Autopsy  4.4.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
FileManager.java
Go to the documentation of this file.
1 /*
2  *
3  * Autopsy Forensic Browser
4  *
5  * Copyright 2011-2016 Basis Technology Corp.
6  *
7  * Copyright 2012 42six Solutions.
8  * Contact: aebadirad <at> 42six <dot> com
9  * Project Contact/Architect: carrier <at> sleuthkit <dot> org
10  *
11  * Licensed under the Apache License, Version 2.0 (the "License");
12  * you may not use this file except in compliance with the License.
13  * You may obtain a copy of the License at
14  *
15  * http://www.apache.org/licenses/LICENSE-2.0
16  *
17  * Unless required by applicable law or agreed to in writing, software
18  * distributed under the License is distributed on an "AS IS" BASIS,
19  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
20  * See the License for the specific language governing permissions and
21  * limitations under the License.
22  */
23 package org.sleuthkit.autopsy.casemodule.services;
24 
25 import java.io.Closeable;
26 import java.io.IOException;
27 import java.util.ArrayList;
28 import java.util.Collection;
29 import java.util.List;
30 import java.util.logging.Level;
31 import org.openide.util.NbBundle;
35 import org.sleuthkit.datamodel.AbstractFile;
36 import org.sleuthkit.datamodel.Content;
37 import org.sleuthkit.datamodel.DerivedFile;
38 import org.sleuthkit.datamodel.LayoutFile;
39 import org.sleuthkit.datamodel.LocalDirectory;
40 import org.sleuthkit.datamodel.SleuthkitCase;
41 import org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction;
42 import org.sleuthkit.datamodel.SpecialDirectory;
43 import org.sleuthkit.datamodel.TskCoreException;
44 import org.sleuthkit.datamodel.TskFileRange;
45 import org.sleuthkit.datamodel.VirtualDirectory;
46 import org.sleuthkit.datamodel.LocalFilesDataSource;
47 import org.sleuthkit.datamodel.TskDataException;
48 import org.apache.commons.lang3.StringUtils;
50 import org.sleuthkit.datamodel.AbstractContent;
51 import org.sleuthkit.datamodel.CarvingResult;
52 import org.sleuthkit.datamodel.TskData;
53 
59 public class FileManager implements Closeable {
60 
61  private static final Logger LOGGER = Logger.getLogger(FileManager.class.getName());
62  private SleuthkitCase caseDb;
63 
71  public FileManager(SleuthkitCase caseDb) {
72  this.caseDb = caseDb;
73  }
74 
85  public synchronized List<AbstractFile> findFilesByMimeType(Collection<String> mimeTypes) throws TskCoreException {
86  if (null == caseDb) {
87  throw new TskCoreException("File manager has been closed");
88  }
89  return caseDb.findAllFilesWhere(createFileTypeInCondition(mimeTypes));
90  }
91 
104  public synchronized List<AbstractFile> findFilesByMimeType(Content dataSource, Collection<String> mimeTypes) throws TskCoreException {
105  if (null == caseDb) {
106  throw new TskCoreException("File manager has been closed");
107  }
108  return caseDb.findAllFilesWhere("data_source_obj_id = " + dataSource.getId() + " AND " + createFileTypeInCondition(mimeTypes));
109  }
110 
118  private static String createFileTypeInCondition(Collection<String> mimeTypes) {
119  String types = StringUtils.join(mimeTypes, "', '");
120  return "mime_type IN ('" + types + "')";
121  }
122 
135  public synchronized List<AbstractFile> findFiles(String fileName) throws TskCoreException {
136  if (null == caseDb) {
137  throw new TskCoreException("File manager has been closed");
138  }
139  List<AbstractFile> result = new ArrayList<>();
140  List<Content> dataSources = caseDb.getRootObjects();
141  for (Content dataSource : dataSources) {
142  result.addAll(findFiles(dataSource, fileName));
143  }
144  return result;
145  }
146 
161  public synchronized List<AbstractFile> findFiles(String fileName, String parentName) throws TskCoreException {
162  if (null == caseDb) {
163  throw new TskCoreException("File manager has been closed");
164  }
165  List<AbstractFile> result = new ArrayList<>();
166  List<Content> dataSources = caseDb.getRootObjects();
167  for (Content dataSource : dataSources) {
168  result.addAll(findFiles(dataSource, fileName, parentName));
169  }
170  return result;
171  }
172 
