19 package org.sleuthkit.autopsy.modules.photoreccarver;
22 import java.io.IOException;
23 import java.lang.ProcessBuilder.Redirect;
24 import java.nio.file.DirectoryStream;
25 import java.nio.file.FileAlreadyExistsException;
26 import java.nio.file.Files;
27 import java.nio.file.Path;
28 import java.nio.file.Paths;
29 import java.text.DateFormat;
30 import java.text.SimpleDateFormat;
31 import java.util.ArrayList;
32 import java.util.Date;
33 import java.util.HashMap;
34 import java.util.List;
36 import java.util.concurrent.ConcurrentHashMap;
37 import java.util.concurrent.atomic.AtomicLong;
38 import java.util.logging.Level;
39 import org.openide.modules.InstalledFileLocator;
40 import org.openide.util.Exceptions;
41 import org.openide.util.NbBundle;
69 "PhotoRecIngestModule.PermissionsNotSufficient=Insufficient permissions accessing",
70 "PhotoRecIngestModule.PermissionsNotSufficientSeeReference=See 'Shared Drive Authentication' in Autopsy help.",
71 "# {0} - output directory name",
"cannotCreateOutputDir.message=Unable to create output directory: {0}.",
72 "unallocatedSpaceProcessingSettingsError.message=The selected file ingest filter ignores unallocated space. This module carves unallocated space. Please choose a filter which does not ignore unallocated space or disable this module.",
73 "unsupportedOS.message=PhotoRec module is supported on Windows platforms only.",
74 "missingExecutable.message=Unable to locate PhotoRec executable.",
75 "cannotRunExecutable.message=Unable to execute PhotoRec.",
76 "PhotoRecIngestModule.nonHostnameUNCPathUsed=PhotoRec cannot operate with a UNC path containing IP addresses."
80 private static final String PHOTOREC_DIRECTORY =
"photorec_exec";
81 private static final String PHOTOREC_EXECUTABLE =
"photorec_win.exe";
82 private static final String PHOTOREC_LINUX_EXECUTABLE =
"photorec";
83 private static final String PHOTOREC_RESULTS_BASE =
"results";
84 private static final String PHOTOREC_RESULTS_EXTENDED =
"results.1";
85 private static final String PHOTOREC_REPORT =
"report.xml";
86 private static final String LOG_FILE =
"run_log.txt";
87 private static final String TEMP_DIR_NAME =
"temp";
88 private static final String SEP = System.getProperty(
"line.separator");
89 private static final Logger logger =
Logger.
getLogger(PhotoRecCarverFileIngestModule.class.getName());
90 private static final HashMap<Long, IngestJobTotals> totalsForIngestJobs =
new HashMap<>();
92 private static final Map<Long, WorkingPaths> pathsByJob =
new ConcurrentHashMap<>();
94 private Path rootOutputDirPath;
95 private File executableFile;
102 private AtomicLong totalItemsRecovered =
new AtomicLong(0);
103 private AtomicLong totalItemsWithErrors =
new AtomicLong(0);
104 private AtomicLong totalWritetime =
new AtomicLong(0);
105 private AtomicLong totalParsetime =
new AtomicLong(0);
108 private static synchronized IngestJobTotals getTotalsForIngestJobs(
long ingestJobId) {
110 if (totals == null) {
111 totals =
new PhotoRecCarverFileIngestModule.IngestJobTotals();
112 totalsForIngestJobs.put(ingestJobId, totals);
117 private static synchronized void initTotalsForIngestJob(
long ingestJobId) {
118 IngestJobTotals totals =
new PhotoRecCarverFileIngestModule.IngestJobTotals();
119 totalsForIngestJobs.put(ingestJobId, totals);
126 public void startUp(IngestJobContext context)
throws IngestModule.IngestModuleException {
127 this.context = context;
129 this.jobId = this.context.getJobId();
135 if (!this.context.processingUnallocatedSpace()) {
136 throw new IngestModule.IngestModuleException(Bundle.unallocatedSpaceProcessingSettingsError_message());
139 this.rootOutputDirPath = createModuleOutputDirectoryForCase();
142 executableFile = locateExecutable();
144 if (PhotoRecCarverFileIngestModule.refCounter.incrementAndGet(
this.jobId) == 1) {
147 DateFormat dateFormat =
new SimpleDateFormat(
"MM-dd-yyyy-HH-mm-ss-SSSS");
148 Date date =
new Date();
149 String folder = this.context.getDataSource().getId() +
"_" + dateFormat.format(date);
