23 package org.sleuthkit.autopsy.casemodule.services;
25 import java.io.Closeable;
26 import java.io.IOException;
27 import java.util.ArrayList;
28 import java.util.Collection;
29 import java.util.List;
30 import java.util.logging.Level;
31 import org.openide.util.NbBundle;
40 import org.
sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction;
46 import org.apache.commons.lang3.StringUtils;
82 public synchronized List<AbstractFile>
findFilesByMimeType(Collection<String> mimeTypes)
throws TskCoreException {
84 throw new TskCoreException(
"File manager has been closed");
101 public synchronized List<AbstractFile>
findFilesByMimeType(Content dataSource, Collection<String> mimeTypes)
throws TskCoreException {
102 if (null == caseDb) {
103 throw new TskCoreException(
"File manager has been closed");
105 return caseDb.findAllFilesWhere(
"data_source_obj_id = " + dataSource.getId() +
" AND " +
createFileTypeInCondition(mimeTypes));
116 String types = StringUtils.join(mimeTypes,
"', '");
117 return "mime_type IN ('" + types +
"')";
132 public synchronized List<AbstractFile>
findFiles(String fileName)
throws TskCoreException {
133 if (null == caseDb) {
134 throw new TskCoreException(
"File manager has been closed");
136 List<AbstractFile> result =
new ArrayList<>();
137 List<Content> dataSources = caseDb.getRootObjects();
138 for (Content dataSource : dataSources) {
139 result.addAll(
findFiles(dataSource, fileName));
158 public synchronized List<AbstractFile>
findFiles(String fileName, String parentName)
throws TskCoreException {
159 if (null == caseDb) {
160 throw new TskCoreException(
"File manager has been closed");
162 List<AbstractFile> result =
new ArrayList<>();
163 List<Content> dataSources = caseDb.getRootObjects();
164 for (Content dataSource : dataSources) {
165 result.addAll(
findFiles(dataSource, fileName, parentName));
184 public synchronized List<AbstractFile>
findFiles(String fileName, AbstractFile parent)
throws TskCoreException {
185 if (null == caseDb) {
186 throw new TskCoreException(
"File manager has been closed");
188 List<AbstractFile> result =
new ArrayList<>();
189 List<Content> dataSources = caseDb.getRootObjects();
190 for (Content dataSource : dataSources) {
191 result.addAll(
findFiles(dataSource, fileName, parent));
210 public synchronized List<AbstractFile>
findFiles(Content dataSource, String fileName)
throws TskCoreException {
211 if (null == caseDb) {
212 throw new TskCoreException(
"File manager has been closed");
214 return caseDb.findFiles(dataSource, fileName);
233 public synchronized List<AbstractFile>
findFiles(Content dataSource, String fileName, String parentName)
throws TskCoreException {
234 if (null == caseDb) {
235 throw new TskCoreException(
"File manager has been closed");
237 return caseDb.findFiles(dataSource, fileName, parentName);
256 public synchronized List<AbstractFile>
findFiles(Content dataSource, String fileName, AbstractFile parent)
throws TskCoreException {
257 if (null == caseDb) {
258 throw new TskCoreException(
"File manager has been closed");
260 return findFiles(dataSource, fileName, parent.getName());
279 public synchronized List<AbstractFile>
openFiles(Content dataSource, String filePath)
throws TskCoreException {
280 if (null == caseDb) {
281 throw new TskCoreException(
"File manager has been closed");
283 return caseDb.openFiles(dataSource, filePath);
318 long ctime,
long crtime,
long atime,
long mtime,
320 AbstractFile parentFile,
321 String rederiveDetails, String toolName, String toolVersion, String otherDetails,
322 TskData.EncodingType encodingType) throws TskCoreException {
323 if (null == caseDb) {
324 throw new TskCoreException(
"File manager has been closed");
326 return caseDb.addDerivedFile(fileName, localPath, size,
327 ctime, crtime, atime, mtime,
