FilesSet.java

Go to the documentation of this file.

/*
 * Autopsy Forensic Browser
 *
 * Copyright 2011-2018 Basis Technology Corp.
 * Contact: carrier <at> sleuthkit <dot> org
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.sleuthkit.autopsy.modules.interestingitems;
 
import java.io.Serializable;
import java.util.ArrayList;
import java.util.Collections;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.Map.Entry;
import java.util.UUID;
import java.util.regex.Pattern;
import org.openide.util.NbBundle;
import org.openide.util.NbBundle.Messages;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.TskData;

public final class FilesSet implements Serializable {
 
    private static final long serialVersionUID = 1L;
    private final String name;
    private final String description;
    private final boolean ignoreKnownFiles;
    private final boolean ignoreUnallocatedSpace;
 
    private final boolean standardSet;
    private final int versionNumber;
 
    private final Map<String, Rule> rules;
    
    // NOTE: these fields are derived from 'rules' which may happen at runtime 
    // due to deserialization of older FilesSet objects before inclusive and 
    // exclusive rules existed.
    private Map<String, Rule> inclusiveRules;
    private Map<String, Rule> exclusiveRules;

    public FilesSet(String name, String description, boolean ignoreKnownFiles, boolean ignoreUnallocatedSpace, Map<String, Rule> rules) {
        this(name, description, ignoreKnownFiles, ignoreUnallocatedSpace, rules, false, 0);
    }

    public FilesSet(String name, String description, boolean ignoreKnownFiles, boolean ignoreUnallocatedSpace, Map<String, Rule> rules,
            boolean standardSet, int versionNumber) {
        if ((name == null) || (name.isEmpty())) {
            throw new IllegalArgumentException("Interesting files set name cannot be null or empty");
        }
 
        if (versionNumber < 0) {
            throw new IllegalArgumentException("version number must be >= 0");
        }
 
        this.standardSet = standardSet;
        this.versionNumber = versionNumber;
 
        this.name = name;
        this.description = (description != null ? description : "");
        this.ignoreKnownFiles = ignoreKnownFiles;
        this.ignoreUnallocatedSpace = ignoreUnallocatedSpace;
        this.rules = rules == null ? Collections.emptyMap() : new HashMap<>(rules);
        
        divideInclusiveExclusive();
    }

    private void divideInclusiveExclusive() {
        Map<String, Rule> inclusiveRules = new HashMap<>();
        Map<String, Rule> exclusiveRules = new HashMap<>();
        if (this.rules != null) {
            for (Entry<String, Rule> ruleEntry : this.rules.entrySet()) {
                if (ruleEntry.getValue().isExclusive()) {
                    exclusiveRules.put(ruleEntry.getKey(), ruleEntry.getValue());
                } else {
                    inclusiveRules.put(ruleEntry.getKey(), ruleEntry.getValue());
                }
            }
        }
        this.inclusiveRules = inclusiveRules;
        this.exclusiveRules = exclusiveRules;
    }

    boolean isStandardSet() {
        return standardSet;
    }

    int getVersionNumber() {
        return versionNumber;
    }

    public String getName() {
        return this.name;
    }

    public String getDescription() {
        return this.description;
    }

    public boolean ignoresKnownFiles() {
        return this.ignoreKnownFiles;
    }

    public boolean ingoresUnallocatedSpace() {
        return this.ignoreUnallocatedSpace;
    }

    public Map<String, Rule> getRules() {
        return new HashMap<>(this.rules);
    }
    
    
     @Messages({
         "FileSet_fileIsMemberOf_noInclusiveRules_ruleName=Not Excluded"
     })
    public String fileIsMemberOf(AbstractFile file) {
        if ((this.ignoreKnownFiles) && (file.getKnown() == TskData.FileKnown.KNOWN)) {
            return null;
        }
 
        if ((this.ignoreUnallocatedSpace)
                && (file.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS)
                || file.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.SLACK)
                || file.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS))) {
            return null;
        }
        
        if (inclusiveRules == null || exclusiveRules == null) {
            divideInclusiveExclusive();
        }
 