150 Path outputDirPath = Paths.get(this.rootOutputDirPath.toAbsolutePath().toString(), folder);
151 Files.createDirectories(outputDirPath);
154 Path tempDirPath = Paths.get(outputDirPath.toString(), PhotoRecCarverFileIngestModule.TEMP_DIR_NAME);
155 Files.createDirectory(tempDirPath);
158 PhotoRecCarverFileIngestModule.pathsByJob.put(this.jobId,
new WorkingPaths(outputDirPath, tempDirPath));
161 initTotalsForIngestJob(jobId);
162 }
catch (SecurityException | IOException | UnsupportedOperationException ex) {
163 throw new IngestModule.IngestModuleException(Bundle.cannotCreateOutputDir_message(ex.getLocalizedMessage()), ex);
172 public IngestModule.ProcessResult process(AbstractFile file) {
174 if (file.getType() != TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS) {
175 return IngestModule.ProcessResult.OK;
179 IngestJobTotals totals = getTotalsForIngestJobs(jobId);
181 Path tempFilePath = null;
184 if (null == this.executableFile) {
185 logger.log(Level.SEVERE,
"PhotoRec carver called after failed start up");
186 return IngestModule.ProcessResult.ERROR;
192 long freeDiskSpace = IngestServices.getInstance().getFreeDiskSpace();
193 if ((freeDiskSpace != IngestMonitor.DISK_FREE_SPACE_UNKNOWN) && ((file.getSize() * 1.2) > freeDiskSpace)) {
194 logger.log(Level.SEVERE,
"PhotoRec error processing {0} with {1} Not enough space on primary disk to save unallocated space.",
195 new Object[]{file.getName(), PhotoRecCarverIngestModuleFactory.getModuleName()});
196 MessageNotifyUtil.Notify.error(NbBundle.getMessage(
this.getClass(),
"PhotoRecIngestModule.UnableToCarve", file.getName()),
197 NbBundle.getMessage(
this.getClass(),
"PhotoRecIngestModule.NotEnoughDiskSpace"));
198 return IngestModule.ProcessResult.ERROR;
200 if (this.context.fileIngestIsCancelled() ==
true) {
202 logger.log(Level.INFO,
"PhotoRec cancelled by user");
203 MessageNotifyUtil.Notify.info(PhotoRecCarverIngestModuleFactory.getModuleName(), NbBundle.getMessage(PhotoRecCarverFileIngestModule.class,
"PhotoRecIngestModule.cancelledByUser"));
204 return IngestModule.ProcessResult.OK;
208 long writestart = System.currentTimeMillis();
209 WorkingPaths paths = PhotoRecCarverFileIngestModule.pathsByJob.get(this.jobId);
210 tempFilePath = Paths.get(paths.getTempDirPath().toString(), file.getName());
211 ContentUtils.writeToFile(file, tempFilePath.toFile(), context::fileIngestIsCancelled);
213 if (this.context.fileIngestIsCancelled() ==
true) {
215 logger.log(Level.INFO,
"PhotoRec cancelled by user");
216 MessageNotifyUtil.Notify.info(PhotoRecCarverIngestModuleFactory.getModuleName(), NbBundle.getMessage(PhotoRecCarverFileIngestModule.class,
"PhotoRecIngestModule.cancelledByUser"));
217 return IngestModule.ProcessResult.OK;
221 Path outputDirPath = Paths.get(paths.getOutputDirPath().toString(), file.getName());
222 Files.createDirectory(outputDirPath);
223 File log =
new File(Paths.get(outputDirPath.toString(), LOG_FILE).toString());
226 ProcessBuilder processAndSettings =
new ProcessBuilder(
227 executableFile.toString(),
229 outputDirPath.toAbsolutePath().toString() + File.separator + PHOTOREC_RESULTS_BASE,
231 tempFilePath.toFile().toString(),
235 processAndSettings.environment().put(
"__COMPAT_LAYER",
"RunAsInvoker");
236 processAndSettings.redirectErrorStream(
true);
237 processAndSettings.redirectOutput(Redirect.appendTo(log));
239 FileIngestModuleProcessTerminator terminator =
new FileIngestModuleProcessTerminator(this.context,
true);
240 int exitValue = ExecUtil.execute(processAndSettings, terminator);
242 if (this.context.fileIngestIsCancelled() ==
true) {
244 cleanup(outputDirPath, tempFilePath);
245 logger.log(Level.INFO,
"PhotoRec cancelled by user");
246 MessageNotifyUtil.Notify.info(PhotoRecCarverIngestModuleFactory.getModuleName(), NbBundle.getMessage(PhotoRecCarverFileIngestModule.class,
"PhotoRecIngestModule.cancelledByUser"));
247 return IngestModule.ProcessResult.OK;
248 }
else if (terminator.getTerminationCode() == ProcTerminationCode.TIME_OUT) {
249 cleanup(outputDirPath, tempFilePath);