328 isFile, parentFile, rederiveDetails, toolName, toolVersion, otherDetails, encodingType);
342 public synchronized List<LayoutFile>
addCarvedFiles(CarvingResult carvingResult)
throws TskCoreException {
343 if (null == caseDb) {
344 throw new TskCoreException(
"File manager has been closed");
346 return caseDb.addCarvedFiles(carvingResult);
391 public synchronized LocalFilesDataSource
addLocalFilesDataSource(String deviceId, String rootVirtualDirectoryName, String timeZone, List<String> localFilePaths,
FileAddProgressUpdater progressUpdater)
throws TskCoreException, TskDataException {
392 if (null == caseDb) {
393 throw new TskCoreException(
"File manager has been closed");
396 CaseDbTransaction trans = null;
398 String rootDirectoryName = rootVirtualDirectoryName;
399 if (rootDirectoryName.isEmpty()) {
407 trans = caseDb.beginTransaction();
408 LocalFilesDataSource dataSource = caseDb.addLocalFilesDataSource(deviceId, rootDirectoryName, timeZone, trans);
409 VirtualDirectory rootDirectory = dataSource.getRootDirectory();
410 List<AbstractFile> filesAdded =
new ArrayList<>();
411 for (java.io.File localFile : localFiles) {
412 AbstractFile fileAdded =
addLocalFile(trans, rootDirectory, localFile, TskData.EncodingType.NONE, progressUpdater);
413 if (null != fileAdded) {
414 filesAdded.add(fileAdded);
416 throw new TskCoreException(NbBundle.getMessage(
this.getClass(),
"FileManager.addLocalFilesDirs.exception.cantAdd.msg", localFile.getAbsolutePath()));
424 for (AbstractFile fileAdded : filesAdded) {
430 }
catch (TskCoreException ex) {
434 }
catch (TskCoreException ex2) {
435 LOGGER.log(Level.SEVERE, String.format(
"Failed to rollback transaction after exception: %s", ex.getMessage()), ex2);
456 int localFileDataSourcesCounter = 0;
458 List<VirtualDirectory> localFileDataSources = caseDb.getVirtualDirectoryRoots();
459 for (VirtualDirectory vd : localFileDataSources) {
461 ++localFileDataSourcesCounter;
465 }
catch (TskCoreException ex) {
466 throw new TskCoreException(
"Error querying for existing local file data sources with defualt names", ex);
483 List<java.io.File> localFiles =
new ArrayList<>();
484 for (String path : localFilePaths) {
485 java.io.File localFile =
new java.io.File(path);
486 if (!localFile.exists() || !localFile.canRead()) {
487 throw new TskDataException(String.format(
"File at %s does not exist or cannot be read", localFile.getAbsolutePath()));
489 localFiles.add(localFile);
513 private AbstractFile
addLocalFile(CaseDbTransaction trans, VirtualDirectory parentDirectory, java.io.File localFile,
515 if (localFile.isDirectory()) {
519 VirtualDirectory virtualDirectory = caseDb.addVirtualDirectory(parentDirectory.getId(), localFile.getName(), trans);
520 progressUpdater.fileAdded(virtualDirectory);
525 final java.io.File[] childFiles = localFile.listFiles();
526 if (childFiles != null && childFiles.length > 0) {
527 for (java.io.File childFile : childFiles) {
528 addLocalFile(trans, virtualDirectory, childFile, progressUpdater);
532 return virtualDirectory;
534 return caseDb.addLocalFile(localFile.getName(), localFile.getAbsolutePath(), localFile.length(),
536 localFile.isFile(), encodingType, parentDirectory, trans);
546 public synchronized void close() throws IOException {
570 if (null == caseDb) {
571 throw new TskCoreException(
"File manager has been closed");
575 }
catch (TskDataException ex) {
576 throw new TskCoreException(ex.getLocalizedMessage(), ex);
599 public synchronized LayoutFile
addCarvedFile(String fileName,
long fileSize,
long parentObjId, List<TskFileRange> layout)
throws TskCoreException {
600 if (null == caseDb) {
601 throw new TskCoreException(
"File manager has been closed");
603 Content parent = caseDb.getContentById(parentObjId);
604 List<CarvingResult.CarvedFile> carvedFiles =
