19 package org.sleuthkit.autopsy.modules.photoreccarver;
 
   22 import java.io.IOException;
 
   23 import java.lang.ProcessBuilder.Redirect;
 
   24 import java.nio.file.DirectoryStream;
 
   25 import java.nio.file.FileAlreadyExistsException;
 
   26 import java.nio.file.Files;
 
   27 import java.nio.file.Path;
 
   28 import java.nio.file.Paths;
 
   29 import java.text.DateFormat;
 
   30 import java.text.SimpleDateFormat;
 
   31 import java.util.ArrayList;
 
   32 import java.util.Date;
 
   33 import java.util.HashMap;
 
   34 import java.util.List;
 
   36 import java.util.concurrent.ConcurrentHashMap;
 
   37 import java.util.concurrent.atomic.AtomicLong;
 
   38 import java.util.logging.Level;
 
   39 import org.openide.modules.InstalledFileLocator;
 
   40 import org.openide.util.NbBundle;
 
   62 import org.
sleuthkit.datamodel.ReadContentInputStream.ReadContentInputStreamException;
 
   70     "PhotoRecIngestModule.PermissionsNotSufficient=Insufficient permissions accessing",
 
   71     "PhotoRecIngestModule.PermissionsNotSufficientSeeReference=See 'Shared Drive Authentication' in Autopsy help.",
 
   72     "# {0} - output directory name", 
"cannotCreateOutputDir.message=Unable to create output directory: {0}.",
 
   73     "unallocatedSpaceProcessingSettingsError.message=The selected file ingest filter ignores unallocated space. This module carves unallocated space. Please choose a filter which does not ignore unallocated space or disable this module.",
 
   74     "unsupportedOS.message=PhotoRec module is supported on Windows platforms only.",
 
   75     "missingExecutable.message=Unable to locate PhotoRec executable.",
 
   76     "cannotRunExecutable.message=Unable to execute PhotoRec.",
 
   77     "PhotoRecIngestModule.nonHostnameUNCPathUsed=PhotoRec cannot operate with a UNC path containing IP addresses." 
   81     static final boolean DEFAULT_CONFIG_KEEP_CORRUPTED_FILES = 
false;
 
   83     private static final String PHOTOREC_DIRECTORY = 
"photorec_exec"; 
 
   84     private static final String PHOTOREC_EXECUTABLE = 
"photorec_win.exe"; 
 
   85     private static final String PHOTOREC_LINUX_EXECUTABLE = 
"photorec";
 
   86     private static final String PHOTOREC_RESULTS_BASE = 
"results"; 
 
   87     private static final String PHOTOREC_RESULTS_EXTENDED = 
"results.1"; 
 
   88     private static final String PHOTOREC_REPORT = 
"report.xml"; 
 
   89     private static final String LOG_FILE = 
"run_log.txt"; 
 
   90     private static final String TEMP_DIR_NAME = 
"temp"; 
 
   91     private static final String SEP = System.getProperty(
"line.separator");
 
   92     private static final Logger logger = 
Logger.
getLogger(PhotoRecCarverFileIngestModule.class.getName());
 
   93     private static final HashMap<Long, IngestJobTotals> totalsForIngestJobs = 
new HashMap<>();
 
   95     private static final Map<Long, WorkingPaths> pathsByJob = 
new ConcurrentHashMap<>();
 
   97     private Path rootOutputDirPath;
 
   98     private File executableFile;
 
  103     private final boolean keepCorruptedFiles;
 
  106         private final AtomicLong totalItemsRecovered = 
new AtomicLong(0);
 
  107         private final AtomicLong totalItemsWithErrors = 
new AtomicLong(0);
 
  108         private final AtomicLong totalWritetime = 
new AtomicLong(0);
 
  109         private final AtomicLong totalParsetime = 
new AtomicLong(0);
 
  116     PhotoRecCarverFileIngestModule(PhotoRecCarverIngestJobSettings settings) {
 
  117         keepCorruptedFiles = settings.isKeepCorruptedFiles();
 
  120     private static synchronized IngestJobTotals getTotalsForIngestJobs(
long ingestJobId) {
 
  121         IngestJobTotals totals = totalsForIngestJobs.get(ingestJobId);
 
  122         if (totals == null) {
 
  123             totals = 
new PhotoRecCarverFileIngestModule.IngestJobTotals();
 
  124             totalsForIngestJobs.put(ingestJobId, totals);
 
  129     private static synchronized void initTotalsForIngestJob(
long ingestJobId) {
 
  130         IngestJobTotals totals = 
new PhotoRecCarverFileIngestModule.IngestJobTotals();
 
  131         totalsForIngestJobs.put(ingestJobId, totals);
 