 
        String ruleName;
        if (inclusiveRules.isEmpty()) {
            // in the event there are no rules, return null for no match
            if (exclusiveRules.isEmpty()) {
                return null;
            // in the event there are exclusion rules, rely on those
            } else {
                ruleName = Bundle.FileSet_fileIsMemberOf_noInclusiveRules_ruleName();
            }
            
        } else {
            // if there are inclusive rules, at least one should be matched
            ruleName = null;
            for (Rule rule : inclusiveRules.values()) {
                if (rule.isSatisfied(file)) {
                    ruleName = rule.getName();
                    break;
                }
            }
        }
        
        for (Rule rule : exclusiveRules.values()) {
            if (rule.isSatisfied(file)) {
                return null;
            }
        }
        
        return ruleName;
    }
 
    @Override
    public String toString() {
        // This override is designed to provide a display name for use with 
        // javax.swing.DefaultListModel<E>.
        return this.name;
    }

    public final static class Rule implements Serializable {
 
        private static final long serialVersionUID = 1L;
        private final String uuid;
        private final String ruleName;
        private final Boolean exclusive;
        private final FileNameCondition fileNameCondition;
        private final MetaTypeCondition metaTypeCondition;
        private final ParentPathCondition pathCondition;
        private final MimeTypeCondition mimeTypeCondition;
        private final FileSizeCondition fileSizeCondition;
        private final DateCondition dateCondition;
        private final List<FileAttributeCondition> conditions = new ArrayList<>();

        public Rule(String ruleName, FileNameCondition fileNameCondition, MetaTypeCondition metaTypeCondition, 
                ParentPathCondition pathCondition, MimeTypeCondition mimeTypeCondition, 
                FileSizeCondition fileSizeCondition, DateCondition dateCondition, 
                Boolean exclusive) {
            
            // since ruleName is optional, ruleUUID can be used to uniquely identify a rule.
            this.uuid = UUID.randomUUID().toString();
            if (metaTypeCondition == null) {
                throw new IllegalArgumentException("Interesting files set rule meta-type condition cannot be null");
            }
 
            this.ruleName = ruleName;
 
            /*
             * The rules are evaluated in the order added. MetaType check is
             * fastest, so do it first
             */
            this.metaTypeCondition = metaTypeCondition;
            this.conditions.add(this.metaTypeCondition);
 
            this.fileSizeCondition = fileSizeCondition;
            if (this.fileSizeCondition != null) {
                this.conditions.add(this.fileSizeCondition);
            }
 
            this.fileNameCondition = fileNameCondition;
            if (this.fileNameCondition != null) {
                this.conditions.add(fileNameCondition);
            }
 
            this.mimeTypeCondition = mimeTypeCondition;
            if (this.mimeTypeCondition != null) {
                this.conditions.add(mimeTypeCondition);
            }
 
            this.pathCondition = pathCondition;
            if (this.pathCondition != null) {
                this.conditions.add(this.pathCondition);
            }
            this.dateCondition = dateCondition;
            if (this.dateCondition != null) {
                this.conditions.add(this.dateCondition);
            }
            
            this.exclusive = exclusive;
        }

        public String getName() {
            return ruleName;
        }

        public FileNameCondition getFileNameCondition() {
            return this.fileNameCondition;
        }

        public MetaTypeCondition getMetaTypeCondition() {
            return this.metaTypeCondition;
        }

        public ParentPathCondition getPathCondition() {
            return this.pathCondition;
        }
 
        public DateCondition getDateCondition() {
            return this.dateCondition;
        }

        public boolean isExclusive() {
            return exclusive != null && exclusive == true;
        }

        public boolean isSatisfied(AbstractFile file) {
            for (FileAttributeCondition condition : conditions) {
                if (!condition.passes(file)) {
                    return false;
                }
            }
            return true;
        }
 
