndroidModuleFactory.getModuleName();
49  private static final Logger logger = Logger.getLogger(BrowserLocationAnalyzer.class.getName());
50  private static Blackboard blackboard;
51 
52  public static void findGeoLocations(Content dataSource, FileManager fileManager) {
53  blackboard = Case.getCurrentCase().getServices().getBlackboard();
54  try {
55  List<AbstractFile> abstractFiles = fileManager.findFiles(dataSource, "CachedGeoposition%.db"); //NON-NLS
56 
57  for (AbstractFile abstractFile : abstractFiles) {
58  try {
59  if (abstractFile.getSize() == 0) {
60  continue;
61  }
62  File jFile = new File(Case.getCurrentCase().getTempDirectory(), abstractFile.getName());
63  ContentUtils.writeToFile(abstractFile, jFile);
64  findGeoLocationsInDB(jFile.toString(), abstractFile);
65  } catch (Exception e) {
66  logger.log(Level.SEVERE, "Error parsing Browser Location files", e); //NON-NLS
67  }
68  }
69  } catch (TskCoreException e) {
70  logger.log(Level.SEVERE, "Error finding Browser Location files", e); //NON-NLS
71 
72  }
73  }
74 
75  private static void findGeoLocationsInDB(String DatabasePath, AbstractFile f) {
76  Connection connection = null;
77  ResultSet resultSet = null;
78  Statement statement = null;
79  if (DatabasePath == null || DatabasePath.isEmpty()) {
80  return;
81  }
82  try {
83  Class.forName("org.sqlite.JDBC"); //NON-NLS //load JDBC driver
84  connection = DriverManager.getConnection("jdbc:sqlite:" + DatabasePath); //NON-NLS
85  statement = connection.createStatement();
86  } catch (ClassNotFoundException | SQLException e) {
87  logger.log(Level.SEVERE, "Error connecting to sql database", e); //NON-NLS
88  return;
89  }
90 
91  try {
92  resultSet = statement.executeQuery(
93  "SELECT timestamp, latitude, longitude, accuracy FROM CachedPosition;"); //NON-NLS
94 
95  while (resultSet.next()) {
96  Long timestamp = Long.valueOf(resultSet.getString("timestamp")) / 1000; //NON-NLS
97  double latitude = Double.valueOf(resultSet.getString("latitude")); //NON-NLS
98  double longitude = Double.valueOf(resultSet.getString("longitude")); //NON-NLS
99 
100  BlackboardArtifact bba = f.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_TRACKPOINT);
101  bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE, moduleName, latitude));
102  bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE, moduleName, longitude));
103  bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, moduleName, timestamp));
104  bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME, moduleName,
105  NbBundle.getMessage(BrowserLocationAnalyzer.class,
106  "BrowserLocationAnalyzer.bbAttribute.browserLocationHistory")));
107  // bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_VALUE.getTypeID(),moduleName, accuracy));
108 
109  try {
110  // index the artifact for keyword search
111  blackboard.indexArtifact(bba);
112  } catch (Blackboard.BlackboardException ex) {
113  logger.log(Level.SEVERE, NbBundle.getMessage(Blackboard.class, "Blackboard.unableToIndexArtifact.error.msg", bba.getDisplayName()), ex); //NON-NLS
114  MessageNotifyUtil.Notify.error(
115  NbBundle.getMessage(Blackboard.class, "Blackboard.unableToIndexArtifact.exception.msg"), bba.getDisplayName());
116  }
117  }
118  } catch (Exception e) {
119  logger.log(Level.SEVERE, "Error Putting artifacts to Blackboard", e); //NON-NLS
120  } finally {
121  try {
122  if (resultSet != null) {
123  resultSet.close();
124  }
125  statement.close();
126  connection.close();
127  } catch (Exception e) {
128  logger.log(Level.SEVERE, "Error closing database", e); //NON-NLS
129  }
130  }
131 
132  }
133 }

Copyright © 2012-2015 Basis Technology. Generated on: Wed Apr 6 2016
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.