FileManager.java

Go to the documentation of this file.

/*
 *
 * Autopsy Forensic Browser
 *
 * Copyright 2012-2021 Basis Technology Corp.
 * Copyright 2012 42six Solutions.
 * Contact: aebadirad <at> 42six <dot> com
 * Project Contact/Architect: carrier <at> sleuthkit <dot> org
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 * 
 * TODO (AUT-2158): This class should not extend Closeable.
 */
package org.sleuthkit.autopsy.casemodule.services;
 
import java.io.Closeable;
import java.io.IOException;
import java.nio.file.Files;
import java.nio.file.attribute.BasicFileAttributes;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;
import java.util.logging.Level;
import org.openide.util.NbBundle;
import org.sleuthkit.autopsy.datamodel.VirtualDirectoryNode;
import org.sleuthkit.autopsy.ingest.IngestServices;
import org.sleuthkit.autopsy.ingest.ModuleContentEvent;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.Content;
import org.sleuthkit.datamodel.DerivedFile;
import org.sleuthkit.datamodel.Host;
import org.sleuthkit.datamodel.LayoutFile;
import org.sleuthkit.datamodel.LocalDirectory;
import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction;
import org.sleuthkit.datamodel.SpecialDirectory;
import org.sleuthkit.datamodel.TskCoreException;
import org.sleuthkit.datamodel.TskFileRange;
import org.sleuthkit.datamodel.VirtualDirectory;
import org.sleuthkit.datamodel.LocalFilesDataSource;
import org.sleuthkit.datamodel.TskDataException;
import org.apache.commons.lang3.StringUtils;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.datamodel.CarvingResult;
import org.sleuthkit.datamodel.TskData;

public class FileManager implements Closeable {
 
    private static final Logger LOGGER = Logger.getLogger(FileManager.class.getName());
    private final SleuthkitCase caseDb;

    public FileManager(SleuthkitCase caseDb) {
        this.caseDb = caseDb;
    }

    public List<AbstractFile> findFilesByMimeType(Collection<String> mimeTypes) throws TskCoreException {
        return caseDb.findAllFilesWhere(createFileTypeInCondition(mimeTypes));
    }

    public List<AbstractFile> findFilesByParentPath(long dataSourceObjectID, String parentPath) throws TskCoreException {
        return caseDb.findAllFilesWhere(createParentPathCondition(dataSourceObjectID, parentPath));
    }

    public List<AbstractFile> findFilesByMimeType(Content dataSource, Collection<String> mimeTypes) throws TskCoreException {
        return caseDb.findAllFilesWhere("data_source_obj_id = " + dataSource.getId() + " AND " + createFileTypeInCondition(mimeTypes));
    }
    
    public List<AbstractFile> findFilesExactName(long parentId, String name) throws TskCoreException{
        return caseDb.getFileManager().findFilesExactName(parentId, name);
    }

    private static String createFileTypeInCondition(Collection<String> mimeTypes) {
        String types = StringUtils.join(mimeTypes, "', '");
        return "mime_type IN ('" + types + "')";
    }

    private static String createParentPathCondition(long dataSourceObjectID, String parentPath) {
        return "data_source_obj_id = " + dataSourceObjectID + " AND parent_path LIKE '" + parentPath + "%'";
    }

    public List<AbstractFile> findFiles(String fileName) throws TskCoreException {
        List<AbstractFile> result = new ArrayList<>();
        List<Content> dataSources = caseDb.getRootObjects();
        for (Content dataSource : dataSources) {
            result.addAll(findFiles(dataSource, fileName));
        }
        return result;
    }

    public List<AbstractFile> findFiles(String fileName, String parentSubString) throws TskCoreException {
        List<AbstractFile> result = new ArrayList<>();
        List<Content> dataSources = caseDb.getRootObjects();
        for (Content dataSource : dataSources) {
            result.addAll(findFiles(dataSource, fileName, parentSubString));
        }
        return result;
    }

    public List<AbstractFile> findFiles(String fileName, AbstractFile parent) throws TskCoreException {
        return caseDb.findFilesInFolder(fileName, parent);
    }

    public List<AbstractFile> findFiles(Content dataSource, String fileName) throws TskCoreException {
        return caseDb.findFiles(dataSource, fileName);
    }

    public List<AbstractFile> findFiles(Content dataSource, String fileName, String parentSubString) throws TskCoreException {
        return caseDb.findFiles(dataSource, fileName, parentSubString);
    }
 

    public List<AbstractFile> openFiles(Content dataSource, String filePath) throws TskCoreException {
        return caseDb.openFiles(dataSource, filePath);
    }

    public DerivedFile addDerivedFile(String fileName,
            String localPath,
            long size,
            long ctime, long crtime, long atime, long mtime,
            boolean isFile,
            Content parentObj,
            String rederiveDetails, String toolName, String toolVersion, String otherDetails,
            TskData.EncodingType encodingType) throws TskCoreException {
        return caseDb.addDerivedFile(fileName, localPath, size,
                ctime, crtime, atime, mtime,
                isFile, parentObj, rederiveDetails, toolName, toolVersion, otherDetails, encodingType);
    }