        @NbBundle.Messages({
            "# {0} - daysIncluded",
            "FilesSet.rule.dateRule.toString=(modified within {0} day(s))"
        })
        @Override
        public String toString() {
            // This override is designed to provide a display name for use with 
            // javax.swing.DefaultListModel<E>.
            if (fileNameCondition != null) {
                return this.ruleName + " (" + fileNameCondition.getTextToMatch() + ")";
            } else if (this.pathCondition != null) {
                return this.ruleName + " (" + pathCondition.getTextToMatch() + ")";
            } else if (this.mimeTypeCondition != null) {
                return this.ruleName + " (" + mimeTypeCondition.getMimeType() + ")";
            } else if (this.fileSizeCondition != null) {
                return this.ruleName + " (" + fileSizeCondition.getComparator().getSymbol() + " " + fileSizeCondition.getSizeValue()
                        + " " + fileSizeCondition.getUnit().getName() + ")";
            } else if (this.dateCondition != null) {
                return this.ruleName + Bundle.FilesSet_rule_dateRule_toString(dateCondition.getDaysIncluded());
            } else {
                return this.ruleName + " ()";
            }
 
        }

        public String getUuid() {
            return this.uuid;
        }

        public MimeTypeCondition getMimeTypeCondition() {
            return mimeTypeCondition;
        }

        public FileSizeCondition getFileSizeCondition() {
            return fileSizeCondition;
        }

        static interface FileAttributeCondition extends Serializable {

            boolean passes(AbstractFile file);
        }

        public static final class MimeTypeCondition implements FileAttributeCondition {
 
            private static final long serialVersionUID = 1L;
            private final String mimeType;

            public MimeTypeCondition(String mimeType) {
                this.mimeType = mimeType;
            }
 
            @Override
            public boolean passes(AbstractFile file) {
                return this.mimeType.equals(file.getMIMEType());
            }

            public String getMimeType() {
                return this.mimeType;
            }
 
        }

        public static final class FileSizeCondition implements FileAttributeCondition {
 
            private static final long serialVersionUID = 1L;

            public static enum COMPARATOR {
 
                LESS_THAN("<"),
                LESS_THAN_EQUAL("≤"),
                EQUAL("="),
                GREATER_THAN(">"),
                GREATER_THAN_EQUAL("≥");
 
                private String symbol;
 
                private COMPARATOR(String symbol) {
                    this.symbol = symbol;
                }
 
                public static COMPARATOR fromSymbol(String symbol) {
                    switch (symbol) {
                        case "<=":
                        case "≤":
                            return LESS_THAN_EQUAL;
                        case "<":
                            return LESS_THAN;
                        case "==":
                        case "=":
                            return EQUAL;
                        case ">":
                            return GREATER_THAN;
                        case ">=":
                        case "≥":
                            return GREATER_THAN_EQUAL;
                        default:
                            throw new IllegalArgumentException("Invalid symbol");
                    }
                }

                public String getSymbol() {
                    return symbol;
                }
            }

            public static enum SIZE_UNIT {
 
                BYTE(1, "Bytes"),
                KILOBYTE(1024, "Kilobytes"),
                MEGABYTE(1024 * 1024, "Megabytes"),
                GIGABYTE(1024 * 1024 * 1024, "Gigabytes");
                private long size;
                private String name;
 
                private SIZE_UNIT(long size, String name) {
                    this.size = size;
                    this.name = name;
                }
 
                public long getSize() {
                    return this.size;
                }
 
                public static SIZE_UNIT fromName(String name) {
                    for (SIZE_UNIT unit : SIZE_UNIT.values()) {
                        if (unit.getName().equals(name)) {
                            return unit;
                        }
                    }
                    throw new IllegalArgumentException("Invalid name for size unit.");
                }

                public String getName() {
                    return name;
                }
            }
            private final COMPARATOR comparator;
            private final SIZE_UNIT unit;
            private final int sizeValue;
 
            public FileSizeCondition(COMPARATOR comparator, SIZE_UNIT unit, int sizeValue) {
                this.comparator = comparator;
                this.unit = unit;
                this.sizeValue = sizeValue;
            }

            public COMPARATOR getComparator() {
                return comparator;
            }

            public SIZE_UNIT getUnit() {
                return unit;
            }

            public int getSizeValue() {
                return sizeValue;
            }
 
            @Override
            public boolean passes(AbstractFile file) {
                long fileSize = file.getSize();
                long conditionSize = this.getUnit().getSize() * this.getSizeValue();
                switch (this.getComparator()) {
                    case GREATER_THAN:
                        return fileSize > conditionSize;
                    case GREATER_THAN_EQUAL:
                        return fileSize >= conditionSize;
                    case LESS_THAN_EQUAL:
                        return fileSize <= conditionSize;
                    case LESS_THAN:
                        return fileSize < conditionSize;
                    default:
                        return fileSize == conditionSize;
 
