19 package org.sleuthkit.autopsy.modules.filetypeid;
21 import java.util.ArrayList;
22 import java.util.Collections;
23 import java.util.List;
24 import java.util.SortedSet;
25 import java.util.TreeSet;
26 import java.util.logging.Level;
27 import java.util.stream.Collectors;
28 import org.apache.tika.Tika;
29 import org.apache.tika.mime.MimeTypes;
30 import org.openide.util.NbBundle;
51 private static final Tika
tika =
new Tika();
69 TreeSet<String> detectedTypes =
new TreeSet<>((String string1, String string2) -> {
70 int result = String.CASE_INSENSITIVE_ORDER.compare(string1, string2);
72 result = string1.compareTo(string2);
78 for (FileType fileType : CustomFileTypesManager.getInstance().getAutopsyDefinedFileTypes()) {
79 detectedTypes.add(fileType.getMimeType());
81 }
catch (CustomFileTypesManager.CustomFileTypesException ex) {
82 throw new FileTypeDetectorInitException(
"Error loading Autopsy custom file types", ex);
85 for (FileType fileType : CustomFileTypesManager.getInstance().getUserDefinedFileTypes()) {
86 detectedTypes.add(fileType.getMimeType());
88 }
catch (CustomFileTypesManager.CustomFileTypesException ex) {
89 throw new FileTypeDetectorInitException(
"Error loading user custom file types", ex);
102 if (null == tikaDetectedTypes) {
103 tikaDetectedTypes =
org.apache.tika.mime.MimeTypes.getDefaultMimeTypes().getMediaTypeRegistry().getTypes()
104 .stream().filter(t -> !t.hasParameters()).map(s -> s.toString()).collect(Collectors.toCollection(TreeSet::new));
106 return Collections.unmodifiableSortedSet(tikaDetectedTypes);
123 userDefinedFileTypes = CustomFileTypesManager.getInstance().getUserDefinedFileTypes();
124 autopsyDefinedFileTypes = CustomFileTypesManager.getInstance().getAutopsyDefinedFileTypes();
125 }
catch (CustomFileTypesManager.CustomFileTypesException ex) {
126 throw new FileTypeDetectorInitException(
"Error loading custom file types", ex);
154 for (FileType fileType : customTypes) {
155 if (fileType.getMimeType().equals(mimeType)) {
189 public String
getFileType(AbstractFile file)
throws TskCoreException {
190 return detect(file,
true);
205 public String
detect(AbstractFile file)
throws TskCoreException {
206 return detect(file,
false);
225 private String
detect(AbstractFile file,
boolean addToCaseDb)
throws TskCoreException {
230 String mimeType = file.getMIMEType();
231 if (null != mimeType) {
243 if (!file.isFile() || file.getSize() <= 0
244 || (file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS)
245 || (file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS)
246 || (file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.VIRTUAL_DIR)
247 || (file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.SLACK)) {
248 mimeType = MimeTypes.OCTET_STREAM;
255 if (null == mimeType) {
263 if (null == mimeType) {
271 if (null == mimeType) {
274 int len = file.read(buffer, 0, BUFFER_SIZE);
275 if (len < BUFFER_SIZE) {
277 System.arraycopy(buffer, 0, buf, 0, len);
281 String tikaType = tika.detect(buf, file.getName());
286 mimeType = tikaType.replace(
"tika-",
"");
292 }
catch (Exception ignored) {
300 mimeType = MimeTypes.OCTET_STREAM;
339 int indexOfSemicolon = mimeType.indexOf(
';');
340 if (indexOfSemicolon != -1) {
341 return mimeType.substring(0, indexOfSemicolon).trim();
358 for (FileType fileType : userDefinedFileTypes) {
359 if (fileType.matches(file)) {
360 if (fileType.createInterestingFileHit()) {
361 BlackboardArtifact artifact;
362 artifact = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT);
363 BlackboardAttribute setNameAttribute =
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME,
FileTypeIdModuleFactory.getModuleName(), fileType.getInterestingFilesSetName());
364 artifact.addAttribute(setNameAttribute);
371 BlackboardAttribute ruleNameAttribute =
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY,
FileTypeIdModuleFactory.getModuleName(), fileType.getMimeType());
372 artifact.addAttribute(ruleNameAttribute);
380 logger.log(Level.SEVERE, String.format(
"Unable to index blackboard artifact %d", artifact.getArtifactID()), ex);
382 NbBundle.getMessage(
Blackboard.class,
"Blackboard.unableToIndexArtifact.exception.msg"), artifact.getDisplayName());
386 return fileType.getMimeType();
403 for (FileType fileType : autopsyDefinedFileTypes) {
404 if (fileType.matches(file)) {
405 return fileType.getMimeType();
437 super(message, throwable);
452 List<String> customFileTypes =
new ArrayList<>();
453 userDefinedFileTypes.forEach((fileType) -> {
454 customFileTypes.add(fileType.getMimeType());
456 autopsyDefinedFileTypes.forEach((fileType) -> {
457 customFileTypes.add(fileType.getMimeType());
459 return customFileTypes;
static final int BUFFER_SIZE
String removeOptionalParameter(String mimeType)
static final long serialVersionUID
final List< FileType > userDefinedFileTypes
boolean isDetectable(String mimeType)
String detectUserDefinedType(AbstractFile file)
boolean isDetectableAsCustomType(List< FileType > customTypes, String mimeType)
final List< FileType > autopsyDefinedFileTypes
static SortedSet< String > tikaDetectedTypes
SleuthkitCase getSleuthkitCase()
Blackboard getBlackboard()
static void error(String title, String message)
String detect(AbstractFile file)
synchronized void indexArtifact(BlackboardArtifact artifact)
String detectAutopsyDefinedType(AbstractFile file)
static Case getCurrentCase()
synchronized static Logger getLogger(String name)
static final Logger logger
List< String > getUserDefinedTypes()
static SortedSet< String > getTikaDetectedTypes()
String getFileType(AbstractFile file)
String detect(AbstractFile file, boolean addToCaseDb)
static synchronized SortedSet< String > getDetectedTypes()
boolean isDetectableByTika(String mimeType)
String detectAndPostToBlackboard(AbstractFile file)