23 package org.sleuthkit.autopsy.casemodule.services;
25 import java.io.Closeable;
26 import java.io.IOException;
27 import java.util.ArrayList;
28 import java.util.Collection;
29 import java.util.List;
30 import java.util.logging.Level;
31 import org.openide.util.NbBundle;
41 import org.
sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction;
48 import org.apache.commons.lang3.StringUtils;
85 public synchronized List<AbstractFile>
findFilesByMimeType(Collection<String> mimeTypes)
throws TskCoreException {
87 throw new TskCoreException(
"File manager has been closed");
104 public synchronized List<AbstractFile>
findFilesByMimeType(Content dataSource, Collection<String> mimeTypes)
throws TskCoreException {
105 if (null == caseDb) {
106 throw new TskCoreException(
"File manager has been closed");
108 return caseDb.findAllFilesWhere(
"data_source_obj_id = " + dataSource.getId() +
" AND " +
createFileTypeInCondition(mimeTypes));
119 String types = StringUtils.join(mimeTypes,
"', '");
120 return "mime_type IN ('" + types +
"')";
135 public synchronized List<AbstractFile>
findFiles(String fileName)
throws TskCoreException {
136 if (null == caseDb) {
137 throw new TskCoreException(
"File manager has been closed");
139 List<AbstractFile> result =
new ArrayList<>();
140 List<Content> dataSources = caseDb.getRootObjects();
141 for (Content dataSource : dataSources) {
142 result.addAll(
findFiles(dataSource, fileName));
161 public synchronized List<AbstractFile>
findFiles(String fileName, String parentName)
throws TskCoreException {
162 if (null == caseDb) {
163 throw new TskCoreException(
"File manager has been closed");
165 List<AbstractFile> result =
new ArrayList<>();
166 List<Content> dataSources = caseDb.getRootObjects();
167 for (Content dataSource : dataSources) {
168 result.addAll(
findFiles(dataSource, fileName, parentName));
187 public synchronized List<AbstractFile>
findFiles(String fileName, AbstractFile parent)
throws TskCoreException {
188 if (null == caseDb) {
189 throw new TskCoreException(
"File manager has been closed");
191 List<AbstractFile> result =
new ArrayList<>();
192 List<Content> dataSources = caseDb.getRootObjects();
193 for (Content dataSource : dataSources) {
194 result.addAll(
findFiles(dataSource, fileName, parent));
213 public synchronized List<AbstractFile>
findFiles(Content dataSource, String fileName)
throws TskCoreException {
214 if (null == caseDb) {
215 throw new TskCoreException(
"File manager has been closed");
217 return caseDb.findFiles(dataSource, fileName);
236 public synchronized List<AbstractFile>
findFiles(Content dataSource, String fileName, String parentName)
throws TskCoreException {
237 if (null == caseDb) {
238 throw new TskCoreException(
"File manager has been closed");
240 return caseDb.findFiles(dataSource, fileName, parentName);
259 public synchronized List<AbstractFile>
findFiles(Content dataSource, String fileName, AbstractFile parent)
throws TskCoreException {
260 if (null == caseDb) {
261 throw new TskCoreException(
"File manager has been closed");
263 return findFiles(dataSource, fileName, parent.getName());
282 public synchronized List<AbstractFile>
openFiles(Content dataSource, String filePath)
throws TskCoreException {
283 if (null == caseDb) {
284 throw new TskCoreException(
"File manager has been closed");
286 return caseDb.openFiles(dataSource, filePath);
321 long ctime,
long crtime,
long atime,
long mtime,
324 String rederiveDetails, String toolName, String toolVersion, String otherDetails,
325 TskData.EncodingType encodingType) throws TskCoreException {
326 if (null == caseDb) {
327 throw new TskCoreException(
"File manager has been closed");
329 return caseDb.addDerivedFile(fileName, localPath, size,
330 ctime, crtime, atime, mtime,