                }
            }
 
        }

        public static final class MetaTypeCondition implements FileAttributeCondition {
 
            private static final long serialVersionUID = 1L;
 
            public enum Type {
 
                FILES,
                DIRECTORIES,
                FILES_AND_DIRECTORIES,
                ALL
            }
 
            private final Type type;

            public MetaTypeCondition(Type type) {
                this.type = type;
            }
 
            @Override
            public boolean passes(AbstractFile file) {
                switch (this.type) {
                    case FILES:
                        return file.isFile();
                    case DIRECTORIES:
                        return file.getMetaType() == TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR
                                || file.getMetaType() == TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR;
                    case FILES_AND_DIRECTORIES:
                        return file.getMetaType() == TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_REG
                                || file.getMetaType() == TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR
                                || file.getMetaType() == TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR;
                    case ALL:
                        return true;  //Effectively ignores the metatype condition when All is selected.
                    default:
                        return true;
                }
            }

            public Type getMetaType() {
                return this.type;
            }
        }

        static interface TextCondition extends FileAttributeCondition {

            String getTextToMatch();

            boolean isRegex();

            boolean textMatches(String textToMatch);
 
        }

        private static abstract class AbstractTextCondition implements TextCondition {
 
            /*
             * To ensure compatibility with existing serialized configuration
             * settings, this class cannot have a 'serialVersionUID'.
             */
            private final TextMatcher textMatcher;

            AbstractTextCondition(String text, Boolean partialMatch) {
                if (partialMatch) {
                    this.textMatcher = new FilesSet.Rule.CaseInsensitivePartialStringComparisionMatcher(text);
                } else {
                    this.textMatcher = new FilesSet.Rule.CaseInsensitiveStringComparisionMatcher(text);
                }
            }

            AbstractTextCondition(Pattern regex) {
                this.textMatcher = new FilesSet.Rule.RegexMatcher(regex);
            }

            AbstractTextCondition(List<String> values) {
                this.textMatcher = new FilesSet.Rule.CaseInsensitiveMultiValueStringComparisionMatcher(values);
            }

            @Override
            public String getTextToMatch() {
                return this.textMatcher.getTextToMatch();
            }

            @Override
            public boolean isRegex() {
                return this.textMatcher.isRegex();
            }

            @Override
            public boolean textMatches(String textToMatch) {
                return this.textMatcher.textMatches(textToMatch);
            }
 
            @Override
            public abstract boolean passes(AbstractFile file);
 
        }

        public static final class ParentPathCondition extends AbstractTextCondition {
 
            private static final long serialVersionUID = 1L;

            public ParentPathCondition(String path) {
                super(path, true);
            }

            public ParentPathCondition(Pattern path) {
                super(path);
            }
 
            @Override
            public boolean passes(AbstractFile file) {
                return this.textMatches(file.getParentPath() + "/");
            }
 
        }

        static interface FileNameCondition extends TextCondition {
        }

        public static final class FullNameCondition extends AbstractTextCondition implements FileNameCondition {
 
            private static final long serialVersionUID = 1L;

            public FullNameCondition(String name) {
                super(name, false);
            }

            public FullNameCondition(Pattern name) {
                super(name);
            }
 
            @Override
            public boolean passes(AbstractFile file) {
                return this.textMatches(file.getName());
            }
 
        }

        public static final class DateCondition implements FileAttributeCondition {
 
            /*
             * To ensure compatibility with existing serialized configuration
             * settings, this class cannot have a 'serialVersionUID'.
             */
            private final static long SECS_PER_DAY = 60 * 60 * 24;
 
            private int daysIncluded;

            public DateCondition(int days) {
                daysIncluded = days;
            }

            public int getDaysIncluded() {
                return daysIncluded;
            }
 
