Autopsy  4.14.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
ExtractOs.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2019 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.recentactivity;
20 
21 import java.util.ArrayList;
22 import java.util.Arrays;
23 import java.util.Collection;
24 import java.util.Collections;
25 import java.util.List;
26 import java.util.logging.Level;
27 import org.apache.commons.io.FilenameUtils;
28 import org.openide.util.NbBundle.Messages;
33 import org.sleuthkit.datamodel.AbstractFile;
34 import org.sleuthkit.datamodel.BlackboardArtifact;
35 import org.sleuthkit.datamodel.BlackboardAttribute;
36 import org.sleuthkit.datamodel.Content;
37 import org.sleuthkit.datamodel.TskCoreException;
38 
43 @Messages({"ExtractOs.parentModuleName=Recent Activity",
44  "ExtractOS_progressMessage=Checking for OS"})
45 class ExtractOs extends Extract {
46 
47  private static final Logger logger = Logger.getLogger(ExtractOs.class.getName());
48 
49  private static final String WINDOWS_VOLUME_PATH = "/windows/system32";
50  private static final String OSX_VOLUME_PATH = "/System/Library/CoreServices/SystemVersion.plist";
51  private static final String ANDROID_VOLUME_PATH = "/data/com.android.providers.settings/databases/settings.db";
52  //linux specific files reference https://www.novell.com/coolsolutions/feature/11251.html
53  private static final String LINUX_RED_HAT_PATHS[] = {"/etc/redhat-release", "/etc/redhat_version"};
54  private static final String LINUX_NOVELL_SUSE_PATH = "/etc/SUSE-release";
55  private static final String LINUX_FEDORA_PATH = "/etc/fedora-release";
56  private static final String LINUX_SLACKWARE_PATHS[] = {"/etc/slackware-release", "/etc/slackware-version"};
57  private static final String LINUX_DEBIAN_PATHS[] = {"/etc/debian_release", "/etc/debian_version"};
58  private static final String LINUX_MANDRAKE_PATH = "/etc/mandrake-release";
59  private static final String LINUX_YELLOW_DOG_PATH = "/etc/yellowdog-release";
60  private static final String LINUX_SUN_JDS_PATH = "/etc/sun-release";
61  private static final String LINUX_SOLARIS_SPARC_PATH = "/etc/release";
62  private static final String LINUX_GENTOO_PATH = "/etc/gentoo-release";
63  private static final String LINUX_UNITED_LINUX_PATH = "/etc/UnitedLinux-release";
64  private static final String LINUX_UBUNTU_PATH = "/etc/lsb-release";
65 
66  private Content dataSource;
67 
68  @Override
69  void process(Content dataSource, IngestJobContext context, DataSourceIngestModuleProgress progressBar) {
70  this.dataSource = dataSource;
71  try {
72  progressBar.progress(Bundle.ExtractOS_progressMessage());
73  for (OS_TYPE value : OS_TYPE.values()) {
74  checkForOSFiles(value);
75  }
76  } catch (TskCoreException ex) {
77  logger.log(Level.WARNING, "Failed to check if datasource contained a volume with operating system specific files", ex);
78  }
79  }
80 
88  private void checkForOSFiles(OS_TYPE osType) throws TskCoreException {
89  if (osType.getOsInfoLabel().isEmpty()) {
90  //shortcut out if it was called with out a specified program name so no OS INFO artifacts are created
