FilesSet.java

Go to the documentation of this file.

/*
 * Autopsy Forensic Browser
 *
 * Copyright 2011-2018 Basis Technology Corp.
 * Contact: carrier <at> sleuthkit <dot> org
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.sleuthkit.autopsy.modules.interestingitems;

import java.io.Serializable;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.UUID;
import java.util.regex.Pattern;
import org.openide.util.NbBundle;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.TskData;

public final class FilesSet implements Serializable {

    private static final long serialVersionUID = 1L;
    private final String name;
    private final String description;
    private final boolean ignoreKnownFiles;
    private final boolean ignoreUnallocatedSpace;
    private final Map<String, Rule> rules = new HashMap<>();

    public FilesSet(String name, String description, boolean ignoreKnownFiles, boolean ignoreUnallocatedSpace, Map<String, Rule> rules) {
        if ((name == null) || (name.isEmpty())) {
            throw new IllegalArgumentException("Interesting files set name cannot be null or empty");
        }
        this.name = name;
        this.description = (description != null ? description : "");
        this.ignoreKnownFiles = ignoreKnownFiles;
        this.ignoreUnallocatedSpace = ignoreUnallocatedSpace;
        if (rules != null) {
            this.rules.putAll(rules);
        }
    }

    public String getName() {
        return this.name;
    }

    public String getDescription() {
        return this.description;
    }

    boolean ignoresKnownFiles() {
        return this.ignoreKnownFiles;
    }

    public boolean ingoresUnallocatedSpace() {
        return this.ignoreUnallocatedSpace;
    }

    Map<String, Rule> getRules() {
        return new HashMap<>(this.rules);
    }

    public String fileIsMemberOf(AbstractFile file) {
        if ((this.ignoreKnownFiles) && (file.getKnown() == TskData.FileKnown.KNOWN)) {
            return null;
        }

        if ((this.ignoreUnallocatedSpace)
                && (file.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS)
                || file.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.SLACK)
                || file.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS))) {
            return null;
        }

        for (Rule rule : rules.values()) {
            if (rule.isSatisfied(file)) {
                return rule.getName();
            }
        }
        return null;
    }

    @Override
    public String toString() {
        // This override is designed to provide a display name for use with 
        // javax.swing.DefaultListModel<E>.
        return this.name;
    }

    static class Rule implements Serializable {

        private static final long serialVersionUID = 1L;
        private final String uuid;
        private final String ruleName;
        private final FileNameCondition fileNameCondition;
        private final MetaTypeCondition metaTypeCondition;
        private final ParentPathCondition pathCondition;
        private final MimeTypeCondition mimeTypeCondition;
        private final FileSizeCondition fileSizeCondition;
        private final DateCondition dateCondition;
        private final List<FileAttributeCondition> conditions = new ArrayList<>();

        Rule(String ruleName, FileNameCondition fileNameCondition, MetaTypeCondition metaTypeCondition, ParentPathCondition pathCondition, MimeTypeCondition mimeTypeCondition, FileSizeCondition fileSizeCondition, DateCondition dateCondition) {
            // since ruleName is optional, ruleUUID can be used to uniquely identify a rule.
            this.uuid = UUID.randomUUID().toString();
            if (metaTypeCondition == null) {
                throw new IllegalArgumentException("Interesting files set rule meta-type condition cannot be null");
            }

            this.ruleName = ruleName;

            /*
             * The rules are evaluated in the order added. MetaType check is
             * fastest, so do it first
             */
            this.metaTypeCondition = metaTypeCondition;
            this.conditions.add(this.metaTypeCondition);

            this.fileSizeCondition = fileSizeCondition;
            if (this.fileSizeCondition != null) {
                this.conditions.add(this.fileSizeCondition);
            }

            this.fileNameCondition = fileNameCondition;
            if (this.fileNameCondition != null) {
                this.conditions.add(fileNameCondition);
            }

            this.mimeTypeCondition = mimeTypeCondition;
            if (this.mimeTypeCondition != null) {
                this.conditions.add(mimeTypeCondition);
            }

            this.pathCondition = pathCondition;
            if (this.pathCondition != null) {
                this.conditions.add(this.pathCondition);
            }
            this.dateCondition = dateCondition;
            if (this.dateCondition != null) {
                this.conditions.add(this.dateCondition);
            }
        }

