19 package org.sleuthkit.autopsy.centralrepository.ingestmodule;
23 import java.util.List;
24 import java.util.logging.Level;
25 import java.util.stream.Collectors;
26 import org.openide.util.NbBundle.Messages;
56 @Messages({
"IngestModule.prevTaggedSet.text=Previously Tagged As Notable (Central Repository)",
57 "IngestModule.prevCaseComment.text=Previous Case: "})
71 public ProcessResult process(AbstractFile af) {
79 return ProcessResult.OK;
85 return ProcessResult.OK;
92 LOGGER.log(Level.SEVERE,
"Error connecting to Central Repository database.", ex);
93 return ProcessResult.ERROR;
97 if (!filesType.isEnabled()) {
98 return ProcessResult.OK;
102 String md5 = af.getMd5Hash();
103 if ((md5 == null) || (HashUtility.isNoDataMd5(md5))) {
104 return ProcessResult.OK;
109 if (af.getKnown() != TskData.FileKnown.KNOWN) {
112 if (!caseDisplayNames.isEmpty()) {
113 postCorrelatedBadFileToBlackboard(af, caseDisplayNames);
116 LOGGER.log(Level.SEVERE,
"Error searching database for artifact.", ex);
117 return ProcessResult.ERROR;
127 af.getParentPath() + af.
getName(),
129 TskData.FileKnown.UNKNOWN
134 LOGGER.log(Level.SEVERE,
"Error adding artifact to bulk artifacts.", ex);
135 return ProcessResult.ERROR;
138 return ProcessResult.OK;
142 public void shutDown() {
144 if ((
EamDb.
isEnabled() ==
false) || (eamCase == null) || (eamDataSource == null)) {
151 LOGGER.log(Level.SEVERE,
"Error connecting to Central Repository database.", ex);
157 LOGGER.log(Level.SEVERE,
"Error doing bulk insert of artifacts.", ex);
161 LOGGER.log(Level.INFO,
"{0} artifacts in db for case: {1} ds:{2}",
new Object[]{count, eamCase.getDisplayName(), eamDataSource.getName()});
163 LOGGER.log(Level.SEVERE,
"Error counting artifacts.", ex);
172 "IngestModule.notfyBubble.title=Central Repository Not Initialized",
173 "IngestModule.errorMessage.isNotEnabled=Central repository settings are not initialized, cannot run Correlation Engine ingest module."
176 public void startUp(
IngestJobContext context)
throws IngestModuleException {
196 LOGGER.log(Level.SEVERE,
"Cannot run correlation engine on a multi-user case with a SQLite central repository.");
197 throw new IngestModuleException(
"Cannot run on a multi-user case with a SQLite central repository.");
205 LOGGER.log(Level.SEVERE,
"Error connecting to central repository database.", ex);
206 throw new IngestModuleException(
"Error connecting to central repository database.", ex);
212 LOGGER.log(Level.SEVERE,
"Error getting correlation type FILES in ingest module start up.", ex);
213 throw new IngestModuleException(
"Error getting correlation type FILES in ingest module start up.", ex);
217 eamCase = centralRepoDb.
getCase(autopsyCase);
219 throw new IngestModuleException(
"Unable to get case from central repository database ", ex);
221 if (eamCase == null) {
224 eamCase = centralRepoDb.