250 String msg = NbBundle.getMessage(this.getClass(),
"PhotoRecIngestModule.processTerminated") + file.getName();
251 MessageNotifyUtil.Notify.error(NbBundle.getMessage(
this.getClass(),
"PhotoRecIngestModule.moduleError"), msg);
252 logger.log(Level.SEVERE, msg);
253 return IngestModule.ProcessResult.ERROR;
254 }
else if (0 != exitValue) {
256 cleanup(outputDirPath, tempFilePath);
257 totals.totalItemsWithErrors.incrementAndGet();
258 logger.log(Level.SEVERE,
"PhotoRec carver returned error exit value = {0} when scanning {1}",
259 new Object[]{exitValue, file.getName()});
260 MessageNotifyUtil.Notify.error(PhotoRecCarverIngestModuleFactory.getModuleName(), NbBundle.getMessage(PhotoRecCarverFileIngestModule.class,
"PhotoRecIngestModule.error.exitValue",
261 new Object[]{exitValue, file.getName()}));
262 return IngestModule.ProcessResult.ERROR;
266 java.io.File oldAuditFile =
new java.io.File(Paths.get(outputDirPath.toString(), PHOTOREC_RESULTS_EXTENDED, PHOTOREC_REPORT).toString());
267 java.io.File newAuditFile =
new java.io.File(Paths.get(outputDirPath.toString(), PHOTOREC_REPORT).toString());
268 oldAuditFile.renameTo(newAuditFile);
270 if (this.context.fileIngestIsCancelled() ==
true) {
272 logger.log(Level.INFO,
"PhotoRec cancelled by user");
273 MessageNotifyUtil.Notify.info(PhotoRecCarverIngestModuleFactory.getModuleName(), NbBundle.getMessage(PhotoRecCarverFileIngestModule.class,
"PhotoRecIngestModule.cancelledByUser"));
274 return IngestModule.ProcessResult.OK;
276 Path pathToRemove = Paths.get(outputDirPath.toAbsolutePath().toString());
277 try (DirectoryStream<Path> stream = Files.newDirectoryStream(pathToRemove)) {
278 for (Path entry : stream) {
279 if (Files.isDirectory(entry)) {
280 FileUtil.deleteDir(
new File(entry.toString()));
284 long writedelta = (System.currentTimeMillis() - writestart);
285 totals.totalWritetime.addAndGet(writedelta);
288 long calcstart = System.currentTimeMillis();
289 PhotoRecCarverOutputParser parser =
new PhotoRecCarverOutputParser(outputDirPath);
290 if (this.context.fileIngestIsCancelled() ==
true) {
292 logger.log(Level.INFO,
"PhotoRec cancelled by user");
293 MessageNotifyUtil.Notify.info(PhotoRecCarverIngestModuleFactory.getModuleName(), NbBundle.getMessage(PhotoRecCarverFileIngestModule.class,
"PhotoRecIngestModule.cancelledByUser"));
294 return IngestModule.ProcessResult.OK;
296 List<LayoutFile> carvedItems = parser.parse(newAuditFile, file, context);
297 long calcdelta = (System.currentTimeMillis() - calcstart);
298 totals.totalParsetime.addAndGet(calcdelta);
299 if (carvedItems != null && !carvedItems.isEmpty()) {
300 totals.totalItemsRecovered.addAndGet(carvedItems.size());
301 context.addFilesToJob(
new ArrayList<>(carvedItems));
304 }
catch (IOException ex) {
305 totals.totalItemsWithErrors.incrementAndGet();
306 logger.log(Level.SEVERE,
"Error processing " + file.getName() +
" with PhotoRec carver", ex);
307 MessageNotifyUtil.Notify.error(PhotoRecCarverIngestModuleFactory.getModuleName(), NbBundle.getMessage(PhotoRecCarverFileIngestModule.class,
"PhotoRecIngestModule.error.msg", file.getName()));
308 return IngestModule.ProcessResult.ERROR;
310 if (null != tempFilePath && Files.exists(tempFilePath)) {
312 tempFilePath.toFile().delete();
315 return IngestModule.ProcessResult.OK;
319 private void cleanup(Path outputDirPath, Path tempFilePath) {
321 FileUtil.deleteDir(
new File(outputDirPath.toString()));
322 if (null != tempFilePath && Files.exists(tempFilePath)) {
323 tempFilePath.toFile().delete();
327 private static synchronized void postSummary(
long jobId) {
328 IngestJobTotals jobTotals = totalsForIngestJobs.remove(jobId);
330 StringBuilder detailsSb =
new StringBuilder();
332 detailsSb.append(
"<table border='0' cellpadding='4' width='280'>");
334 detailsSb.append(
"<tr><td>")
335 .append(NbBundle.getMessage(PhotoRecCarverFileIngestModule.class,
"PhotoRecIngestModule.complete.numberOfCarved"))
337 detailsSb.append(
"<td>").append(jobTotals.totalItemsRecovered.get()).append(