        String getName() {
            return ruleName;
        }

        FileNameCondition getFileNameCondition() {
            return this.fileNameCondition;
        }

        MetaTypeCondition getMetaTypeCondition() {
            return this.metaTypeCondition;
        }

        ParentPathCondition getPathCondition() {
            return this.pathCondition;
        }

        DateCondition getDateCondition() {
            return this.dateCondition;
        }

        boolean isSatisfied(AbstractFile file) {
            for (FileAttributeCondition condition : conditions) {
                if (!condition.passes(file)) {
                    return false;
                }
            }
            return true;
        }

        @NbBundle.Messages({
            "# {0} - daysIncluded",
            "FilesSet.rule.dateRule.toString=(modified within {0} day(s))"
        })
        @Override
        public String toString() {
            // This override is designed to provide a display name for use with 
            // javax.swing.DefaultListModel<E>.
            if (fileNameCondition != null) {
                return this.ruleName + " (" + fileNameCondition.getTextToMatch() + ")";
            } else if (this.pathCondition != null) {
                return this.ruleName + " (" + pathCondition.getTextToMatch() + ")";
            } else if (this.mimeTypeCondition != null) {
                return this.ruleName + " (" + mimeTypeCondition.getMimeType() + ")";
            } else if (this.fileSizeCondition != null) {
                return this.ruleName + " (" + fileSizeCondition.getComparator().getSymbol() + " " + fileSizeCondition.getSizeValue()
                        + " " + fileSizeCondition.getUnit().getName() + ")";
            } else if (this.dateCondition != null) {
                return this.ruleName + Bundle.FilesSet_rule_dateRule_toString(dateCondition.getDaysIncluded());
            } else {
                return this.ruleName + " ()";
            }

        }

        public String getUuid() {
            return this.uuid;
        }

        MimeTypeCondition getMimeTypeCondition() {
            return mimeTypeCondition;
        }

        FileSizeCondition getFileSizeCondition() {
            return fileSizeCondition;
        }

        static interface FileAttributeCondition extends Serializable {

            boolean passes(AbstractFile file);
        }

        static final class MimeTypeCondition implements FileAttributeCondition {

            private static final long serialVersionUID = 1L;
            private final String mimeType;

            MimeTypeCondition(String mimeType) {
                this.mimeType = mimeType;
            }

            @Override
            public boolean passes(AbstractFile file) {
                return this.mimeType.equals(file.getMIMEType());
            }

            String getMimeType() {
                return this.mimeType;
            }

        }

        static final class FileSizeCondition implements FileAttributeCondition {

            private static final long serialVersionUID = 1L;

            static enum COMPARATOR {

                LESS_THAN("<"),
                LESS_THAN_EQUAL("≤"),
                EQUAL("="),
                GREATER_THAN(">"),
                GREATER_THAN_EQUAL("≥");

                private String symbol;

                COMPARATOR(String symbol) {
                    this.symbol = symbol;
                }

                public static COMPARATOR fromSymbol(String symbol) {
                    if (symbol.equals("<=") || symbol.equals("≤")) {
                        return LESS_THAN_EQUAL;
                    } else if (symbol.equals("<")) {
                        return LESS_THAN;
                    } else if (symbol.equals("==") || symbol.equals("=")) {
                        return EQUAL;
                    } else if (symbol.equals(">")) {
                        return GREATER_THAN;
                    } else if (symbol.equals(">=") || symbol.equals("≥")) {
                        return GREATER_THAN_EQUAL;
                    } else {
                        throw new IllegalArgumentException("Invalid symbol");
                    }
                }

