19 package org.sleuthkit.autopsy.casemodule;
22 import java.io.IOException;
23 import java.nio.file.Path;
24 import java.nio.file.Paths;
25 import java.util.ArrayList;
26 import java.util.Arrays;
27 import java.util.List;
28 import java.util.UUID;
29 import java.util.logging.Level;
30 import javax.swing.JPanel;
31 import javax.swing.filechooser.FileFilter;
32 import org.apache.commons.io.FilenameUtils;
33 import org.openide.modules.InstalledFileLocator;
34 import org.openide.util.NbBundle;
35 import org.openide.util.NbBundle.Messages;
36 import org.openide.util.lookup.ServiceProvider;
37 import org.openide.util.lookup.ServiceProviders;
52 @ServiceProviders(value = {
53 @ServiceProvider(service = DataSourceProcessor.class),
54 @ServiceProvider(service = AutoIngestDataSourceProcessor.class)
57 "LocalFilesDSProcessor.logicalEvidenceFilter.desc=Logical Evidence Files (L01)"
61 private static final String DATA_SOURCE_TYPE = NbBundle.getMessage(
LocalFilesDSProcessor.class,
"LocalFilesDSProcessor.dsType");
64 private static final String L01_EXTRACTION_DIR =
"L01";
65 private static final String UNIQUENESS_CONSTRAINT_SEPERATOR =
"_";
66 private static final String EWFEXPORT_DIR =
"ewfexport_exec";
67 private static final String EWFEXPORT_32_BIT_DIR =
"32-bit";
68 private static final String EWFEXPORT_64_BIT_DIR =
"64-bit";
69 private static final String EWFEXPORT_WINDOWS_EXE =
"ewfexport.exe";
70 private static final String LOG_FILE_EXTENSION =
".txt";
71 private static final List<String> LOGICAL_EVIDENCE_EXTENSIONS = Arrays.asList(
".l01");
72 private static final String LOGICAL_EVIDENCE_DESC = Bundle.LocalFilesDSProcessor_logicalEvidenceFilter_desc();
88 configPanel = LogicalFilesDspPanel.getDefault();
99 return DATA_SOURCE_TYPE;
111 return DATA_SOURCE_TYPE;
124 configPanel.select();
137 return configPanel.validatePanel();
156 if (!setDataSourceOptionsCalled) {
157 localFilePaths = configPanel.getContentPaths();
158 if (configPanel.subTypeIsLogicalEvidencePanel()) {
161 localFilePaths = extractLogicalEvidenceFileContents(localFilePaths);
164 final List<String> errors =
new ArrayList<>();
165 errors.add(ex.getMessage());
169 logger.log(Level.WARNING,
"Exception while getting open case.", ex);
174 run(UUID.randomUUID().toString(), configPanel.getFileSetName(), localFilePaths, progressMonitor, callback);
190 final List<String> extractedPaths =
new ArrayList<>();
192 ewfexportPath = locateEwfexportExecutable();
193 List<String> command =
new ArrayList<>();
194 for (
final String l01Path : logicalEvidenceFilePaths) {
196 command.add(ewfexportPath.toAbsolutePath().toString());
198 command.add(
"files");
201 if (!l01Dir.exists()) {
204 Path dirPath = Paths.get(FilenameUtils.getBaseName(l01Path) + UNIQUENESS_CONSTRAINT_SEPERATOR + System.currentTimeMillis());
206 command.add(dirPath.toString());
207 command.add(l01Path);
208 ProcessBuilder processBuilder =
new ProcessBuilder(command);
209 processBuilder.directory(l01Dir);
212 Path logFileName = Paths.get(l01Dir.toString(), dirPath.toString() + LOG_FILE_EXTENSION);
213 File logFile =
new File(logFileName.toString());
214 Path errFileName = Paths.get(l01Dir.toString(), dirPath.toString() + LOG_FILE_EXTENSION);
215 File errFile =
new File(errFileName.toString());
216 processBuilder.redirectError(ProcessBuilder.Redirect.appendTo(errFile));
217 processBuilder.redirectOutput(ProcessBuilder.Redirect.appendTo(logFile));
220 if (l01Dir.toPath().resolve(dirPath).toFile().exists()) {
