19 package org.sleuthkit.autopsy.modules.android;
22 import java.sql.Connection;
23 import java.sql.DriverManager;
24 import java.sql.ResultSet;
25 import java.sql.SQLException;
26 import java.sql.Statement;
27 import java.util.List;
28 import java.util.logging.Level;
29 import org.openide.util.NbBundle;
46 class BrowserLocationAnalyzer {
48 private static final String moduleName = AndroidModuleFactory.getModuleName();
49 private static final Logger logger = Logger.getLogger(BrowserLocationAnalyzer.class.getName());
50 private static Blackboard blackboard;
52 public static void findGeoLocations(Content dataSource, FileManager fileManager,
53 IngestJobContext context) {
54 blackboard = Case.getCurrentCase().getServices().getBlackboard();
56 List<AbstractFile> abstractFiles = fileManager.findFiles(dataSource,
"CachedGeoposition%.db");
58 for (AbstractFile abstractFile : abstractFiles) {
60 if (abstractFile.getSize() == 0) {
63 File jFile =
new File(Case.getCurrentCase().getTempDirectory(), abstractFile.getName());
64 ContentUtils.writeToFile(abstractFile, jFile, context::dataSourceIngestIsCancelled);
65 findGeoLocationsInDB(jFile.toString(), abstractFile);
66 }
catch (Exception e) {
67 logger.log(Level.SEVERE,
"Error parsing Browser Location files", e);
70 }
catch (TskCoreException e) {
71 logger.log(Level.SEVERE,
"Error finding Browser Location files", e);
76 @NbBundle.Messages({
"BrowserLocationAnalyzer.indexError.message=Failed to index GPS trackpoint artifact for keyword search."})
77 private static void findGeoLocationsInDB(String DatabasePath, AbstractFile f) {
78 Connection connection = null;
79 ResultSet resultSet = null;
80 Statement statement = null;
81 if (DatabasePath == null || DatabasePath.isEmpty()) {
85 Class.forName(
"org.sqlite.JDBC");
86 connection = DriverManager.getConnection(
"jdbc:sqlite:" + DatabasePath);
87 statement = connection.createStatement();
88 }
catch (ClassNotFoundException | SQLException e) {
89 logger.log(Level.SEVERE,
"Error connecting to sql database", e);
94 resultSet = statement.executeQuery(
95 "SELECT timestamp, latitude, longitude, accuracy FROM CachedPosition;");
97 while (resultSet.next()) {
98 Long timestamp = Long.valueOf(resultSet.getString(
"timestamp")) / 1000;
99 double latitude = Double.valueOf(resultSet.getString(
"latitude"));
100 double longitude = Double.valueOf(resultSet.getString(
"longitude"));
102 BlackboardArtifact bba = f.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_TRACKPOINT);
103 bba.addAttribute(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE, moduleName, latitude));
104 bba.addAttribute(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE, moduleName, longitude));
105 bba.addAttribute(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, moduleName, timestamp));
106 bba.addAttribute(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME, moduleName,
107 NbBundle.getMessage(BrowserLocationAnalyzer.class,
108 "BrowserLocationAnalyzer.bbAttribute.browserLocationHistory")));
113 blackboard.indexArtifact(bba);
114 }
catch (Blackboard.BlackboardException ex) {
115 logger.log(Level.SEVERE,
"Unable to index blackboard artifact " + bba.getArtifactTypeName(), ex);
116 MessageNotifyUtil.Notify.error(
117 Bundle.BrowserLocationAnalyzer_indexError_message(), bba.getDisplayName());
120 }
catch (Exception e) {
121 logger.log(Level.SEVERE,
"Error Putting artifacts to Blackboard", e);
124 if (resultSet != null) {
129 }
catch (Exception e) {
130 logger.log(Level.SEVERE,
"Error closing database", e);