Autopsy  4.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
FileManager.java
Go to the documentation of this file.
1 /*
2  *
3  * Autopsy Forensic Browser
4  *
5  * Copyright 2011-2016 Basis Technology Corp.
6  *
7  * Copyright 2012 42six Solutions.
8  * Contact: aebadirad <at> 42six <dot> com
9  * Project Contact/Architect: carrier <at> sleuthkit <dot> org
10  *
11  * Licensed under the Apache License, Version 2.0 (the "License");
12  * you may not use this file except in compliance with the License.
13  * You may obtain a copy of the License at
14  *
15  * http://www.apache.org/licenses/LICENSE-2.0
16  *
17  * Unless required by applicable law or agreed to in writing, software
18  * distributed under the License is distributed on an "AS IS" BASIS,
19  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
20  * See the License for the specific language governing permissions and
21  * limitations under the License.
22  */
23 package org.sleuthkit.autopsy.casemodule.services;
24 
25 import java.io.Closeable;
26 import java.io.IOException;
27 import java.util.ArrayList;
28 import java.util.Collection;
29 import java.util.List;
30 import java.util.logging.Level;
31 import org.openide.util.NbBundle;
35 import org.sleuthkit.datamodel.AbstractFile;
36 import org.sleuthkit.datamodel.Content;
37 import org.sleuthkit.datamodel.DerivedFile;
38 import org.sleuthkit.datamodel.LayoutFile;
39 import org.sleuthkit.datamodel.SleuthkitCase;
40 import org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction;
41 import org.sleuthkit.datamodel.TskCoreException;
42 import org.sleuthkit.datamodel.TskFileRange;
43 import org.sleuthkit.datamodel.VirtualDirectory;
44 import org.sleuthkit.datamodel.LocalFilesDataSource;
45 import org.sleuthkit.datamodel.TskDataException;
46 import org.apache.commons.lang3.StringUtils;
48 import org.sleuthkit.datamodel.CarvingResult;
49 import org.sleuthkit.datamodel.TskData;
50 
56 public class FileManager implements Closeable {
57 
58  private static final Logger LOGGER = Logger.getLogger(FileManager.class.getName());
59  private SleuthkitCase caseDb;
60 
68  public FileManager(SleuthkitCase caseDb) {
69  this.caseDb = caseDb;
70  }
71 
82  public synchronized List<AbstractFile> findFilesByMimeType(Collection<String> mimeTypes) throws TskCoreException {
83  if (null == caseDb) {
84  throw new TskCoreException("File manager has been closed");
85  }
86  return caseDb.findAllFilesWhere(createFileTypeInCondition(mimeTypes));
87  }
88 
101  public synchronized List<AbstractFile> findFilesByMimeType(Content dataSource, Collection<String> mimeTypes) throws TskCoreException {
102  if (null == caseDb) {
103  throw new TskCoreException("File manager has been closed");
104  }
105  return caseDb.findAllFilesWhere("data_source_obj_id = " + dataSource.getId() + " AND " + createFileTypeInCondition(mimeTypes));
106  }
107 
115  private static String createFileTypeInCondition(Collection<String> mimeTypes) {
116  String types = StringUtils.join(mimeTypes, "', '");
117  return "mime_type IN ('" + types + "')";
118  }
119 
132  public synchronized List<AbstractFile> findFiles(String fileName) throws TskCoreException {
133  if (null == caseDb) {
134  throw new TskCoreException("File manager has been closed");
135  }
136  List<AbstractFile> result = new ArrayList<>();
137  List<Content> dataSources = caseDb.getRootObjects();
138  for (Content dataSource : dataSources) {
139  result.addAll(findFiles(dataSource, fileName));
140  }
141  return result;
142  }
143 
158  public synchronized List<AbstractFile> findFiles(String fileName, String parentName) throws TskCoreException {
159  if (null == caseDb) {
160  throw new TskCoreException("File manager has been closed");
161  }
162  List<AbstractFile> result = new ArrayList<>();
163  List<Content> dataSources = caseDb.getRootObjects();
164  for (Content dataSource : dataSources) {
165  result.addAll(findFiles(dataSource, fileName, parentName));
166  }
167  return result;
168  }
169 
184  public synchronized List<AbstractFile> findFiles(String fileName, AbstractFile parent) throws TskCoreException {
185  if (null == caseDb) {