221 extractedPaths.add(l01Dir.toPath().resolve(dirPath).toString());
223 throw new L01Exception(
"Can not process the selected L01 file, ewfExport was unable to extract any files from it.");
226 }
catch (SecurityException ex) {
227 throw new L01Exception(
"Security exception occcured while trying to extract l01 contents", ex);
228 }
catch (IOException ex) {
229 throw new L01Exception(
"IOException occcured while trying to extract l01 contents", ex);
232 return extractedPaths;
240 static FileFilter getLogicalEvidenceFilter() {
241 return LOGICAL_EVIDENCE_FILTER;
255 throw new L01Exception(
"L01 files are only supported on windows currently");
260 final File ewfRoot = InstalledFileLocator.getDefault().locate(EWFEXPORT_DIR,
LocalFilesDSProcessor.class.getPackage().getName(),
false);
264 executablePath = Paths.get(
265 ewfRoot.getAbsolutePath(),
266 EWFEXPORT_64_BIT_DIR,
267 EWFEXPORT_WINDOWS_EXE);
269 executablePath = Paths.get(
270 ewfRoot.getAbsolutePath(),
271 EWFEXPORT_32_BIT_DIR,
272 EWFEXPORT_WINDOWS_EXE);
277 final File ewfexport = executablePath.toFile();
278 if (null == ewfexport || !ewfexport.exists()) {
281 if (!ewfexport.canExecute()) {
285 return executablePath;
312 new Thread(
new AddLocalFilesTask(deviceId, rootVirtualDirectoryName, localFilePaths, progressMonitor, callback)).start();
335 configPanel.select();
336 localFilePaths = null;
337 setDataSourceOptionsCalled =
false;
346 List<String> filePaths = Arrays.asList(
new String[]{dataSourcePath.toString()});
349 if (filePaths.size() == 1) {
350 for (
final String path : filePaths) {
351 if (
new File(path).isFile() && LOGICAL_EVIDENCE_FILTER.
accept(
new File(path))) {
354 filePaths = extractLogicalEvidenceFileContents(filePaths);
355 }
catch (L01Exception ex) {
356 logger.log(Level.WARNING,
"File extension was .l01 but contents of logical evidence file were unable to be extracted", ex);
360 logger.log(Level.WARNING,
"Exception while getting open case.", ex);
371 List<String> filePaths = Arrays.asList(
new String[]{dataSourcePath.toString()});
372 run(deviceId,
"", filePaths, progressMonitor, callBack);
392 this.localFilePaths = Arrays.asList(paths.split(
","));
393 setDataSourceOptionsCalled =
true;
399 private final class L01Exception
extends Exception {
401 private static final long serialVersionUID = 1L;
403 L01Exception(
final String message) {
407 L01Exception(
final String message,
final Throwable cause) {
408 super(message, cause);
List< String > localFilePaths
final LogicalFilesDspPanel configPanel
void run(DataSourceProcessorProgressMonitor progressMonitor, DataSourceProcessorCallback callback)
static int execute(ProcessBuilder processBuilder)
String getDataSourceType()
void setDataSourceOptions(String paths)
void process(String deviceId, Path dataSourcePath, DataSourceProcessorProgressMonitor progressMonitor, DataSourceProcessorCallback callBack)
void done(DataSourceProcessorResult result, List< String > errList, List< Content > newDataSources)
List< String > extractLogicalEvidenceFileContents(final List< String > logicalEvidenceFilePaths)
String getModuleDirectory()
Path locateEwfexportExecutable()
int canProcess(Path dataSourcePath)
boolean setDataSourceOptionsCalled
synchronized static Logger getLogger(String name)
static Case getCurrentCaseThrows()
void run(String deviceId, String rootVirtualDirectoryName, List< String > localFilePaths, DataSourceProcessorProgressMonitor progressMonitor, DataSourceProcessorCallback callback)