91  return;
92  }
93  AbstractFile file = getFirstFileFound(osType.getFilePaths());
94 
95  if (file != null && tskCase.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_INFO, file.getId()).isEmpty()) {
96  //if the os info program name is not empty create an os info artifact on the first of the files found
97  Collection<BlackboardAttribute> bbattributes = new ArrayList<>();
98  bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME,
99  Bundle.ExtractOs_parentModuleName(),
100  osType.getOsInfoLabel())); //NON-NLS
101  postArtifact(createArtifactWithAttributes(BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_INFO, file, bbattributes));
102  }
103  }
104 
115  private AbstractFile getFirstFileFound(List<String> pathsToSearchFor) throws TskCoreException{
116  FileManager fileManager = currentCase.getServices().getFileManager();
117  for (String filePath : pathsToSearchFor) {
118  for (AbstractFile file : fileManager.findFiles(dataSource, FilenameUtils.getName(filePath), FilenameUtils.getPath(filePath))) {
119  if ((file.getParentPath() + file.getName()).equals(filePath)) {
120  return file;
121  }
122  }
123  }
124  return null;
125  }
126 
127  @Messages({
128  "ExtractOs.osx.label=Mac OS X",
129  "ExtractOs.androidOs.label=Android",
130  "ExtractOs.redhatLinuxOs.label=Linux (Redhat)",
131  "ExtractOs.novellSUSEOs.label=Linux (Novell SUSE)",
132  "ExtractOs.fedoraLinuxOs.label=Linux (Fedora)",
133  "ExtractOs.slackwareLinuxOs.label=Linux (Slackware)",
134  "ExtractOs.debianLinuxOs.label=Linux (Debian)",
135  "ExtractOs.mandrakeLinuxOs.label=Linux (Mandrake)",
136  "ExtractOs.yellowDogLinuxOs.label=Linux (Yellow Dog)",
137  "ExtractOs.sunJDSLinuxOs.label=Linux (Sun JDS)",
138  "ExtractOs.solarisSparcOs.label=Linux (Solaris/Sparc)",
139  "ExtractOs.gentooLinuxOs.label=Linux (Gentoo)",
140  "ExtractOs.unitedLinuxOs.label=Linux (United Linux)",
141  "ExtractOs.ubuntuLinuxOs.label=Linux (Ubuntu)",
142  "ExtractOs.windowsVolume.label=OS Drive (Windows)",
143  "ExtractOs.osxVolume.label=OS Drive (OS X)",
144  "ExtractOs.androidVolume.label=OS Drive (Android)",
145  "ExtractOs.redhatLinuxVolume.label=OS Drive (Linux Redhat)",
146  "ExtractOs.novellSUSEVolume.label=OS Drive (Linux Novell SUSE)",
147  "ExtractOs.fedoraLinuxVolume.label=OS Drive (Linux Fedora)",
148  "ExtractOs.slackwareLinuxVolume.label=OS Drive (Linux Slackware)",
149  "ExtractOs.debianLinuxVolume.label=OS Drive (Linux Debian)",
150  "ExtractOs.mandrakeLinuxVolume.label=OS Drive (Linux Mandrake)",
151  "ExtractOs.yellowDogLinuxVolume.label=OS Drive (Linux Yellow Dog)",
152  "ExtractOs.sunJDSLinuxVolume.label=OS Drive (Linux Sun JDS)",
153  "ExtractOs.solarisSparcVolume.label=OS Drive (Linux Solaris/Sparc)",
154  "ExtractOs.gentooLinuxVolume.label=OS Drive (Linux Gentoo)",
155  "ExtractOs.unitedLinuxVolume.label=OS Drive (Linux United Linux)",
156  "ExtractOs.ubuntuLinuxVolume.label=OS Drive (Linux Ubuntu)"})
161  enum OS_TYPE {
162  WINDOWS("", Bundle.ExtractOs_windowsVolume_label(), Arrays.asList(WINDOWS_VOLUME_PATH)), //windows doesn't get OS_INFO artifacts created for it here