186  throw new TskCoreException("File manager has been closed");
187  }
188  List<AbstractFile> result = new ArrayList<>();
189  List<Content> dataSources = caseDb.getRootObjects();
190  for (Content dataSource : dataSources) {
191  result.addAll(findFiles(dataSource, fileName, parent));
192  }
193  return result;
194  }
195 
210  public synchronized List<AbstractFile> findFiles(Content dataSource, String fileName) throws TskCoreException {
211  if (null == caseDb) {
212  throw new TskCoreException("File manager has been closed");
213  }
214  return caseDb.findFiles(dataSource, fileName);
215  }
216 
233  public synchronized List<AbstractFile> findFiles(Content dataSource, String fileName, String parentName) throws TskCoreException {
234  if (null == caseDb) {
235  throw new TskCoreException("File manager has been closed");
236  }
237  return caseDb.findFiles(dataSource, fileName, parentName);
238  }
239 
256  public synchronized List<AbstractFile> findFiles(Content dataSource, String fileName, AbstractFile parent) throws TskCoreException {
257  if (null == caseDb) {
258  throw new TskCoreException("File manager has been closed");
259  }
260  return findFiles(dataSource, fileName, parent.getName());
261  }
262 
279  public synchronized List<AbstractFile> openFiles(Content dataSource, String filePath) throws TskCoreException {
280  if (null == caseDb) {
281  throw new TskCoreException("File manager has been closed");
282  }
283  return caseDb.openFiles(dataSource, filePath);
284  }
285 
315  public synchronized DerivedFile addDerivedFile(String fileName,
316  String localPath,
317  long size,
318  long ctime, long crtime, long atime, long mtime,
319  boolean isFile,
320  AbstractFile parentFile,
321  String rederiveDetails, String toolName, String toolVersion, String otherDetails,
322  TskData.EncodingType encodingType) throws TskCoreException {
323  if (null == caseDb) {
324  throw new TskCoreException("File manager has been closed");
325  }
326  return caseDb.addDerivedFile(fileName, localPath, size,
327  ctime, crtime, atime, mtime,
328  isFile, parentFile, rederiveDetails, toolName, toolVersion, otherDetails, encodingType);
329  }
330 
342  public synchronized List<LayoutFile> addCarvedFiles(CarvingResult carvingResult) throws TskCoreException {
343  if (null == caseDb) {
344  throw new TskCoreException("File manager has been closed");
345  }
346  return caseDb.addCarvedFiles(carvingResult);
347  }
348 
353  public interface FileAddProgressUpdater {
354 
360  void fileAdded(AbstractFile newFile);
361  }
362 
391  public synchronized LocalFilesDataSource addLocalFilesDataSource(String deviceId, String rootVirtualDirectoryName, String timeZone, List<String> localFilePaths, FileAddProgressUpdater progressUpdater) throws TskCoreException, TskDataException {
392  if (null == caseDb) {
393  throw new TskCoreException("File manager has been closed");
394  }
395  List<java.io.File> localFiles = getFilesAndDirectories(localFilePaths);
396  CaseDbTransaction trans = null;
397  try {
398  String rootDirectoryName = rootVirtualDirectoryName;
399  if (rootDirectoryName.isEmpty()) {
400  rootDirectoryName = generateFilesDataSourceName(caseDb);
401  }
402 
403  /*
404  * Add the root virtual directory and its local/logical file
405  * children to the case database.
406  */
407  trans = caseDb.beginTransaction();
408  LocalFilesDataSource dataSource = caseDb.addLocalFilesDataSource(deviceId, rootDirectoryName, timeZone, trans);
409  VirtualDirectory rootDirectory = dataSource.getRootDirectory();
410  List<AbstractFile> filesAdded = new ArrayList<>();
411  for (java.io.File localFile : localFiles) {
412  AbstractFile fileAdded = addLocalFile(trans, rootDirectory, localFile, TskData.EncodingType.NONE, progressUpdater);
413  if (null != fileAdded) {
414  filesAdded.add(fileAdded);
415  } else {
416  throw new TskCoreException(NbBundle.getMessage(this.getClass(), "FileManager.addLocalFilesDirs.exception.cantAdd.msg", localFile.getAbsolutePath()));
417  }
418  }
419  trans.commit();
420 
421  /*
422  * Publish content added events for the added files and directories.
