19 package org.sleuthkit.autopsy.modules.iOS;
22 import java.io.FileOutputStream;
23 import java.io.IOException;
24 import java.io.InputStream;
25 import java.io.OutputStream;
26 import java.sql.Connection;
27 import java.sql.DriverManager;
28 import java.sql.ResultSet;
29 import java.sql.SQLException;
30 import java.sql.Statement;
31 import java.util.ArrayList;
32 import java.util.Collection;
33 import java.util.List;
34 import java.util.logging.Level;
35 import org.openide.util.NbBundle.Messages;
47 import org.
sleuthkit.datamodel.ReadContentInputStream.ReadContentInputStreamException;
54 final class ContactAnalyzer {
56 private Connection connection = null;
57 private ResultSet resultSet = null;
58 private Statement statement = null;
59 private String dbPath =
"";
60 private long fileId = 0;
61 private java.io.File jFile = null;
62 private final String moduleName = iOSModuleFactory.getModuleName();
63 private static final Logger logger = Logger.getLogger(ContactAnalyzer.class.getName());
64 private Blackboard blackboard;
71 public void findContacts(IngestJobContext context) {
74 openCase = Case.getOpenCase();
75 }
catch (NoCurrentCaseException ex) {
76 logger.log(Level.SEVERE,
"Exception while getting open case.", ex);
80 blackboard = openCase.getServices().getBlackboard();
81 List<AbstractFile> absFiles;
83 SleuthkitCase skCase = openCase.getSleuthkitCase();
84 absFiles = skCase.findAllFilesWhere(
"LOWER(name) LIKE LOWER('%call_history%') ");
85 if (absFiles.isEmpty()) {
88 for (AbstractFile file : absFiles) {
90 jFile =
new java.io.File(openCase.getTempDirectory(), file.getName().replaceAll(
"[<>%|\"/:*\\\\]",
""));
91 dbPath = jFile.toString();
92 fileId = file.getId();
93 ContentUtils.writeToFile(file, jFile, context::dataSourceIngestIsCancelled);
94 }
catch (ReadContentInputStreamException ex) {
95 logger.log(Level.WARNING, String.format(
"Error reading content from file '%s' (id=%d).", file.getName(), fileId), ex);
96 }
catch (Exception ex) {
97 logger.log(Level.SEVERE, String.format(
"Error writing content from file '%s' (id=%d) to '%s'.", file.getName(), fileId, dbPath), ex);
100 }
catch (TskCoreException e) {
101 logger.log(Level.SEVERE,
"Error finding Contacts", e);
112 @Messages({
"ContactAnalyzer.indexError.message=Failed to index contact artifact for keyword search."})
113 private void findContactsInDB(String DatabasePath,
long fileId) {
114 if (DatabasePath == null || DatabasePath.isEmpty()) {
119 currentCase = Case.getOpenCase();
120 }
catch (NoCurrentCaseException ex) {
121 logger.log(Level.SEVERE,
"Exception while getting open case.", ex);
125 Class.forName(
"org.sqlite.JDBC");
126 connection = DriverManager.getConnection(
"jdbc:sqlite:" + DatabasePath);
127 statement = connection.createStatement();
128 }
catch (ClassNotFoundException | SQLException e) {
129 logger.log(Level.SEVERE,
"Error opening database", e);
132 SleuthkitCase skCase = currentCase.getSleuthkitCase();
134 AbstractFile file = skCase.getAbstractFileById(fileId);
136 logger.log(Level.SEVERE,
"Error getting abstract file {0}", fileId);
143 resultSet = statement.executeQuery(
144 "SELECT mimetype,data1, name_raw_contact.display_name AS display_name \n"
145 +
"FROM raw_contacts JOIN contacts ON (raw_contacts.contact_id=contacts._id) \n"
146 +
"JOIN raw_contacts AS name_raw_contact ON(name_raw_contact_id=name_raw_contact._id) "
147 +
"LEFT OUTER JOIN data ON (data.raw_contact_id=raw_contacts._id) \n"
148 +
"LEFT OUTER JOIN mimetypes ON (data.mimetype_id=mimetypes._id) \n"
149 +
"WHERE mimetype = 'vnd.android.cursor.item/phone_v2' OR mimetype = 'vnd.android.cursor.item/email_v2'\n"
150 +
"ORDER BY name_raw_contact.display_name ASC;");
152 BlackboardArtifact bba;
153 bba = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT);
154 Collection<BlackboardAttribute> attributes =
new ArrayList<>();
159 while (resultSet.next()) {
160 name = resultSet.getString(
"display_name");
161 data1 = resultSet.getString(
"data1");
162 mimetype = resultSet.getString(
"mimetype");
163 if (name.equals(oldName) ==
false) {
164 attributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME, moduleName, name));
166 if (mimetype.equals(
"vnd.android.cursor.item/phone_v2")) {
167 attributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER, moduleName, data1));
169 attributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL, moduleName, data1));
173 bba.addAttributes(attributes);
176 blackboard.indexArtifact(bba);
177 }
catch (Blackboard.BlackboardException ex) {
178 logger.log(Level.SEVERE,
"Unable to index blackboard artifact " + bba.getArtifactID(), ex);
179 MessageNotifyUtil.Notify.error(
180 Bundle.ContactAnalyzer_indexError_message(), bba.getDisplayName());
184 }
catch (Exception e) {
185 logger.log(Level.SEVERE,
"Error parsing Contacts to Blackboard", e);
191 }
catch (Exception e) {
192 logger.log(Level.SEVERE,
"Error closing database", e);
195 }
catch (Exception e) {
196 logger.log(Level.SEVERE,
"Error parsing Contacts to Blackboard", e);
201 public static void copyFileUsingStream(AbstractFile file, File jFile)
throws IOException {
202 InputStream is =
new ReadContentInputStream(file);
203 OutputStream os =
new FileOutputStream(jFile);
204 byte[] buffer =
new byte[8192];
207 while ((length = is.read(buffer)) != -1) {
208 os.write(buffer, 0, length);
209 System.out.println(length);
220 public static void copyFileUsingStreams(AbstractFile file, File jFile) {
222 OutputStream ostream = null;
225 istream =
new ReadContentInputStream(file);
227 ostream =
new FileOutputStream(jFile);
228 while ((c = istream.read()) != EOF) {
231 }
catch (IOException e) {
232 System.out.println(
"Error: " + e.getMessage());
237 }
catch (IOException e) {
238 System.out.println(
"File did not close");