  138     public void startUp(IngestJobContext context) 
throws IngestModule.IngestModuleException {
 
  139         this.context = context;
 
  141         this.jobId = this.context.getJobId();
 
  147         if (!this.context.processingUnallocatedSpace()) {
 
  148             throw new IngestModule.IngestModuleException(Bundle.unallocatedSpaceProcessingSettingsError_message());
 
  151         this.rootOutputDirPath = createModuleOutputDirectoryForCase();
 
  154             executableFile = locateExecutable();
 
  156         if (PhotoRecCarverFileIngestModule.refCounter.incrementAndGet(
this.jobId) == 1) {
 
  159                 DateFormat dateFormat = 
new SimpleDateFormat(
"MM-dd-yyyy-HH-mm-ss-SSSS");  
 
  160                 Date date = 
new Date();
 
  161                 String folder = this.context.getDataSource().getId() + 
"_" + dateFormat.format(date);
 
  162                 Path outputDirPath = Paths.get(this.rootOutputDirPath.toAbsolutePath().toString(), folder);
 
  163                 Files.createDirectories(outputDirPath);
 
  166                 Path tempDirPath = Paths.get(outputDirPath.toString(), PhotoRecCarverFileIngestModule.TEMP_DIR_NAME);
 
  167                 Files.createDirectory(tempDirPath);
 
  170                 PhotoRecCarverFileIngestModule.pathsByJob.put(this.jobId, 
new WorkingPaths(outputDirPath, tempDirPath));
 
  173                 initTotalsForIngestJob(jobId);
 
  174             } 
catch (SecurityException | IOException | UnsupportedOperationException ex) {
 
  175                 throw new IngestModule.IngestModuleException(Bundle.cannotCreateOutputDir_message(ex.getLocalizedMessage()), ex);
 
  184     public IngestModule.ProcessResult process(AbstractFile file) {
 
  186         if (file.getType() != TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS) {
 
  187             return IngestModule.ProcessResult.OK;
 
  191         IngestJobTotals totals = getTotalsForIngestJobs(jobId);
 
  193         Path tempFilePath = null;
 
  196             if (null == this.executableFile) {
 
  197                 logger.log(Level.SEVERE, 
"PhotoRec carver called after failed start up");  
 
  198                 return IngestModule.ProcessResult.ERROR;
 
  204             long freeDiskSpace = IngestServices.getInstance().getFreeDiskSpace();
 
  205             if ((freeDiskSpace != IngestMonitor.DISK_FREE_SPACE_UNKNOWN) && ((file.getSize() * 1.2) > freeDiskSpace)) {
 
  206                 logger.log(Level.SEVERE, 
"PhotoRec error processing {0} with {1} Not enough space on primary disk to save unallocated space.", 
 
  207                         new Object[]{file.getName(), PhotoRecCarverIngestModuleFactory.getModuleName()}); 
 
  208                 MessageNotifyUtil.Notify.error(NbBundle.getMessage(
this.getClass(), 
"PhotoRecIngestModule.UnableToCarve", file.getName()),
 
  209                         NbBundle.getMessage(
this.getClass(), 
"PhotoRecIngestModule.NotEnoughDiskSpace"));
 
  210                 return IngestModule.ProcessResult.ERROR;
 
  212             if (this.context.fileIngestIsCancelled() == 
true) {
 
  214                 logger.log(Level.INFO, 
"PhotoRec cancelled by user"); 
 
  215                 MessageNotifyUtil.Notify.info(PhotoRecCarverIngestModuleFactory.getModuleName(), NbBundle.getMessage(PhotoRecCarverFileIngestModule.class, 
"PhotoRecIngestModule.cancelledByUser"));
 
  216                 return IngestModule.ProcessResult.OK;
 
  220             long writestart = System.currentTimeMillis();
 
  221             WorkingPaths paths = PhotoRecCarverFileIngestModule.pathsByJob.get(this.jobId);
 
  222             tempFilePath = Paths.get(paths.getTempDirPath().toString(), file.getName());
 
  223             ContentUtils.writeToFile(file, tempFilePath.toFile(), context::fileIngestIsCancelled);
 
  225             if (this.context.fileIngestIsCancelled() == 
true) {
 
  227                 logger.log(Level.INFO, 
"PhotoRec cancelled by user"); 
 
  228                 MessageNotifyUtil.Notify.info(PhotoRecCarverIngestModuleFactory.getModuleName(), NbBundle.getMessage(PhotoRecCarverFileIngestModule.class, 
"PhotoRecIngestModule.cancelledByUser"));
 