423  */
424  for (AbstractFile fileAdded : filesAdded) {
426  }
427 
428  return dataSource;
429 
430  } catch (TskCoreException ex) {
431  if (null != trans) {
432  try {
433  trans.rollback();
434  } catch (TskCoreException ex2) {
435  LOGGER.log(Level.SEVERE, String.format("Failed to rollback transaction after exception: %s", ex.getMessage()), ex2);
436  }
437  }
438  throw ex;
439  }
440  }
441 
455  private static synchronized String generateFilesDataSourceName(SleuthkitCase caseDb) throws TskCoreException {
456  int localFileDataSourcesCounter = 0;
457  try {
458  List<VirtualDirectory> localFileDataSources = caseDb.getVirtualDirectoryRoots();
459  for (VirtualDirectory vd : localFileDataSources) {
460  if (vd.getName().startsWith(VirtualDirectoryNode.LOGICAL_FILE_SET_PREFIX)) {
461  ++localFileDataSourcesCounter;
462  }
463  }
464  return VirtualDirectoryNode.LOGICAL_FILE_SET_PREFIX + (localFileDataSourcesCounter + 1);
465  } catch (TskCoreException ex) {
466  throw new TskCoreException("Error querying for existing local file data sources with defualt names", ex);
467  }
468  }
469 
482  private List<java.io.File> getFilesAndDirectories(List<String> localFilePaths) throws TskDataException {
483  List<java.io.File> localFiles = new ArrayList<>();
484  for (String path : localFilePaths) {
485  java.io.File localFile = new java.io.File(path);
486  if (!localFile.exists() || !localFile.canRead()) {
487  throw new TskDataException(String.format("File at %s does not exist or cannot be read", localFile.getAbsolutePath()));
488  }
489  localFiles.add(localFile);
490  }
491  return localFiles;
492  }
493 
513  private AbstractFile addLocalFile(CaseDbTransaction trans, VirtualDirectory parentDirectory, java.io.File localFile,
514  TskData.EncodingType encodingType, FileAddProgressUpdater progressUpdater) throws TskCoreException {
515  if (localFile.isDirectory()) {
516  /*
517  * Add the directory as a virtual directory.
518  */
519  VirtualDirectory virtualDirectory = caseDb.addVirtualDirectory(parentDirectory.getId(), localFile.getName(), trans);
520  progressUpdater.fileAdded(virtualDirectory);
521 
522  /*
523  * Add its children, if any.
524  */
525  final java.io.File[] childFiles = localFile.listFiles();
526  if (childFiles != null && childFiles.length > 0) {
527  for (java.io.File childFile : childFiles) {
528  addLocalFile(trans, virtualDirectory, childFile, progressUpdater);
529  }
530  }
531 
532  return virtualDirectory;
533  } else {
534  return caseDb.addLocalFile(localFile.getName(), localFile.getAbsolutePath(), localFile.length(),
535  0, 0, 0, 0,
536  localFile.isFile(), encodingType, parentDirectory, trans);
537  }
538  }
539 
545  @Override
546  public synchronized void close() throws IOException {
547  caseDb = null;
548  }
549 
568  @Deprecated
569  public synchronized VirtualDirectory addLocalFilesDirs(List<String> localFilePaths, FileAddProgressUpdater progressUpdater) throws TskCoreException {
570  if (null == caseDb) {
571  throw new TskCoreException("File manager has been closed");
572  }
573  try {
574  return addLocalFilesDataSource("", "", "", localFilePaths, progressUpdater).getRootDirectory();
575  } catch (TskDataException ex) {
576  throw new TskCoreException(ex.getLocalizedMessage(), ex);
577  }
578  }
579 
598  @Deprecated
599  public synchronized LayoutFile addCarvedFile(String fileName, long fileSize, long parentObjId, List<TskFileRange> layout) throws TskCoreException {
600  if (null == caseDb) {
601  throw new TskCoreException("File manager has been closed");
602  }
603  Content parent = caseDb.getContentById(parentObjId);
604  List<CarvingResult.CarvedFile> carvedFiles = new ArrayList<>();
605  carvedFiles.add(new CarvingResult.CarvedFile(fileName, fileSize, layout));
606  List<LayoutFile> layoutFiles = caseDb.addCarvedFiles(new CarvingResult(parent, carvedFiles));