187  public synchronized List<AbstractFile> findFiles(String fileName, AbstractFile parent) throws TskCoreException {
188  if (null == caseDb) {
189  throw new TskCoreException("File manager has been closed");
190  }
191  List<AbstractFile> result = new ArrayList<>();
192  List<Content> dataSources = caseDb.getRootObjects();
193  for (Content dataSource : dataSources) {
194  result.addAll(findFiles(dataSource, fileName, parent));
195  }
196  return result;
197  }
198 
213  public synchronized List<AbstractFile> findFiles(Content dataSource, String fileName) throws TskCoreException {
214  if (null == caseDb) {
215  throw new TskCoreException("File manager has been closed");
216  }
217  return caseDb.findFiles(dataSource, fileName);
218  }
219 
236  public synchronized List<AbstractFile> findFiles(Content dataSource, String fileName, String parentName) throws TskCoreException {
237  if (null == caseDb) {
238  throw new TskCoreException("File manager has been closed");
239  }
240  return caseDb.findFiles(dataSource, fileName, parentName);
241  }
242 
259  public synchronized List<AbstractFile> findFiles(Content dataSource, String fileName, AbstractFile parent) throws TskCoreException {
260  if (null == caseDb) {
261  throw new TskCoreException("File manager has been closed");
262  }
263  return findFiles(dataSource, fileName, parent.getName());
264  }
265 
282  public synchronized List<AbstractFile> openFiles(Content dataSource, String filePath) throws TskCoreException {
283  if (null == caseDb) {
284  throw new TskCoreException("File manager has been closed");
285  }
286  return caseDb.openFiles(dataSource, filePath);
287  }
288 
318  public synchronized DerivedFile addDerivedFile(String fileName,
319  String localPath,
320  long size,
321  long ctime, long crtime, long atime, long mtime,
322  boolean isFile,
323  Content parentObj,
324  String rederiveDetails, String toolName, String toolVersion, String otherDetails,
325  TskData.EncodingType encodingType) throws TskCoreException {
326  if (null == caseDb) {
327  throw new TskCoreException("File manager has been closed");
328  }
329  return caseDb.addDerivedFile(fileName, localPath, size,
330  ctime, crtime, atime, mtime,
331  isFile, parentObj, rederiveDetails, toolName, toolVersion, otherDetails, encodingType);
332  }
333 
345  public synchronized List<LayoutFile> addCarvedFiles(CarvingResult carvingResult) throws TskCoreException {
346  if (null == caseDb) {
347  throw new TskCoreException("File manager has been closed");
348  }
349  return caseDb.addCarvedFiles(carvingResult);
350  }
351 
356  public interface FileAddProgressUpdater {
357 
363  void fileAdded(AbstractFile newFile);
364  }
365 
394  public synchronized LocalFilesDataSource addLocalFilesDataSource(String deviceId, String rootVirtualDirectoryName, String timeZone, List<String> localFilePaths, FileAddProgressUpdater progressUpdater) throws TskCoreException, TskDataException {
395  if (null == caseDb) {
396  throw new TskCoreException("File manager has been closed");
397  }
398  List<java.io.File> localFiles = getFilesAndDirectories(localFilePaths);
399  CaseDbTransaction trans = null;
400  try {
401  String rootDirectoryName = rootVirtualDirectoryName;
402  if (rootDirectoryName.isEmpty()) {
403  rootDirectoryName = generateFilesDataSourceName(caseDb);
404  }
405 
406  /*
407  * Add the root virtual directory and its local/logical file
408  * children to the case database.
409  */
410  trans = caseDb.beginTransaction();
411  LocalFilesDataSource dataSource = caseDb.addLocalFilesDataSource(deviceId, rootDirectoryName, timeZone, trans);
412  VirtualDirectory rootDirectory = dataSource.getRootDirectory();
413  List<AbstractFile> filesAdded = new ArrayList<>();
414  for (java.io.File localFile : localFiles) {
415  AbstractFile fileAdded = addLocalFile(trans, rootDirectory, localFile, TskData.EncodingType.NONE, progressUpdater);
416  if (null != fileAdded) {
417  filesAdded.add(fileAdded);
418  } else {
419  throw new TskCoreException(NbBundle.getMessage(this.getClass(), "FileManager.addLocalFilesDirs.exception.cantAdd.msg", localFile.getAbsolutePath()));
420  }
421  }
422  trans.commit();
423 
424  /*
425  * Publish content added events for the added files and directories.