    public DerivedFile updateDerivedFile(DerivedFile derivedFile, String localPath,
            long size,
            long ctime, long crtime, long atime, long mtime,
            boolean isFile, String mimeType,
            String rederiveDetails, String toolName, String toolVersion, String otherDetails,
            TskData.EncodingType encodingType) throws TskCoreException {
        return caseDb.updateDerivedFile(derivedFile, localPath, size,
                ctime, crtime, atime, mtime,
                isFile, mimeType, rederiveDetails, toolName, toolVersion, otherDetails, encodingType);
    }

    public List<LayoutFile> addCarvedFiles(CarvingResult carvingResult) throws TskCoreException {
        return caseDb.addCarvedFiles(carvingResult);
    }

    public interface FileAddProgressUpdater {

        void fileAdded(AbstractFile newFile);
    }

    public LocalFilesDataSource addLocalFilesDataSource(String deviceId, String rootVirtualDirectoryName, String timeZone, List<String> localFilePaths, FileAddProgressUpdater progressUpdater) throws TskCoreException, TskDataException {
        return addLocalFilesDataSource(deviceId, rootVirtualDirectoryName, timeZone, null, localFilePaths, false, false, false, progressUpdater);
    }

    public LocalFilesDataSource addLocalFilesDataSource(String deviceId, String rootVirtualDirectoryName, String timeZone, Host host, List<String> localFilePaths, FileAddProgressUpdater progressUpdater) throws TskCoreException, TskDataException {
        return addLocalFilesDataSource(deviceId, rootVirtualDirectoryName, timeZone, host, localFilePaths, false, false, false, progressUpdater);
    }
    
    public LocalFilesDataSource addLocalFilesDataSource(String deviceId, String rootVirtualDirectoryName, String timeZone, Host host,
            List<String> localFilePaths, boolean createTimestamp, boolean accessTimestamp, boolean modifiedTimestamp, FileAddProgressUpdater progressUpdater) throws TskCoreException, TskDataException {
        List<java.io.File> localFiles = getFilesAndDirectories(localFilePaths);
        CaseDbTransaction trans = null;
        try {
            String rootDirectoryName = rootVirtualDirectoryName;
            if (rootDirectoryName.isEmpty()) {
                rootDirectoryName = generateFilesDataSourceName(caseDb);
            }
 
            /*
             * Add the root virtual directory and its local/logical file
             * children to the case database.
             */
            trans = caseDb.beginTransaction();
            LocalFilesDataSource dataSource = caseDb.addLocalFilesDataSource(deviceId, rootDirectoryName, timeZone, host, trans);
            List<AbstractFile> filesAdded = new ArrayList<>();
            for (java.io.File localFile : localFiles) {
                AbstractFile fileAdded = addLocalFile(trans, dataSource, localFile, createTimestamp, accessTimestamp, modifiedTimestamp, TskData.EncodingType.NONE, progressUpdater);
                if (null != fileAdded) {
                    filesAdded.add(fileAdded);
                } else {
                    throw new TskCoreException(NbBundle.getMessage(this.getClass(), "FileManager.addLocalFilesDirs.exception.cantAdd.msg", localFile.getAbsolutePath()));
                }
            }
            trans.commit();
            trans = null;
 
            /*
             * Publish content added events for the added files and directories.
             */
            for (AbstractFile fileAdded : filesAdded) {
                IngestServices.getInstance().fireModuleContentEvent(new ModuleContentEvent(fileAdded));
            }
 
            return dataSource;
 
        } finally {
            if (null != trans) {
                try {
                    trans.rollback();
                } catch (TskCoreException ex) {
                    LOGGER.log(Level.SEVERE, "Failed to rollback transaction after exception", ex);
                }
            }
        }
    }

    private static String generateFilesDataSourceName(SleuthkitCase caseDb) throws TskCoreException {
        int localFileDataSourcesCounter = 0;
        try {
            List<VirtualDirectory> localFileDataSources = caseDb.getVirtualDirectoryRoots();
            for (VirtualDirectory vd : localFileDataSources) {
                if (vd.getName().startsWith(VirtualDirectoryNode.LOGICAL_FILE_SET_PREFIX)) {
                    ++localFileDataSourcesCounter;
                }
            }
            return VirtualDirectoryNode.LOGICAL_FILE_SET_PREFIX + (localFileDataSourcesCounter + 1);
        } catch (TskCoreException ex) {
            throw new TskCoreException("Error querying for existing local file data sources with defualt names", ex);
        }
    }