                public String getSymbol() {
                    return symbol;
                }
            }

            static enum SIZE_UNIT {

                BYTE(1, "Bytes"),
                KILOBYTE(1024, "Kilobytes"),
                MEGABYTE(1024 * 1024, "Megabytes"),
                GIGABYTE(1024 * 1024 * 1024, "Gigabytes");
                private long size;
                private String name;

                private SIZE_UNIT(long size, String name) {
                    this.size = size;
                    this.name = name;
                }

                public long getSize() {
                    return this.size;
                }

                public static SIZE_UNIT fromName(String name) {
                    for (SIZE_UNIT unit : SIZE_UNIT.values()) {
                        if (unit.getName().equals(name)) {
                            return unit;
                        }
                    }
                    throw new IllegalArgumentException("Invalid name for size unit.");
                }

                public String getName() {
                    return name;
                }
            }
            private final COMPARATOR comparator;
            private final SIZE_UNIT unit;
            private final int sizeValue;

            FileSizeCondition(COMPARATOR comparator, SIZE_UNIT unit, int sizeValue) {
                this.comparator = comparator;
                this.unit = unit;
                this.sizeValue = sizeValue;
            }

            COMPARATOR getComparator() {
                return comparator;
            }

            SIZE_UNIT getUnit() {
                return unit;
            }

            int getSizeValue() {
                return sizeValue;
            }

            @Override
            public boolean passes(AbstractFile file) {
                long fileSize = file.getSize();
                long conditionSize = this.getUnit().getSize() * this.getSizeValue();
                switch (this.getComparator()) {
                    case GREATER_THAN:
                        return fileSize > conditionSize;
                    case GREATER_THAN_EQUAL:
                        return fileSize >= conditionSize;
                    case LESS_THAN_EQUAL:
                        return fileSize <= conditionSize;
                    case LESS_THAN:
                        return fileSize < conditionSize;
                    default:
                        return fileSize == conditionSize;

                }
            }

        }

        static final class MetaTypeCondition implements FileAttributeCondition {

            private static final long serialVersionUID = 1L;

            enum Type {

                FILES,
                DIRECTORIES,
                FILES_AND_DIRECTORIES,
                ALL
            }

            private final Type type;

            MetaTypeCondition(Type type) {
                this.type = type;
            }

            @Override
            public boolean passes(AbstractFile file) {
                switch (this.type) {
                    case FILES:
                        return file.isFile();
                    case DIRECTORIES:
                        return file.getMetaType() == TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR
                                || file.getMetaType() == TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR;
                    case FILES_AND_DIRECTORIES:
                        return file.getMetaType() == TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_REG
                                || file.getMetaType() == TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR
                                || file.getMetaType() == TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR;
                    case ALL:
                        return true;  //Effectively ignores the metatype condition when All is selected.
                    default:
                        return true;
                }
            }

            Type getMetaType() {
                return this.type;
            }
        }

        static interface TextCondition extends FileAttributeCondition {

            String getTextToMatch();

            boolean isRegex();

            boolean textMatches(String textToMatch);

        }

        private static abstract class AbstractTextCondition implements TextCondition {

            private final TextMatcher textMatcher;

            AbstractTextCondition(String text, Boolean partialMatch) {
                if (partialMatch) {
                    this.textMatcher = new FilesSet.Rule.CaseInsensitivePartialStringComparisionMatcher(text);
                } else {
                    this.textMatcher = new FilesSet.Rule.CaseInsensitiveStringComparisionMatcher(text);
                }
            }

            AbstractTextCondition(Pattern regex) {
                this.textMatcher = new FilesSet.Rule.RegexMatcher(regex);
            }

            @Override
            public String getTextToMatch() {
                return this.textMatcher.getTextToMatch();
            }

            @Override
            public boolean isRegex() {
                return this.textMatcher.isRegex();
            }

            @Override
            public boolean textMatches(String textToMatch) {
                return this.textMatcher.textMatches(textToMatch);
            }