331 isFile, parentObj, rederiveDetails, toolName, toolVersion, otherDetails, encodingType);
345 public synchronized List<LayoutFile>
addCarvedFiles(CarvingResult carvingResult)
throws TskCoreException {
346 if (null == caseDb) {
347 throw new TskCoreException(
"File manager has been closed");
349 return caseDb.addCarvedFiles(carvingResult);
394 public synchronized LocalFilesDataSource
addLocalFilesDataSource(String deviceId, String rootVirtualDirectoryName, String timeZone, List<String> localFilePaths,
FileAddProgressUpdater progressUpdater)
throws TskCoreException, TskDataException {
395 if (null == caseDb) {
396 throw new TskCoreException(
"File manager has been closed");
399 CaseDbTransaction trans = null;
401 String rootDirectoryName = rootVirtualDirectoryName;
402 if (rootDirectoryName.isEmpty()) {
410 trans = caseDb.beginTransaction();
411 LocalFilesDataSource dataSource = caseDb.addLocalFilesDataSource(deviceId, rootDirectoryName, timeZone, trans);
412 VirtualDirectory rootDirectory = dataSource.getRootDirectory();
413 List<AbstractFile> filesAdded =
new ArrayList<>();
414 for (java.io.File localFile : localFiles) {
415 AbstractFile fileAdded =
addLocalFile(trans, rootDirectory, localFile, TskData.EncodingType.NONE, progressUpdater);
416 if (null != fileAdded) {
417 filesAdded.add(fileAdded);
419 throw new TskCoreException(NbBundle.getMessage(
this.getClass(),
"FileManager.addLocalFilesDirs.exception.cantAdd.msg", localFile.getAbsolutePath()));
427 for (AbstractFile fileAdded : filesAdded) {
433 }
catch (TskCoreException ex) {
437 }
catch (TskCoreException ex2) {
438 LOGGER.log(Level.SEVERE, String.format(
"Failed to rollback transaction after exception: %s", ex.getMessage()), ex2);
459 int localFileDataSourcesCounter = 0;
461 List<VirtualDirectory> localFileDataSources = caseDb.getVirtualDirectoryRoots();
462 for (VirtualDirectory vd : localFileDataSources) {
464 ++localFileDataSourcesCounter;
468 }
catch (TskCoreException ex) {
469 throw new TskCoreException(
"Error querying for existing local file data sources with defualt names", ex);
486 List<java.io.File> localFiles =
new ArrayList<>();
487 for (String path : localFilePaths) {
488 java.io.File localFile =
new java.io.File(path);
489 if (!localFile.exists() || !localFile.canRead()) {
490 throw new TskDataException(String.format(
"File at %s does not exist or cannot be read", localFile.getAbsolutePath()));
492 localFiles.add(localFile);
513 private AbstractFile
addLocalFile(CaseDbTransaction trans, SpecialDirectory parentDirectory, java.io.File localFile,
515 if (localFile.isDirectory()) {
519 LocalDirectory localDirectory = caseDb.addLocalDirectory(parentDirectory.getId(), localFile.getName(), trans);
520 progressUpdater.fileAdded(localDirectory);
525 final java.io.File[] childFiles = localFile.listFiles();
526 if (childFiles != null && childFiles.length > 0) {
527 for (java.io.File childFile : childFiles) {
528 addLocalFile(trans, localDirectory, childFile, progressUpdater);
532 return localDirectory;
534 return caseDb.addLocalFile(localFile.getName(), localFile.getAbsolutePath(), localFile.length(),
536 localFile.isFile(), encodingType, parentDirectory, trans);
546 public synchronized void close() throws IOException {
570 if (null == caseDb) {
571 throw new TskCoreException(
"File manager has been closed");
575 }
catch (TskDataException ex) {
576 throw new TskCoreException(ex.getLocalizedMessage(), ex);
599 public synchronized LayoutFile
addCarvedFile(String fileName,
long fileSize,
long parentObjId, List<TskFileRange> layout)
throws TskCoreException {
600 if (null == caseDb) {
601 throw new TskCoreException(
"File manager has been closed");
603 Content parent = caseDb.getContentById(parentObjId);
604 List<CarvingResult.CarvedFile> carvedFiles =