426  */
427  for (AbstractFile fileAdded : filesAdded) {
429  }
430 
431  return dataSource;
432 
433  } catch (TskCoreException ex) {
434  if (null != trans) {
435  try {
436  trans.rollback();
437  } catch (TskCoreException ex2) {
438  LOGGER.log(Level.SEVERE, String.format("Failed to rollback transaction after exception: %s", ex.getMessage()), ex2);
439  }
440  }
441  throw ex;
442  }
443  }
444 
458  private static synchronized String generateFilesDataSourceName(SleuthkitCase caseDb) throws TskCoreException {
459  int localFileDataSourcesCounter = 0;
460  try {
461  List<VirtualDirectory> localFileDataSources = caseDb.getVirtualDirectoryRoots();
462  for (VirtualDirectory vd : localFileDataSources) {
463  if (vd.getName().startsWith(VirtualDirectoryNode.LOGICAL_FILE_SET_PREFIX)) {
464  ++localFileDataSourcesCounter;
465  }
466  }
467  return VirtualDirectoryNode.LOGICAL_FILE_SET_PREFIX + (localFileDataSourcesCounter + 1);
468  } catch (TskCoreException ex) {
469  throw new TskCoreException("Error querying for existing local file data sources with defualt names", ex);
470  }
471  }
472 
485  private List<java.io.File> getFilesAndDirectories(List<String> localFilePaths) throws TskDataException {
486  List<java.io.File> localFiles = new ArrayList<>();
487  for (String path : localFilePaths) {
488  java.io.File localFile = new java.io.File(path);
489  if (!localFile.exists() || !localFile.canRead()) {
490  throw new TskDataException(String.format("File at %s does not exist or cannot be read", localFile.getAbsolutePath()));
491  }
492  localFiles.add(localFile);
493  }
494  return localFiles;
495  }
496 
513  private AbstractFile addLocalFile(CaseDbTransaction trans, SpecialDirectory parentDirectory, java.io.File localFile,
514  TskData.EncodingType encodingType, FileAddProgressUpdater progressUpdater) throws TskCoreException {
515  if (localFile.isDirectory()) {
516  /*
517  * Add the directory as a local directory.
518  */
519  LocalDirectory localDirectory = caseDb.addLocalDirectory(parentDirectory.getId(), localFile.getName(), trans);
520  progressUpdater.fileAdded(localDirectory);
521 
522  /*
523  * Add its children, if any.
524  */
525  final java.io.File[] childFiles = localFile.listFiles();
526  if (childFiles != null && childFiles.length > 0) {
527  for (java.io.File childFile : childFiles) {
528  addLocalFile(trans, localDirectory, childFile, progressUpdater);
529  }
530  }
531 
532  return localDirectory;
533  } else {
534  return caseDb.addLocalFile(localFile.getName(), localFile.getAbsolutePath(), localFile.length(),
535  0, 0, 0, 0,
536  localFile.isFile(), encodingType, parentDirectory, trans);
537  }
538  }
539 
545  @Override
546  public synchronized void close() throws IOException {
547  caseDb = null;
548  }
549 
568  @Deprecated
569  public synchronized VirtualDirectory addLocalFilesDirs(List<String> localFilePaths, FileAddProgressUpdater progressUpdater) throws TskCoreException {
570  if (null == caseDb) {
571  throw new TskCoreException("File manager has been closed");
572  }
573  try {
574  return addLocalFilesDataSource("", "", "", localFilePaths, progressUpdater).getRootDirectory();
575  } catch (TskDataException ex) {
576  throw new TskCoreException(ex.getLocalizedMessage(), ex);
577  }
578  }
579 
598  @Deprecated
599  public synchronized LayoutFile addCarvedFile(String fileName, long fileSize, long parentObjId, List<TskFileRange> layout) throws TskCoreException {
600  if (null == caseDb) {
601  throw new TskCoreException("File manager has been closed");
602  }
603  Content parent = caseDb.getContentById(parentObjId);
604  List<CarvingResult.CarvedFile> carvedFiles = new ArrayList<>();
605  carvedFiles.add(new CarvingResult.CarvedFile(fileName, fileSize, layout));
606  List<LayoutFile> layoutFiles = caseDb.addCarvedFiles(new CarvingResult(parent, carvedFiles));