            @Override
            public abstract boolean passes(AbstractFile file);

        }

        static final class ParentPathCondition extends AbstractTextCondition {

            private static final long serialVersionUID = 1L;

            ParentPathCondition(String path) {
                super(path, true);
            }

            ParentPathCondition(Pattern path) {
                super(path);
            }

            @Override
            public boolean passes(AbstractFile file) {
                return this.textMatches(file.getParentPath() + "/");
            }

        }

        static interface FileNameCondition extends TextCondition {
        }

        static final class FullNameCondition extends AbstractTextCondition implements FileNameCondition {

            private static final long serialVersionUID = 1L;

            FullNameCondition(String name) {
                super(name, false);
            }

            FullNameCondition(Pattern name) {
                super(name);
            }

            @Override
            public boolean passes(AbstractFile file) {
                return this.textMatches(file.getName());
            }

        }

        static final class DateCondition implements FileAttributeCondition {

            private final static long SECS_PER_DAY = 60 * 60 * 24;

            private int daysIncluded;

            DateCondition(int days) {
                daysIncluded = days;
            }

            int getDaysIncluded() {
                return daysIncluded;
            }

            @Override
            public boolean passes(AbstractFile file) {
                long dateThreshold = System.currentTimeMillis() / 1000 - daysIncluded * SECS_PER_DAY;
                if (file.getCrtime() > dateThreshold || file.getMtime() > dateThreshold) {
                    return true;
                }
                return false;
            }

        }

        static final class ExtensionCondition extends AbstractTextCondition implements FileNameCondition {

            private static final long serialVersionUID = 1L;

            ExtensionCondition(String extension) {
                // If there is a leading ".", strip it since 
                // AbstractFile.getFileNameExtension() returns just the 
                // extension chars and not the dot.
                super(extension.startsWith(".") ? extension.substring(1) : extension, false);
            }

            ExtensionCondition(Pattern extension) {
                super(extension);
            }

            @Override
            public boolean passes(AbstractFile file) {
                return this.textMatches(file.getNameExtension());
            }

        }

        private static interface TextMatcher extends Serializable {

            String getTextToMatch();

            boolean isRegex();

            boolean textMatches(String subject);

        }

        private static class CaseInsensitiveStringComparisionMatcher implements TextMatcher {

            private static final long serialVersionUID = 1L;
            private final String textToMatch;

            CaseInsensitiveStringComparisionMatcher(String textToMatch) {
                this.textToMatch = textToMatch;
            }

            @Override
            public String getTextToMatch() {
                return this.textToMatch;
            }

            @Override
            public boolean isRegex() {
                return false;
            }

            @Override
            public boolean textMatches(String subject) {
                return subject.equalsIgnoreCase(textToMatch);
            }

        }

        private static class CaseInsensitivePartialStringComparisionMatcher implements TextMatcher {

            private static final long serialVersionUID = 1L;
            private final String textToMatch;
            private final Pattern pattern;

            CaseInsensitivePartialStringComparisionMatcher(String textToMatch) {
                this.textToMatch = textToMatch;
                this.pattern = Pattern.compile(Pattern.quote(textToMatch), Pattern.CASE_INSENSITIVE);
            }

            @Override
            public String getTextToMatch() {
                return this.textToMatch;
            }

            @Override
            public boolean isRegex() {
                return false;
            }

            @Override
            public boolean textMatches(String subject) {
                return pattern.matcher(subject).find();
            }
        }

        private static class RegexMatcher implements TextMatcher {

            private static final long serialVersionUID = 1L;
            private final Pattern regex;

            RegexMatcher(Pattern regex) {
                this.regex = regex;
            }

            @Override
            public String getTextToMatch() {
                return this.regex.pattern();
            }

            @Override
            public boolean isRegex() {
                return true;
            }

            @Override
            public boolean textMatches(String subject) {
                // A single match is sufficient.
                return this.regex.matcher(subject).find();
            }

        }

    }

}