new ArrayList<>();
605 carvedFiles.add(
new CarvingResult.CarvedFile(fileName, fileSize, layout));
606 List<LayoutFile> layoutFiles = caseDb.addCarvedFiles(
new CarvingResult(parent, carvedFiles));
607 return layoutFiles.get(0);
626 public synchronized List<LayoutFile>
addCarvedFiles(List<org.sleuthkit.datamodel.CarvedFileContainer> filesToAdd)
throws TskCoreException {
627 if (null == caseDb) {
628 throw new TskCoreException(
"File manager has been closed");
630 return caseDb.addCarvedFiles(filesToAdd);
667 long ctime,
long crtime,
long atime,
long mtime,
669 AbstractFile parentFile,
670 String rederiveDetails, String toolName, String toolVersion, String otherDetails)
throws TskCoreException {
671 return addDerivedFile(fileName, localPath, size, ctime, crtime, atime, mtime, isFile, parentFile,
672 rederiveDetails, toolName, toolVersion, otherDetails, TskData.EncodingType.NONE);
698 private AbstractFile
addLocalFile(CaseDbTransaction trans, VirtualDirectory parentDirectory, java.io.File localFile,
FileAddProgressUpdater progressUpdater)
throws TskCoreException {
699 return addLocalFile(trans, parentDirectory, localFile, TskData.EncodingType.NONE, progressUpdater);
synchronized List< AbstractFile > findFiles(String fileName, String parentName)
synchronized void close()
static String createFileTypeInCondition(Collection< String > mimeTypes)
synchronized VirtualDirectory addLocalFilesDirs(List< String > localFilePaths, FileAddProgressUpdater progressUpdater)
static final Logger LOGGER
synchronized LayoutFile addCarvedFile(String fileName, long fileSize, long parentObjId, List< TskFileRange > layout)
void fileAdded(AbstractFile newFile)
AbstractFile addLocalFile(CaseDbTransaction trans, VirtualDirectory parentDirectory, java.io.File localFile, TskData.EncodingType encodingType, FileAddProgressUpdater progressUpdater)
synchronized List< AbstractFile > findFiles(Content dataSource, String fileName)
synchronized DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parentFile, String rederiveDetails, String toolName, String toolVersion, String otherDetails)
synchronized List< AbstractFile > findFilesByMimeType(Collection< String > mimeTypes)
synchronized List< LayoutFile > addCarvedFiles(List< org.sleuthkit.datamodel.CarvedFileContainer > filesToAdd)
synchronized List< AbstractFile > openFiles(Content dataSource, String filePath)
synchronized LocalFilesDataSource addLocalFilesDataSource(String deviceId, String rootVirtualDirectoryName, String timeZone, List< String > localFilePaths, FileAddProgressUpdater progressUpdater)
static synchronized String generateFilesDataSourceName(SleuthkitCase caseDb)
synchronized List< AbstractFile > findFilesByMimeType(Content dataSource, Collection< String > mimeTypes)
void fireModuleContentEvent(ModuleContentEvent moduleContentEvent)
synchronized DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parentFile, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType)
synchronized List< AbstractFile > findFiles(String fileName)
synchronized static Logger getLogger(String name)
synchronized List< LayoutFile > addCarvedFiles(CarvingResult carvingResult)
FileManager(SleuthkitCase caseDb)
static final String LOGICAL_FILE_SET_PREFIX
synchronized List< AbstractFile > findFiles(Content dataSource, String fileName, AbstractFile parent)
synchronized List< AbstractFile > findFiles(String fileName, AbstractFile parent)
List< java.io.File > getFilesAndDirectories(List< String > localFilePaths)
AbstractFile addLocalFile(CaseDbTransaction trans, VirtualDirectory parentDirectory, java.io.File localFile, FileAddProgressUpdater progressUpdater)
synchronized List< AbstractFile > findFiles(Content dataSource, String fileName, String parentName)
static synchronized IngestServices getInstance()