607  return layoutFiles.get(0);
608  }
609 
625  @Deprecated
626  public synchronized List<LayoutFile> addCarvedFiles(List<org.sleuthkit.datamodel.CarvedFileContainer> filesToAdd) throws TskCoreException {
627  if (null == caseDb) {
628  throw new TskCoreException("File manager has been closed");
629  }
630  return caseDb.addCarvedFiles(filesToAdd);
631  }
632 
663  @Deprecated
664  public synchronized DerivedFile addDerivedFile(String fileName,
665  String localPath,
666  long size,
667  long ctime, long crtime, long atime, long mtime,
668  boolean isFile,
669  AbstractFile parentFile,
670  String rederiveDetails, String toolName, String toolVersion, String otherDetails) throws TskCoreException {
671  return addDerivedFile(fileName, localPath, size, ctime, crtime, atime, mtime, isFile, parentFile,
672  rederiveDetails, toolName, toolVersion, otherDetails, TskData.EncodingType.NONE);
673  }
674 
694  @Deprecated
695  private AbstractFile addLocalFile(CaseDbTransaction trans, SpecialDirectory parentDirectory, java.io.File localFile, FileAddProgressUpdater progressUpdater) throws TskCoreException {
696  return addLocalFile(trans, parentDirectory, localFile, TskData.EncodingType.NONE, progressUpdater);
697  }
698 
699 }
synchronized List< AbstractFile > findFiles(String fileName, String parentName)
static String createFileTypeInCondition(Collection< String > mimeTypes)
synchronized VirtualDirectory addLocalFilesDirs(List< String > localFilePaths, FileAddProgressUpdater progressUpdater)
synchronized LayoutFile addCarvedFile(String fileName, long fileSize, long parentObjId, List< TskFileRange > layout)
synchronized List< AbstractFile > findFiles(Content dataSource, String fileName)
synchronized DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, Content parentObj, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType)
synchronized DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parentFile, String rederiveDetails, String toolName, String toolVersion, String otherDetails)
AbstractFile addLocalFile(CaseDbTransaction trans, SpecialDirectory parentDirectory, java.io.File localFile, FileAddProgressUpdater progressUpdater)
synchronized List< AbstractFile > findFilesByMimeType(Collection< String > mimeTypes)
synchronized List< LayoutFile > addCarvedFiles(List< org.sleuthkit.datamodel.CarvedFileContainer > filesToAdd)
synchronized List< AbstractFile > openFiles(Content dataSource, String filePath)
synchronized LocalFilesDataSource addLocalFilesDataSource(String deviceId, String rootVirtualDirectoryName, String timeZone, List< String > localFilePaths, FileAddProgressUpdater progressUpdater)
static synchronized String generateFilesDataSourceName(SleuthkitCase caseDb)
synchronized List< AbstractFile > findFilesByMimeType(Content dataSource, Collection< String > mimeTypes)
void fireModuleContentEvent(ModuleContentEvent moduleContentEvent)
synchronized List< AbstractFile > findFiles(String fileName)
AbstractFile addLocalFile(CaseDbTransaction trans, SpecialDirectory parentDirectory, java.io.File localFile, TskData.EncodingType encodingType, FileAddProgressUpdater progressUpdater)
synchronized static Logger getLogger(String name)
Definition: Logger.java:161
synchronized List< LayoutFile > addCarvedFiles(CarvingResult carvingResult)
synchronized List< AbstractFile > findFiles(Content dataSource, String fileName, AbstractFile parent)
synchronized List< AbstractFile > findFiles(String fileName, AbstractFile parent)
List< java.io.File > getFilesAndDirectories(List< String > localFilePaths)
synchronized List< AbstractFile > findFiles(Content dataSource, String fileName, String parentName)
static synchronized IngestServices getInstance()

Copyright © 2012-2016 Basis Technology. Generated on: Fri Sep 29 2017
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.