  229                 return IngestModule.ProcessResult.OK;
 
  233             Path outputDirPath = Paths.get(paths.getOutputDirPath().toString(), file.getName());
 
  234             Files.createDirectory(outputDirPath);
 
  235             File log = 
new File(Paths.get(outputDirPath.toString(), LOG_FILE).toString()); 
 
  238             ProcessBuilder processAndSettings = 
new ProcessBuilder(
 
  239                     executableFile.toString(),
 
  241                     outputDirPath.toAbsolutePath().toString() + File.separator + PHOTOREC_RESULTS_BASE,
 
  243                     tempFilePath.toFile().toString());
 
  244             if (keepCorruptedFiles) {
 
  245                 processAndSettings.command().add(
"options,keep_corrupted_file,search"); 
 
  247                 processAndSettings.command().add(
"search"); 
 
  251             processAndSettings.environment().put(
"__COMPAT_LAYER", 
"RunAsInvoker"); 
 
  252             processAndSettings.redirectErrorStream(
true);
 
  253             processAndSettings.redirectOutput(Redirect.appendTo(log));
 
  255             FileIngestModuleProcessTerminator terminator = 
new FileIngestModuleProcessTerminator(this.context, 
true);
 
  256             int exitValue = ExecUtil.execute(processAndSettings, terminator);
 
  258             if (this.context.fileIngestIsCancelled() == 
true) {
 
  260                 cleanup(outputDirPath, tempFilePath);
 
  261                 logger.log(Level.INFO, 
"PhotoRec cancelled by user"); 
 
  262                 MessageNotifyUtil.Notify.info(PhotoRecCarverIngestModuleFactory.getModuleName(), NbBundle.getMessage(PhotoRecCarverFileIngestModule.class, 
"PhotoRecIngestModule.cancelledByUser"));
 
  263                 return IngestModule.ProcessResult.OK;
 
  264             } 
else if (terminator.getTerminationCode() == ProcTerminationCode.TIME_OUT) {
 
  265                 cleanup(outputDirPath, tempFilePath);
 
  266                 String msg = NbBundle.getMessage(this.getClass(), 
"PhotoRecIngestModule.processTerminated") + file.getName(); 
 
  267                 MessageNotifyUtil.Notify.error(NbBundle.getMessage(
this.getClass(), 
"PhotoRecIngestModule.moduleError"), msg); 
 
  268                 logger.log(Level.SEVERE, msg);
 
  269                 return IngestModule.ProcessResult.ERROR;
 
  270             } 
else if (0 != exitValue) {
 
  272                 cleanup(outputDirPath, tempFilePath);
 
  273                 totals.totalItemsWithErrors.incrementAndGet();
 
  274                 logger.log(Level.SEVERE, 
"PhotoRec carver returned error exit value = {0} when scanning {1}", 
 
  275                         new Object[]{exitValue, file.getName()}); 
 
  276                 MessageNotifyUtil.Notify.error(PhotoRecCarverIngestModuleFactory.getModuleName(), NbBundle.getMessage(PhotoRecCarverFileIngestModule.class, 
"PhotoRecIngestModule.error.exitValue", 
 
  277                         new Object[]{exitValue, file.getName()}));
 
  278                 return IngestModule.ProcessResult.ERROR;
 
  282             java.io.File oldAuditFile = 
new java.io.File(Paths.get(outputDirPath.toString(), PHOTOREC_RESULTS_EXTENDED, PHOTOREC_REPORT).toString()); 
 
  283             java.io.File newAuditFile = 
new java.io.File(Paths.get(outputDirPath.toString(), PHOTOREC_REPORT).toString()); 
 
  284             oldAuditFile.renameTo(newAuditFile);
 
  286             if (this.context.fileIngestIsCancelled() == 
true) {
 
  288                 logger.log(Level.INFO, 
"PhotoRec cancelled by user"); 
 
  289                 MessageNotifyUtil.Notify.info(PhotoRecCarverIngestModuleFactory.getModuleName(), NbBundle.getMessage(PhotoRecCarverFileIngestModule.class, 
"PhotoRecIngestModule.cancelledByUser"));
 
  290                 return IngestModule.ProcessResult.OK;
 
  292             Path pathToRemove = Paths.get(outputDirPath.toAbsolutePath().toString());
 
  293             try (DirectoryStream<Path> stream = Files.newDirectoryStream(pathToRemove)) {
 
  294                 for (Path entry : stream) {
 
  295                     if (Files.isDirectory(entry)) {
 
  296                         FileUtil.deleteDir(
new File(entry.toString()));
 
  300             long writedelta = (System.currentTimeMillis() - writestart);
 