163  MAC_OS_X(Bundle.ExtractOs_osx_label(), Bundle.ExtractOs_osxVolume_label(), Arrays.asList(OSX_VOLUME_PATH)),
164  ANDROID(Bundle.ExtractOs_androidOs_label(), Bundle.ExtractOs_androidVolume_label(), Arrays.asList(ANDROID_VOLUME_PATH)),
165  LINUX_REDHAT(Bundle.ExtractOs_redhatLinuxOs_label(), Bundle.ExtractOs_redhatLinuxVolume_label(), Arrays.asList(LINUX_RED_HAT_PATHS)),
166  LINUX_NOVELL_SUSE(Bundle.ExtractOs_novellSUSEOs_label(), Bundle.ExtractOs_novellSUSEVolume_label(), Arrays.asList(LINUX_NOVELL_SUSE_PATH)),
167  LINUX_FEDORA(Bundle.ExtractOs_fedoraLinuxOs_label(), Bundle.ExtractOs_fedoraLinuxVolume_label(), Arrays.asList(LINUX_FEDORA_PATH)),
168  LINUX_SLACKWARE(Bundle.ExtractOs_slackwareLinuxOs_label(), Bundle.ExtractOs_slackwareLinuxVolume_label(), Arrays.asList(LINUX_SLACKWARE_PATHS)),
169  LINUX_DEBIAN(Bundle.ExtractOs_debianLinuxOs_label(), Bundle.ExtractOs_debianLinuxVolume_label(), Arrays.asList(LINUX_DEBIAN_PATHS)),
170  LINUX_MANDRAKE(Bundle.ExtractOs_mandrakeLinuxOs_label(), Bundle.ExtractOs_mandrakeLinuxVolume_label(), Arrays.asList(LINUX_MANDRAKE_PATH)),
171  LINUX_YELLOW_DOG(Bundle.ExtractOs_yellowDogLinuxOs_label(), Bundle.ExtractOs_yellowDogLinuxVolume_label(), Arrays.asList(LINUX_YELLOW_DOG_PATH)),
172  LINUX_SUN_JDS(Bundle.ExtractOs_sunJDSLinuxOs_label(), Bundle.ExtractOs_sunJDSLinuxVolume_label(), Arrays.asList(LINUX_SUN_JDS_PATH)),
173  LINUX_SOLARIS_SPARC(Bundle.ExtractOs_solarisSparcOs_label(), Bundle.ExtractOs_solarisSparcVolume_label(), Arrays.asList(LINUX_SOLARIS_SPARC_PATH)),
174  LINUX_GENTOO(Bundle.ExtractOs_gentooLinuxOs_label(), Bundle.ExtractOs_gentooLinuxVolume_label(), Arrays.asList(LINUX_GENTOO_PATH)),
175  LINUX_UNITED_LINUX(Bundle.ExtractOs_unitedLinuxOs_label(), Bundle.ExtractOs_unitedLinuxVolume_label(), Arrays.asList(LINUX_UNITED_LINUX_PATH)),
176  LINUX_UBUNTU(Bundle.ExtractOs_ubuntuLinuxOs_label(), Bundle.ExtractOs_ubuntuLinuxVolume_label(), Arrays.asList(LINUX_UBUNTU_PATH));
177 
178  private final String osInfoLabel;
179  private final String dsUsageLabel;
180  private final List<String> filePaths;
181 
192  private OS_TYPE(String osInfoText, String dsUsageText, List<String> filePathList) {
193  this.osInfoLabel = osInfoText;
194  this.dsUsageLabel = dsUsageText;
195  this.filePaths = filePathList;
196  }
197 
204  String getOsInfoLabel() {
205  return osInfoLabel;
206  }
207 
214  String getDsUsageLabel() {
215  return dsUsageLabel;
216  }
217 
224  List<String> getFilePaths() {
225  return Collections.unmodifiableList(filePaths);
226  }
227 
238  static public OS_TYPE fromDsUsageLabel(String dsUsageLabel) {
239  for (OS_TYPE value : OS_TYPE.values()) {
240  if (value.getDsUsageLabel().equals(dsUsageLabel)) {
241  return value;
242  }
243  }
244  return null;
245  }
246 
256  static public OS_TYPE fromOsInfoLabel(String osInfoLabel) {
257  for (OS_TYPE value : OS_TYPE.values()) {
258  if (value.getOsInfoLabel().equals(osInfoLabel)) {
259  return value;
260  }
261  }
262  return null;
263  }
264  }
265 }

Copyright © 2012-2020 Basis Technology. Generated on: Wed Apr 8 2020
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.