19 package org.sleuthkit.autopsy.modules.iOS;
21 import java.sql.Connection;
22 import java.sql.DriverManager;
23 import java.sql.ResultSet;
24 import java.sql.SQLException;
25 import java.sql.Statement;
26 import java.util.ArrayList;
27 import java.util.Collection;
28 import java.util.List;
29 import java.util.logging.Level;
30 import org.openide.util.NbBundle.Messages;
43 class CallLogAnalyzer {
45 private Connection connection = null;
46 private ResultSet resultSet = null;
47 private Statement statement = null;
48 private String dbPath =
"";
49 private long fileId = 0;
50 private java.io.File jFile = null;
57 List<AbstractFile> absFiles;
60 absFiles = skCase.findAllFilesWhere(
"name ='contacts2.db' OR name ='contacts.db'");
61 if (absFiles.isEmpty()) {
64 for (AbstractFile AF : absFiles) {
68 dbPath = jFile.toString();
70 findCallLogsInDB(dbPath, fileId);
71 }
catch (Exception e) {
72 logger.log(Level.SEVERE,
"Error parsing Call logs", e);
75 }
catch (TskCoreException e) {
76 logger.log(Level.SEVERE,
"Error finding Call logs", e);
80 @Messages({
"CallLogAnalyzer.indexError.message=Failed to index call log artifact for keyword search."})
81 private void findCallLogsInDB(String DatabasePath,
long fId) {
82 if (DatabasePath == null || DatabasePath.isEmpty()) {
86 Class.forName(
"org.sqlite.JDBC");
87 connection = DriverManager.getConnection(
"jdbc:sqlite:" + DatabasePath);
88 statement = connection.createStatement();
89 }
catch (ClassNotFoundException | SQLException e) {
90 logger.log(Level.SEVERE,
"Error opening database", e);
96 AbstractFile f = skCase.getAbstractFileById(fId);
98 logger.log(Level.SEVERE,
"Error getting abstract file " + fId);
103 resultSet = statement.executeQuery(
104 "SELECT number,date,duration,type, name FROM calls ORDER BY date DESC;");
106 BlackboardArtifact bba;
113 while (resultSet.next()) {
114 name = resultSet.getString(
"name");
115 number = resultSet.getString(
"number");
116 duration = resultSet.getString(
"duration");
117 date = resultSet.getString(
"date");
118 type = resultSet.getString(
"type");
120 bba = f.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_CALLLOG);
121 Collection<BlackboardAttribute> attributes =
new ArrayList<>();
122 if (type.equalsIgnoreCase(
"outgoing")) {
123 attributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO, moduleName, number));
125 attributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM, moduleName, number));
127 attributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_START, moduleName, date));
128 attributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_END, moduleName, duration + date));
129 attributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DIRECTION, moduleName, type));
130 attributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME, moduleName, name));
132 bba.addAttributes(attributes);
137 logger.log(Level.SEVERE,
"Unable to index blackboard artifact " + bba.getArtifactID(), ex);
139 Bundle.CallLogAnalyzer_indexError_message(), bba.getDisplayName());
142 }
catch (Exception e) {
143 logger.log(Level.SEVERE,
"Error parsing Call logs to the Blackboard", e);
149 }
catch (Exception e) {
150 logger.log(Level.SEVERE,
"Error closing the database", e);
153 }
catch (Exception e) {
154 logger.log(Level.SEVERE,
"Error parsing Call logs to the Blackboard", e);
String getTempDirectory()
static< T > long writeToFile(Content content, java.io.File outputFile, ProgressHandle progress, Future< T > worker, boolean source)
SleuthkitCase getSleuthkitCase()
Blackboard getBlackboard()
static void error(String title, String message)
synchronized void indexArtifact(BlackboardArtifact artifact)
static Case getCurrentCase()
synchronized static Logger getLogger(String name)