19 package org.sleuthkit.autopsy.modules.filetypeid;
21 import java.util.ArrayList;
22 import java.util.List;
23 import java.util.SortedSet;
24 import java.util.logging.Level;
25 import org.apache.tika.Tika;
26 import org.apache.tika.mime.MediaType;
27 import org.apache.tika.mime.MimeTypes;
28 import org.openide.util.NbBundle;
47 private static final Tika
tika =
new Tika();
65 userDefinedFileTypes = CustomFileTypesManager.getInstance().getUserDefinedFileTypes();
66 autopsyDefinedFileTypes = CustomFileTypesManager.getInstance().getAutopsyDefinedFileTypes();
67 }
catch (CustomFileTypesManager.CustomFileTypesException ex) {
68 throw new FileTypeDetectorInitException(
"Error loading custom file types", ex);
79 List<String> customFileTypes =
new ArrayList<>();
80 for (FileType fileType : userDefinedFileTypes) {
81 customFileTypes.add(fileType.getMimeType());
83 for (FileType fileType : autopsyDefinedFileTypes) {
84 customFileTypes.add(fileType.getMimeType());
86 return customFileTypes;
113 for (FileType fileType : customTypes) {
114 if (fileType.getMimeType().equals(mimeType)) {
129 String[] split = mimeType.split(
"/");
130 if (split.length == 2) {
131 String type = split[0];
132 String subtype = split[1];
133 MediaType mediaType =
new MediaType(type, subtype);
134 SortedSet<MediaType> m = MimeTypes.getDefaultMimeTypes().getMediaTypeRegistry().getTypes();
135 return m.contains(mediaType);
156 public String
getFileType(AbstractFile file)
throws TskCoreException {
157 return detect(file,
true);
172 public String
detect(AbstractFile file)
throws TskCoreException {
173 return detect(file,
false);
192 private String
detect(AbstractFile file,
boolean addToCaseDb)
throws TskCoreException {
197 String mimeType = file.getMIMEType();
198 if (null != mimeType) {
207 if (!file.isFile() || file.getSize() <= 0
208 || (file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS)
209 || (file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS)
210 || (file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.VIRTUAL_DIR)) {
211 mimeType = MimeTypes.OCTET_STREAM;
218 if (null == mimeType) {
226 if (null == mimeType) {
234 if (null == mimeType) {
237 int len = file.read(buffer, 0, BUFFER_SIZE);
238 if (len < BUFFER_SIZE) {
240 System.arraycopy(buffer, 0, buf, 0, len);
244 String tikaType = tika.detect(buf, file.getName());
249 mimeType = tikaType.replace(
"tika-",
"");
251 }
catch (Exception ignored) {
259 mimeType = MimeTypes.OCTET_STREAM;
292 BlackboardArtifact getInfoArt = file.getGenInfoArtifact();
293 @SuppressWarnings(
"deprecation")
294 BlackboardAttribute batt =
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG,
FileTypeIdModuleFactory.getModuleName(), mimeType);
295 getInfoArt.addAttribute(batt);
312 for (FileType fileType : userDefinedFileTypes) {
313 if (fileType.matches(file)) {
314 if (fileType.createInterestingFileHit()) {
315 BlackboardArtifact artifact;
316 artifact = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT);
317 BlackboardAttribute setNameAttribute =
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME,
FileTypeIdModuleFactory.getModuleName(), fileType.getInterestingFilesSetName());
318 artifact.addAttribute(setNameAttribute);
325 BlackboardAttribute ruleNameAttribute =
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY,
FileTypeIdModuleFactory.getModuleName(), fileType.getMimeType());
326 artifact.addAttribute(ruleNameAttribute);
334 logger.log(Level.SEVERE, String.format(
"Unable to index blackboard artifact %d", artifact.getArtifactID()), ex);
336 NbBundle.getMessage(
Blackboard.class,
"Blackboard.unableToIndexArtifact.exception.msg"), artifact.getDisplayName());
340 return fileType.getMimeType();
357 for (FileType fileType : autopsyDefinedFileTypes) {
358 if (fileType.matches(file)) {
359 return fileType.getMimeType();
391 super(message, throwable);
static final int BUFFER_SIZE
static final long serialVersionUID
final List< FileType > userDefinedFileTypes
boolean isDetectable(String mimeType)
String detectUserDefinedType(AbstractFile file)
boolean isDetectableAsCustomType(List< FileType > customTypes, String mimeType)
final List< FileType > autopsyDefinedFileTypes
SleuthkitCase getSleuthkitCase()
Blackboard getBlackboard()
static void error(String title, String message)
String detect(AbstractFile file)
synchronized void indexArtifact(BlackboardArtifact artifact)
String detectAutopsyDefinedType(AbstractFile file)
static Case getCurrentCase()
synchronized static Logger getLogger(String name)
static final Logger logger
List< String > getUserDefinedTypes()
String getFileType(AbstractFile file)
String detect(AbstractFile file, boolean addToCaseDb)
boolean isDetectableByTika(String mimeType)
String detectAndPostToBlackboard(AbstractFile file)