newCase(autopsyCase);
226 LOGGER.log(Level.SEVERE,
"Error creating new case in ingest module start up.", ex);
227 throw new IngestModuleException(
"Error creating new case in ingest module start up.", ex);
234 LOGGER.log(Level.SEVERE,
"Error getting data source info.", ex);
235 throw new IngestModuleException(
"Error getting data source info.", ex);
248 LOGGER.log(Level.SEVERE,
"Error adding data source to Central Repository.", ex);
249 throw new IngestModuleException(
"Error adding data source to Central Repository.", ex);
255 private void postCorrelatedBadFileToBlackboard(AbstractFile abstractFile, List<String> caseDisplayNames) {
259 BlackboardArtifact tifArtifact = abstractFile.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT);
260 BlackboardAttribute att =
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME, MODULE_NAME,
261 Bundle.IngestModule_prevTaggedSet_text());
262 BlackboardAttribute att2 =
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT, MODULE_NAME,
263 Bundle.IngestModule_prevCaseComment_text() + caseDisplayNames.stream().distinct().collect(Collectors.joining(
",",
"",
"")));
264 tifArtifact.addAttribute(att);
265 tifArtifact.addAttribute(att2);
271 LOGGER.log(Level.SEVERE,
"Unable to index blackboard artifact " + tifArtifact.getArtifactID(), ex);
275 sendBadFileInboxMessage(tifArtifact, abstractFile.getName(), abstractFile.getMd5Hash());
279 }
catch (TskCoreException ex) {
280 LOGGER.log(Level.SEVERE,
"Failed to create BlackboardArtifact.", ex);
281 }
catch (IllegalStateException ex) {
282 LOGGER.log(Level.SEVERE,
"Failed to create BlackboardAttribute.", ex);
294 @Messages({
"IngestModule.postToBB.fileName=File Name",
295 "IngestModule.postToBB.md5Hash=MD5 Hash",
296 "IngestModule.postToBB.hashSetSource=Source of Hash",
297 "IngestModule.postToBB.eamHit=Central Repository",
298 "# {0} - Name of file that is Notable",
299 "IngestModule.postToBB.knownBadMsg=Notable: {0}"})
300 public void sendBadFileInboxMessage(BlackboardArtifact artifact, String name, String md5Hash) {
301 StringBuilder detailsSb =
new StringBuilder();
303 detailsSb.append(
"<table border='0' cellpadding='4' width='280'>");
305 detailsSb.append(
"<tr>");
306 detailsSb.append(
"<th>")
307 .append(Bundle.IngestModule_postToBB_fileName())
309 detailsSb.append(
"<td>")
312 detailsSb.append(
"</tr>");
314 detailsSb.append(
"<tr>");
315 detailsSb.append(
"<th>")
316 .append(Bundle.IngestModule_postToBB_md5Hash())
318 detailsSb.append(
"<td>").append(md5Hash).append(
"</td>");
319 detailsSb.append(
"</tr>");
321 detailsSb.append(
"<tr>");
322 detailsSb.append(
"<th>")
323 .append(Bundle.IngestModule_postToBB_hashSetSource())
325 detailsSb.append(
"<td>").append(Bundle.IngestModule_postToBB_eamHit()).append(
"</td>");
326 detailsSb.append(
"</tr>");
328 detailsSb.append(
"</table>");
331 Bundle.IngestModule_postToBB_knownBadMsg(name),
332 detailsSb.toString(),
CorrelationDataSource getDataSource(CorrelationCase correlationCase, String dataSourceDeviceId)
CorrelationAttribute.Type getCorrelationTypeById(int typeId)
synchronized long decrementAndGet(long jobId)
static IngestMessage createDataMessage(String source, String subject, String detailsHtml, String uniqueKey, BlackboardArtifact data)
static boolean runningWithGUI
static final int FILES_TYPE_ID
void prepareBulkArtifact(CorrelationAttribute eamArtifact)
CorrelationCase newCase(CorrelationCase eamCase)
static CorrelationDataSource fromTSKDataSource(CorrelationCase correlationCase, Content dataSource)
static boolean isValidCentralRepoFile(AbstractFile af)
synchronized long incrementAndGet(long jobId)
void bulkInsertArtifacts()
List< String > getListCasesHavingArtifactInstancesKnownBad(CorrelationAttribute.Type aType, String value)
void addInstance(CorrelationAttributeInstance artifactInstance)
static EamDb getInstance()
void postMessage(final IngestMessage message)
void fireModuleDataEvent(ModuleDataEvent moduleDataEvent)
Long getCountArtifactInstancesByCaseDataSource(String caseUUID, String dataSourceID)
static boolean isEnabled()
Blackboard getBlackboard()
CorrelationCase getCase(Case autopsyCase)
synchronized void indexArtifact(BlackboardArtifact artifact)
static Case getCurrentCase()
synchronized static Logger getLogger(String name)
static synchronized void incrementCorrelationEngineModuleCount()
static synchronized void decrementCorrelationEngineModuleCount()
static void warn(String title, String message)
void newDataSource(CorrelationDataSource eamDataSource)
static synchronized IngestServices getInstance()