            @Override
            public boolean passes(AbstractFile file) {
                long dateThreshold = System.currentTimeMillis() / 1000 - daysIncluded * SECS_PER_DAY;
                return file.getCrtime() > dateThreshold || file.getMtime() > dateThreshold;
            }
 
        }

        public static final class ExtensionCondition extends AbstractTextCondition implements FileNameCondition {
 
            private static final long serialVersionUID = 1L;

            public ExtensionCondition(String extension) {
                // If there is a leading ".", strip it since 
                // AbstractFile.getFileNameExtension() returns just the 
                // extension chars and not the dot.
                super(normalize(extension), false);
            }

            public ExtensionCondition(List<String> extensions) {
                // If there is a leading "." in any list value, strip it since 
                // AbstractFile.getFileNameExtension() returns just the 
                // extension chars and not the dot.
                super(normalize(extensions));
            }

            public ExtensionCondition(Pattern extension) {
                super(extension);
            }
 
            @Override
            public boolean passes(AbstractFile file) {
                return this.textMatches(file.getNameExtension());
            }

            private static List<String> normalize(List<String> extensions) {
                List<String> values = new ArrayList<>(extensions);
 
                for (int i = 0; i < values.size(); i++) {
                    values.set(i, normalize(values.get(i)));
                }
 
                return values;
            }

            private static String normalize(String extension) {
                return extension.startsWith(".") ? extension.substring(1) : extension;
            }
 
        }

        private static interface TextMatcher extends Serializable {

            String getTextToMatch();

            boolean isRegex();

            boolean textMatches(String subject);
 
        }

        private static class CaseInsensitiveStringComparisionMatcher implements TextMatcher {
 
            private static final long serialVersionUID = 1L;
            private final String textToMatch;

            CaseInsensitiveStringComparisionMatcher(String textToMatch) {
                this.textToMatch = textToMatch;
            }
 
            @Override
            public String getTextToMatch() {
                return this.textToMatch;
            }
 
            @Override
            public boolean isRegex() {
                return false;
            }
 
            @Override
            public boolean textMatches(String subject) {
                return subject.equalsIgnoreCase(textToMatch);
            }
 
        }

        private static class CaseInsensitivePartialStringComparisionMatcher implements TextMatcher {
 
            private static final long serialVersionUID = 1L;
            private final String textToMatch;
            private final Pattern pattern;

            CaseInsensitivePartialStringComparisionMatcher(String textToMatch) {
                this.textToMatch = textToMatch;
                this.pattern = Pattern.compile(Pattern.quote(textToMatch), Pattern.CASE_INSENSITIVE);
            }
 
            @Override
            public String getTextToMatch() {
                return this.textToMatch;
            }
 
            @Override
            public boolean isRegex() {
                return false;
            }
 
            @Override
            public boolean textMatches(String subject) {
                return pattern.matcher(subject).find();
            }
        }

        private static class CaseInsensitiveMultiValueStringComparisionMatcher implements TextMatcher {
 
            private static final long serialVersionUID = 1L;
            private final List<String> valuesToMatch;

            CaseInsensitiveMultiValueStringComparisionMatcher(List<String> valuesToMatch) {
                this.valuesToMatch = valuesToMatch;
            }
 
            @Override
            public String getTextToMatch() {
                return String.join(",", this.valuesToMatch);
            }
 
            @Override
            public boolean isRegex() {
                return false;
            }
 
            @Override
            public boolean textMatches(String subject) {
                for (String value : valuesToMatch) {
                    if (value.equalsIgnoreCase(subject)) {
                        return true;
                    }
                }
                return false;
            }
 
        }

        private static class RegexMatcher implements TextMatcher {
 
            private static final long serialVersionUID = 1L;
            private final Pattern regex;

            RegexMatcher(Pattern regex) {
                this.regex = regex;
            }
 
            @Override
            public String getTextToMatch() {
                return this.regex.pattern();
            }
 
            @Override
            public boolean isRegex() {
                return true;
            }
 
            @Override
            public boolean textMatches(String subject) {
                // A single match is sufficient.
                return this.regex.matcher(subject).find();
            }
 
        }
 
    }
 
}