19 package org.sleuthkit.autopsy.modules.interestingitems;
21 import java.util.ArrayList;
22 import java.util.Collections;
23 import java.util.List;
25 import java.util.concurrent.ConcurrentHashMap;
26 import java.util.logging.Level;
27 import org.openide.util.NbBundle;
28 import org.openide.util.NbBundle.Messages;
48 "FilesIdentifierIngestModule.getFilesError=Error getting interesting files sets from file."
50 final class FilesIdentifierIngestModule implements FileIngestModule {
52 private static final Object sharedResourcesLock =
new Object();
53 private static final Logger logger = Logger.getLogger(FilesIdentifierIngestModule.class.getName());
54 private static final IngestModuleReferenceCounter refCounter =
new IngestModuleReferenceCounter();
55 private static final Map<Long, List<FilesSet>> interestingFileSetsByJob =
new ConcurrentHashMap<>();
56 private final FilesIdentifierIngestJobSettings settings;
57 private IngestJobContext context;
58 private Blackboard blackboard;
66 FilesIdentifierIngestModule(FilesIdentifierIngestJobSettings settings) {
67 this.settings = settings;
74 public void startUp(IngestJobContext context)
throws IngestModuleException {
75 this.context = context;
76 synchronized (FilesIdentifierIngestModule.sharedResourcesLock) {
77 if (FilesIdentifierIngestModule.refCounter.incrementAndGet(context.getJobId()) == 1) {
83 List<FilesSet> filesSets =
new ArrayList<>();
85 for (FilesSet set : InterestingItemDefsManager.getInstance().getInterestingFilesSets().values()) {
86 if (settings.interestingFilesSetIsEnabled(set.getName())) {
90 }
catch (InterestingItemDefsManager.InterestingItemDefsManagerException ex) {
91 throw new IngestModuleException(Bundle.FilesIdentifierIngestModule_getFilesError(), ex);
93 FilesIdentifierIngestModule.interestingFileSetsByJob.put(context.getJobId(), filesSets);
102 @Messages({
"FilesIdentifierIngestModule.indexError.message=Failed to index interesting file hit artifact for keyword search."})
103 public ProcessResult process(AbstractFile file) {
104 blackboard = Case.getCurrentCase().getServices().getBlackboard();
107 List<FilesSet> filesSets = FilesIdentifierIngestModule.interestingFileSetsByJob.get(this.context.getJobId());
108 for (FilesSet filesSet : filesSets) {
109 String ruleSatisfied = filesSet.fileIsMemberOf(file);
110 if (ruleSatisfied != null) {
114 String moduleName = InterestingItemsIngestModuleFactory.getModuleName();
115 BlackboardArtifact artifact = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT);
122 BlackboardAttribute setNameAttribute =
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME, moduleName, filesSet.getName());
123 artifact.addAttribute(setNameAttribute);
127 BlackboardAttribute ruleNameAttribute =
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY, moduleName, ruleSatisfied);
128 artifact.addAttribute(ruleNameAttribute);
132 blackboard.indexArtifact(artifact);
133 }
catch (Blackboard.BlackboardException ex) {
134 logger.log(Level.SEVERE,
"Unable to index blackboard artifact " + artifact.getArtifactID(), ex);
135 MessageNotifyUtil.Notify.error(Bundle.FilesIdentifierIngestModule_indexError_message(), artifact.getDisplayName());
138 IngestServices.getInstance().fireModuleDataEvent(
new ModuleDataEvent(moduleName, BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT, Collections.singletonList(artifact)));
140 }
catch (TskCoreException ex) {
141 FilesIdentifierIngestModule.logger.log(Level.SEVERE,
"Error posting to the blackboard", ex);
145 return ProcessResult.OK;
152 public void shutDown() {
153 if (context != null) {
154 if (refCounter.decrementAndGet(
this.context.getJobId()) == 0) {
158 FilesIdentifierIngestModule.interestingFileSetsByJob.remove(this.context.getJobId());