    private List<java.io.File> getFilesAndDirectories(List<String> localFilePaths) throws TskDataException {
        List<java.io.File> localFiles = new ArrayList<>();
        for (String path : localFilePaths) {
            java.io.File localFile = new java.io.File(path);
            if (!localFile.exists() || !localFile.canRead()) {
                throw new TskDataException(String.format("File at %s does not exist or cannot be read", localFile.getAbsolutePath()));
            }
            localFiles.add(localFile);
        }
        return localFiles;
    }

    private AbstractFile addLocalFile(CaseDbTransaction trans, SpecialDirectory parentDirectory, java.io.File localFile, boolean createTime,
            boolean accessTime, boolean modifiedTime, TskData.EncodingType encodingType, FileAddProgressUpdater progressUpdater) throws TskCoreException {
        if (localFile.isDirectory()) {
            /*
             * Add the directory as a local directory.
             */
            LocalDirectory localDirectory = caseDb.addLocalDirectory(parentDirectory.getId(), localFile.getName(), trans);
            progressUpdater.fileAdded(localDirectory);
 
            /*
             * Add its children, if any.
             */
            final java.io.File[] childFiles = localFile.listFiles();
            if (childFiles != null && childFiles.length > 0) {
                for (java.io.File childFile : childFiles) {
                    addLocalFile(trans, localDirectory, childFile, createTime, accessTime, modifiedTime, encodingType, progressUpdater);
                }
            }
 
            return localDirectory;
        } else {
            long createTimestamp = 0;
            long modifiedTimestamp = 0;
            long accessTimestamp = 0;
            try {
                BasicFileAttributes attrs;
                attrs = Files.readAttributes(localFile.toPath(), BasicFileAttributes.class);
                if (createTime) {
                  createTimestamp = (attrs.creationTime().toMillis()/1000);
                }
                if (modifiedTime) {
                  modifiedTimestamp = (attrs.lastModifiedTime().toMillis()/1000);
                }
                if (accessTime) {
                  accessTimestamp = (attrs.lastAccessTime().toMillis()/1000);
                }
                return caseDb.addLocalFile(localFile.getName(), localFile.getAbsolutePath(), localFile.length(),
                    0, createTimestamp, accessTimestamp, modifiedTimestamp,
                    localFile.isFile(), encodingType, parentDirectory, trans);
            } catch (IOException ex) {
                return caseDb.addLocalFile(localFile.getName(), localFile.getAbsolutePath(), localFile.length(),
                    0, 0, 0, 0,
                    localFile.isFile(), encodingType, parentDirectory, trans);                
            }
        }
    }

    @Deprecated
    @Override
    public void close() throws IOException {
        /*
         * No-op maintained for backwards compatibility. Clients should not
         * attempt to close case services.
         */
    }    
    
    @Deprecated
    public VirtualDirectory addLocalFilesDirs(List<String> localFilePaths, FileAddProgressUpdater progressUpdater) throws TskCoreException {
        try {
            return addLocalFilesDataSource("", "", "", localFilePaths, progressUpdater).getRootDirectory();
        } catch (TskDataException ex) {
            throw new TskCoreException(ex.getLocalizedMessage(), ex);
        }
    }

    @Deprecated
    public LayoutFile addCarvedFile(String fileName, long fileSize, long parentObjId, List<TskFileRange> layout) throws TskCoreException {
        Content parent = caseDb.getContentById(parentObjId);
        List<CarvingResult.CarvedFile> carvedFiles = new ArrayList<>();
        carvedFiles.add(new CarvingResult.CarvedFile(fileName, fileSize, layout));
        List<LayoutFile> layoutFiles = caseDb.addCarvedFiles(new CarvingResult(parent, carvedFiles));
        return layoutFiles.get(0);
    }

    @Deprecated
    public List<LayoutFile> addCarvedFiles(List<org.sleuthkit.datamodel.CarvedFileContainer> filesToAdd) throws TskCoreException {
        return caseDb.addCarvedFiles(filesToAdd);
    }

    @Deprecated
    public DerivedFile addDerivedFile(String fileName,
            String localPath,
            long size,
            long ctime, long crtime, long atime, long mtime,
            boolean isFile,
            AbstractFile parentFile,
            String rederiveDetails, String toolName, String toolVersion, String otherDetails) throws TskCoreException {
        return addDerivedFile(fileName, localPath, size, ctime, crtime, atime, mtime, isFile, parentFile,
                rederiveDetails, toolName, toolVersion, otherDetails, TskData.EncodingType.NONE);
    }

    @Deprecated
    private AbstractFile addLocalFile(CaseDbTransaction trans, SpecialDirectory parentDirectory, java.io.File localFile, FileAddProgressUpdater progressUpdater) throws TskCoreException {
        return addLocalFile(trans, parentDirectory, localFile, false, false, false, TskData.EncodingType.NONE, progressUpdater);
    }
    
    @Deprecated
    public List<AbstractFile> findFiles(Content dataSource, String fileName, AbstractFile parent) throws TskCoreException {
        return findFiles(fileName, parent);
    }    
 
}