  301             totals.totalWritetime.addAndGet(writedelta);
 
  304             long calcstart = System.currentTimeMillis();
 
  305             PhotoRecCarverOutputParser parser = 
new PhotoRecCarverOutputParser(outputDirPath);
 
  306             if (this.context.fileIngestIsCancelled() == 
true) {
 
  308                 logger.log(Level.INFO, 
"PhotoRec cancelled by user"); 
 
  309                 MessageNotifyUtil.Notify.info(PhotoRecCarverIngestModuleFactory.getModuleName(), NbBundle.getMessage(PhotoRecCarverFileIngestModule.class, 
"PhotoRecIngestModule.cancelledByUser"));
 
  310                 return IngestModule.ProcessResult.OK;
 
  312             List<LayoutFile> carvedItems = parser.parse(newAuditFile, file, context);
 
  313             long calcdelta = (System.currentTimeMillis() - calcstart);
 
  314             totals.totalParsetime.addAndGet(calcdelta);
 
  315             if (carvedItems != null && !carvedItems.isEmpty()) { 
 
  316                 totals.totalItemsRecovered.addAndGet(carvedItems.size());
 
  317                 context.addFilesToJob(
new ArrayList<>(carvedItems));
 
  320         } 
catch (ReadContentInputStreamException ex) {
 
  321             totals.totalItemsWithErrors.incrementAndGet();
 
  322             logger.log(Level.WARNING, String.format(
"Error reading file '%s' (id=%d) with the PhotoRec carver.", file.getName(), file.getId()), ex); 
 
  323             MessageNotifyUtil.Notify.error(PhotoRecCarverIngestModuleFactory.getModuleName(), NbBundle.getMessage(PhotoRecCarverFileIngestModule.class, 
"PhotoRecIngestModule.error.msg", file.getName()));
 
  324             return IngestModule.ProcessResult.ERROR;
 
  325         } 
catch (IOException ex) {
 
  326             totals.totalItemsWithErrors.incrementAndGet();
 
  327             logger.log(Level.SEVERE, String.format(
"Error writing file '%s' (id=%d) to '%s' with the PhotoRec carver.", file.getName(), file.getId(), tempFilePath), ex); 
 
  328             MessageNotifyUtil.Notify.error(PhotoRecCarverIngestModuleFactory.getModuleName(), NbBundle.getMessage(PhotoRecCarverFileIngestModule.class, 
"PhotoRecIngestModule.error.msg", file.getName()));
 
  329             return IngestModule.ProcessResult.ERROR;
 
  331             if (null != tempFilePath && Files.exists(tempFilePath)) {
 
  333                 tempFilePath.toFile().delete();
 
  336         return IngestModule.ProcessResult.OK;
 
  340     private void cleanup(Path outputDirPath, Path tempFilePath) {
 
  342         FileUtil.deleteDir(
new File(outputDirPath.toString()));
 
  343         if (null != tempFilePath && Files.exists(tempFilePath)) {
 
  344             tempFilePath.toFile().delete();
 
  348     private static synchronized void postSummary(
long jobId) {
 
  349         IngestJobTotals jobTotals = totalsForIngestJobs.remove(jobId);
 
  351         StringBuilder detailsSb = 
new StringBuilder();
 
  353         detailsSb.append(
"<table border='0' cellpadding='4' width='280'>"); 
 
  355         detailsSb.append(
"<tr><td>") 
 
  356                 .append(NbBundle.getMessage(PhotoRecCarverFileIngestModule.class, 
"PhotoRecIngestModule.complete.numberOfCarved"))
 
  358         detailsSb.append(
"<td>").append(jobTotals.totalItemsRecovered.get()).append(
"</td></tr>"); 
 
  360         detailsSb.append(
"<tr><td>") 
 
  361                 .append(NbBundle.getMessage(PhotoRecCarverFileIngestModule.class, 
"PhotoRecIngestModule.complete.numberOfErrors"))
 
  363         detailsSb.append(
"<td>").append(jobTotals.totalItemsWithErrors.get()).append(
"</td></tr>"); 
 
  365         detailsSb.append(
"<tr><td>") 
 
  366                 .append(NbBundle.getMessage(PhotoRecCarverFileIngestModule.class, 
"PhotoRecIngestModule.complete.totalWritetime"))
 
  367                 .append(
"</td><td>").append(jobTotals.totalWritetime.get()).append(
"</td></tr>\n"); 
 
  368         detailsSb.append(
"<tr><td>") 
 
  369                 .append(NbBundle.getMessage(PhotoRecCarverFileIngestModule.class, 
"PhotoRecIngestModule.complete.totalParsetime"))
 