607  return layoutFiles.get(0);
608  }
609 
625  @Deprecated
626  public synchronized List<LayoutFile> addCarvedFiles(List<org.sleuthkit.datamodel.CarvedFileContainer> filesToAdd) throws TskCoreException {
627  if (null == caseDb) {
628  throw new TskCoreException("File manager has been closed");
629  }
630  return caseDb.addCarvedFiles(filesToAdd);
631  }
632 
663  @Deprecated
664  public synchronized DerivedFile addDerivedFile(String fileName,
665  String localPath,
666  long size,
667  long ctime, long crtime, long atime, long mtime,
668  boolean isFile,
669  AbstractFile parentFile,
670  String rederiveDetails, String toolName, String toolVersion, String otherDetails) throws TskCoreException {
671  return addDerivedFile(fileName, localPath, size, ctime, crtime, atime, mtime, isFile, parentFile,
672  rederiveDetails, toolName, toolVersion, otherDetails, TskData.EncodingType.NONE);
673  }
674 
697  @Deprecated
698  private AbstractFile addLocalFile(CaseDbTransaction trans, VirtualDirectory parentDirectory, java.io.File localFile, FileAddProgressUpdater progressUpdater) throws TskCoreException {
699  return addLocalFile(trans, parentDirectory, localFile, TskData.EncodingType.NONE, progressUpdater);
700  }
701 
702 }
synchronized List< AbstractFile > findFiles(String fileName, String parentName)
static String createFileTypeInCondition(Collection< String > mimeTypes)
synchronized VirtualDirectory addLocalFilesDirs(List< String > localFilePaths, FileAddProgressUpdater progressUpdater)
synchronized LayoutFile addCarvedFile(String fileName, long fileSize, long parentObjId, List< TskFileRange > layout)
AbstractFile addLocalFile(CaseDbTransaction trans, VirtualDirectory parentDirectory, java.io.File localFile, TskData.EncodingType encodingType, FileAddProgressUpdater progressUpdater)
synchronized List< AbstractFile > findFiles(Content dataSource, String fileName)
synchronized DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parentFile, String rederiveDetails, String toolName, String toolVersion, String otherDetails)
synchronized List< AbstractFile > findFilesByMimeType(Collection< String > mimeTypes)
synchronized List< LayoutFile > addCarvedFiles(List< org.sleuthkit.datamodel.CarvedFileContainer > filesToAdd)
synchronized List< AbstractFile > openFiles(Content dataSource, String filePath)
synchronized LocalFilesDataSource addLocalFilesDataSource(String deviceId, String rootVirtualDirectoryName, String timeZone, List< String > localFilePaths, FileAddProgressUpdater progressUpdater)
static synchronized String generateFilesDataSourceName(SleuthkitCase caseDb)
synchronized List< AbstractFile > findFilesByMimeType(Content dataSource, Collection< String > mimeTypes)
void fireModuleContentEvent(ModuleContentEvent moduleContentEvent)
synchronized DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parentFile, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType)
synchronized List< AbstractFile > findFiles(String fileName)
synchronized static Logger getLogger(String name)
Definition: Logger.java:161
synchronized List< LayoutFile > addCarvedFiles(CarvingResult carvingResult)
synchronized List< AbstractFile > findFiles(Content dataSource, String fileName, AbstractFile parent)
synchronized List< AbstractFile > findFiles(String fileName, AbstractFile parent)
List< java.io.File > getFilesAndDirectories(List< String > localFilePaths)
AbstractFile addLocalFile(CaseDbTransaction trans, VirtualDirectory parentDirectory, java.io.File localFile, FileAddProgressUpdater progressUpdater)
synchronized List< AbstractFile > findFiles(Content dataSource, String fileName, String parentName)
static synchronized IngestServices getInstance()

Copyright © 2012-2016 Basis Technology. Generated on: Tue Oct 25 2016
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.