"</td></tr>");
339 detailsSb.append(
"<tr><td>")
340 .append(NbBundle.getMessage(PhotoRecCarverFileIngestModule.class,
"PhotoRecIngestModule.complete.numberOfErrors"))
342 detailsSb.append(
"<td>").append(jobTotals.totalItemsWithErrors.get()).append(
"</td></tr>");
344 detailsSb.append(
"<tr><td>")
345 .append(NbBundle.getMessage(PhotoRecCarverFileIngestModule.class,
"PhotoRecIngestModule.complete.totalWritetime"))
346 .append(
"</td><td>").append(jobTotals.totalWritetime.get()).append(
"</td></tr>\n");
347 detailsSb.append(
"<tr><td>")
348 .append(NbBundle.getMessage(PhotoRecCarverFileIngestModule.class,
"PhotoRecIngestModule.complete.totalParsetime"))
349 .append(
"</td><td>").append(jobTotals.totalParsetime.get()).append(
"</td></tr>\n");
350 detailsSb.append(
"</table>");
352 IngestServices.getInstance().postMessage(IngestMessage.createMessage(
353 IngestMessage.MessageType.INFO,
354 PhotoRecCarverIngestModuleFactory.getModuleName(),
355 NbBundle.getMessage(PhotoRecCarverFileIngestModule.class,
356 "PhotoRecIngestModule.complete.photoRecResults"),
357 detailsSb.toString()));
365 public void shutDown() {
366 if (this.context != null && refCounter.decrementAndGet(
this.jobId) == 0) {
370 WorkingPaths paths = PhotoRecCarverFileIngestModule.pathsByJob.remove(this.jobId);
371 FileUtil.deleteDir(
new File(paths.getTempDirPath().toString()));
373 }
catch (SecurityException ex) {
374 logger.log(Level.SEVERE,
"Error shutting down PhotoRec carver module", ex);
385 this.outputDirPath = outputDirPath;
386 this.tempDirPath = tempDirPath;
389 Path getOutputDirPath() {
390 return this.outputDirPath;
393 Path getTempDirPath() {
394 return this.tempDirPath;
406 synchronized Path createModuleOutputDirectoryForCase() throws IngestModule.IngestModuleException {
407 Path path = Paths.get(Case.getCurrentCase().getModuleDirectory(), PhotoRecCarverIngestModuleFactory.getModuleName());
409 Files.createDirectory(path);
410 if (UNCPathUtilities.isUNC(path)) {
414 throw new IngestModule.IngestModuleException(Bundle.PhotoRecIngestModule_nonHostnameUNCPathUsed());
416 if (
false == FileUtil.hasReadWriteAccess(path)) {
417 throw new IngestModule.IngestModuleException(
418 Bundle.PhotoRecIngestModule_PermissionsNotSufficient() + SEP + path.toString() + SEP
419 + Bundle.PhotoRecIngestModule_PermissionsNotSufficientSeeReference()
423 }
catch (FileAlreadyExistsException ex) {
425 }
catch (IOException | SecurityException | UnsupportedOperationException ex) {
426 throw new IngestModule.IngestModuleException(Bundle.cannotCreateOutputDir_message(ex.getLocalizedMessage()), ex);
440 public static File locateExecutable() throws IngestModule.IngestModuleException {
442 Path execName = null;
443 String photorec_linux_directory =
"/usr/bin";
444 if (PlatformUtil.isWindowsOS()) {
445 execName = Paths.get(PHOTOREC_DIRECTORY, PHOTOREC_EXECUTABLE);
446 exeFile = InstalledFileLocator.getDefault().locate(execName.toString(), PhotoRecCarverFileIngestModule.class.getPackage().getName(),
false);
448 File usrBin =
new File(
"/usr/bin/photorec");
449 File usrLocalBin =
new File(
"/usr/local/bin/photorec");
450 if (usrBin.canExecute() && usrBin.exists() && !usrBin.isDirectory()) {
451 photorec_linux_directory =
"/usr/bin";
452 }
else if(usrLocalBin.canExecute() && usrLocalBin.exists() && !usrLocalBin.isDirectory()){
453 photorec_linux_directory =
"/usr/local/bin";
455 throw new IngestModule.IngestModuleException(
"Photorec not found");
457 execName = Paths.get(photorec_linux_directory, PHOTOREC_LINUX_EXECUTABLE);
458 exeFile =
new File(execName.toString());
461 if (null == exeFile) {
462 throw new IngestModule.IngestModuleException(Bundle.missingExecutable_message());
466 if (!exeFile.canExecute()) {
467 throw new IngestModule.IngestModuleException(Bundle.cannotRunExecutable_message());
void fireModuleContentEvent(ModuleContentEvent moduleContentEvent)
synchronized static Logger getLogger(String name)
synchronized Path ipToHostName(Path inputPath)
static synchronized IngestServices getInstance()