  370                 .append(
"</td><td>").append(jobTotals.totalParsetime.get()).append(
"</td></tr>\n"); 
 
  371         detailsSb.append(
"</table>"); 
 
  373         IngestServices.getInstance().postMessage(IngestMessage.createMessage(
 
  374                 IngestMessage.MessageType.INFO,
 
  375                 PhotoRecCarverIngestModuleFactory.getModuleName(),
 
  376                 NbBundle.getMessage(PhotoRecCarverFileIngestModule.class,
 
  377                         "PhotoRecIngestModule.complete.photoRecResults"),
 
  378                 detailsSb.toString()));
 
  386     public void shutDown() {
 
  387         if (this.context != null && refCounter.decrementAndGet(
this.jobId) == 0) {
 
  391                 WorkingPaths paths = PhotoRecCarverFileIngestModule.pathsByJob.remove(this.jobId);
 
  392                 FileUtil.deleteDir(
new File(paths.getTempDirPath().toString()));
 
  394             } 
catch (SecurityException ex) {
 
  395                 logger.log(Level.SEVERE, 
"Error shutting down PhotoRec carver module", ex); 
 
  406             this.outputDirPath = outputDirPath;
 
  407             this.tempDirPath = tempDirPath;
 
  410         Path getOutputDirPath() {
 
  411             return this.outputDirPath;
 
  414         Path getTempDirPath() {
 
  415             return this.tempDirPath;
 
  427     synchronized Path createModuleOutputDirectoryForCase() throws IngestModule.IngestModuleException {
 
  430             path = Paths.get(Case.getCurrentCaseThrows().getModuleDirectory(), PhotoRecCarverIngestModuleFactory.getModuleName());
 
  431         } 
catch (NoCurrentCaseException ex) {
 
  432             throw new IngestModule.IngestModuleException(Bundle.cannotCreateOutputDir_message(ex.getLocalizedMessage()), ex);
 
  435             Files.createDirectory(path);
 
  436             if (UNCPathUtilities.isUNC(path)) {
 
  440                     throw new IngestModule.IngestModuleException(Bundle.PhotoRecIngestModule_nonHostnameUNCPathUsed());
 
  442                 if (
false == FileUtil.hasReadWriteAccess(path)) {
 
  443                     throw new IngestModule.IngestModuleException(
 
  444                             Bundle.PhotoRecIngestModule_PermissionsNotSufficient() + SEP + path.toString() + SEP
 
  445                             + Bundle.PhotoRecIngestModule_PermissionsNotSufficientSeeReference()
 
  449         } 
catch (FileAlreadyExistsException ex) {
 
  451         } 
catch (IOException | SecurityException | UnsupportedOperationException ex) {
 
  452             throw new IngestModule.IngestModuleException(Bundle.cannotCreateOutputDir_message(ex.getLocalizedMessage()), ex);
 
  466     public static File locateExecutable() throws IngestModule.IngestModuleException {
 
  469         String photorec_linux_directory = 
"/usr/bin";
 
  470         if (PlatformUtil.isWindowsOS()) {
 
  471             execName = Paths.get(PHOTOREC_DIRECTORY, PHOTOREC_EXECUTABLE);
 
  472             exeFile = InstalledFileLocator.getDefault().locate(execName.toString(), PhotoRecCarverFileIngestModule.class.getPackage().getName(), 
false);
 
  474             File usrBin = 
new File(
"/usr/bin/photorec");
 
  475             File usrLocalBin = 
new File(
"/usr/local/bin/photorec");
 
  476             if (usrBin.canExecute() && usrBin.exists() && !usrBin.isDirectory()) {
 
  477                 photorec_linux_directory = 
"/usr/bin";
 
  478             }
else if(usrLocalBin.canExecute() && usrLocalBin.exists() && !usrLocalBin.isDirectory()){
 
  479                 photorec_linux_directory = 
"/usr/local/bin";
 
  481                 throw new IngestModule.IngestModuleException(
"Photorec not found");
 
  483             execName = Paths.get(photorec_linux_directory, PHOTOREC_LINUX_EXECUTABLE);
 
  484             exeFile = 
new File(execName.toString());
 
  487         if (null == exeFile) {
 
  488             throw new IngestModule.IngestModuleException(Bundle.missingExecutable_message());
 
  492         if (!exeFile.canExecute()) {
 
  493             throw new IngestModule.IngestModuleException(Bundle.cannotRunExecutable_message());
 
void fireModuleContentEvent(ModuleContentEvent moduleContentEvent)
synchronized static Logger getLogger(String name)
synchronized Path ipToHostName(Path inputPath)
static synchronized IngestServices getInstance()