new ArrayList<>();
605 carvedFiles.add(
new CarvingResult.CarvedFile(fileName, fileSize, layout));
606 List<LayoutFile> layoutFiles = caseDb.addCarvedFiles(
new CarvingResult(parent, carvedFiles));
607 return layoutFiles.get(0);
626 public synchronized List<LayoutFile>
addCarvedFiles(List<org.sleuthkit.datamodel.CarvedFileContainer> filesToAdd)
throws TskCoreException {
627 if (null == caseDb) {
628 throw new TskCoreException(
"File manager has been closed");
630 return caseDb.addCarvedFiles(filesToAdd);
667 long ctime,
long crtime,
long atime,
long mtime,
669 AbstractFile parentFile,
670 String rederiveDetails, String toolName, String toolVersion, String otherDetails)
throws TskCoreException {
671 return addDerivedFile(fileName, localPath, size, ctime, crtime, atime, mtime, isFile, parentFile,
672 rederiveDetails, toolName, toolVersion, otherDetails, TskData.EncodingType.NONE);
695 private AbstractFile
addLocalFile(CaseDbTransaction trans, SpecialDirectory parentDirectory, java.io.File localFile,
FileAddProgressUpdater progressUpdater)
throws TskCoreException {
696 return addLocalFile(trans, parentDirectory, localFile, TskData.EncodingType.NONE, progressUpdater);
synchronized List< AbstractFile > findFiles(String fileName, String parentName)
synchronized void close()
static String createFileTypeInCondition(Collection< String > mimeTypes)
synchronized VirtualDirectory addLocalFilesDirs(List< String > localFilePaths, FileAddProgressUpdater progressUpdater)
static final Logger LOGGER
synchronized LayoutFile addCarvedFile(String fileName, long fileSize, long parentObjId, List< TskFileRange > layout)
void fileAdded(AbstractFile newFile)
synchronized List< AbstractFile > findFiles(Content dataSource, String fileName)
synchronized DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, Content parentObj, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType)
synchronized DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parentFile, String rederiveDetails, String toolName, String toolVersion, String otherDetails)
AbstractFile addLocalFile(CaseDbTransaction trans, SpecialDirectory parentDirectory, java.io.File localFile, FileAddProgressUpdater progressUpdater)
synchronized List< AbstractFile > findFilesByMimeType(Collection< String > mimeTypes)
synchronized List< LayoutFile > addCarvedFiles(List< org.sleuthkit.datamodel.CarvedFileContainer > filesToAdd)
synchronized List< AbstractFile > openFiles(Content dataSource, String filePath)
synchronized LocalFilesDataSource addLocalFilesDataSource(String deviceId, String rootVirtualDirectoryName, String timeZone, List< String > localFilePaths, FileAddProgressUpdater progressUpdater)
static synchronized String generateFilesDataSourceName(SleuthkitCase caseDb)
synchronized List< AbstractFile > findFilesByMimeType(Content dataSource, Collection< String > mimeTypes)
void fireModuleContentEvent(ModuleContentEvent moduleContentEvent)
synchronized List< AbstractFile > findFiles(String fileName)
AbstractFile addLocalFile(CaseDbTransaction trans, SpecialDirectory parentDirectory, java.io.File localFile, TskData.EncodingType encodingType, FileAddProgressUpdater progressUpdater)
synchronized static Logger getLogger(String name)
synchronized List< LayoutFile > addCarvedFiles(CarvingResult carvingResult)
FileManager(SleuthkitCase caseDb)
static final String LOGICAL_FILE_SET_PREFIX
synchronized List< AbstractFile > findFiles(Content dataSource, String fileName, AbstractFile parent)
synchronized List< AbstractFile > findFiles(String fileName, AbstractFile parent)
List< java.io.File > getFilesAndDirectories(List< String > localFilePaths)
synchronized List< AbstractFile > findFiles(Content dataSource, String fileName, String parentName)
static synchronized IngestServices getInstance()