19 package org.sleuthkit.autopsy.modules.encryptiondetection;
21 import java.io.IOException;
22 import java.util.Collections;
23 import java.util.List;
24 import java.util.logging.Level;
52 private double calculatedEntropy;
53 private final double minimumEntropy;
61 EncryptionDetectionDataSourceIngestModule(EncryptionDetectionIngestJobSettings settings) {
62 minimumEntropy = settings.getMinimumEntropy();
79 if (dataSource instanceof Image) {
80 List<VolumeSystem> volumeSystems = ((Image) dataSource).getVolumeSystems();
81 for (VolumeSystem volumeSystem : volumeSystems) {
82 for (Volume volume : volumeSystem.getVolumes()) {
83 if (isVolumeEncrypted(volume)) {
84 return flagVolume(volume);
89 }
catch (ReadContentInputStream.ReadContentInputStreamException ex) {
90 logger.log(Level.WARNING, String.format(
"Unable to read data source '%s'", dataSource.getName()), ex);
92 }
catch (IOException | TskCoreException ex) {
93 logger.log(Level.SEVERE, String.format(
"Unable to process data source '%s'", dataSource.getName()), ex);
109 EncryptionDetectionTools.validateMinEntropyValue(minimumEntropy);
122 BlackboardArtifact artifact = volume.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_SUSPECTED);
130 logger.log(Level.SEVERE,
"Unable to index blackboard artifact " + artifact.getArtifactID(), ex);
141 StringBuilder detailsSb =
new StringBuilder(
"");
142 detailsSb.append(
"File: ").append(volume.getParent().getUniquePath()).append(volume.getName()).append(
"<br/>\n");
143 detailsSb.append(
"Entropy: ").append(calculatedEntropy);
146 "Encryption Detected Match: " + volume.getName(),
147 detailsSb.toString(),
152 }
catch (TskCoreException ex) {
153 logger.log(Level.SEVERE, String.format(
"Failed to create blackboard artifact for '%s'.", volume.getName()), ex);
166 private boolean isVolumeEncrypted(Volume volume)
throws ReadContentInputStream.ReadContentInputStreamException, IOException, TskCoreException {
171 if (volume.getFileSystems().isEmpty()) {
172 calculatedEntropy = EncryptionDetectionTools.calculateEntropy(volume);
173 if (calculatedEntropy >= minimumEntropy) {
static IngestMessage createDataMessage(String source, String subject, String detailsHtml, String uniqueKey, BlackboardArtifact data)
static Case getOpenCase()
Logger getLogger(String moduleDisplayName)
void postMessage(final IngestMessage message)
void fireModuleDataEvent(ModuleDataEvent moduleDataEvent)
Blackboard getBlackboard()
synchronized void indexArtifact(BlackboardArtifact artifact)
static synchronized IngestServices getInstance()