Autopsy  4.6.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
RecentDocumentsByLnk.java
Go to the documentation of this file.
1  /*
2  *
3  * Autopsy Forensic Browser
4  *
5  * Copyright 2012-2014 Basis Technology Corp.
6  *
7  * Copyright 2012 42six Solutions.
8  * Contact: aebadirad <at> 42six <dot> com
9  * Project Contact/Architect: carrier <at> sleuthkit <dot> org
10  *
11  * Licensed under the Apache License, Version 2.0 (the "License");
12  * you may not use this file except in compliance with the License.
13  * You may obtain a copy of the License at
14  *
15  * http://www.apache.org/licenses/LICENSE-2.0
16  *
17  * Unless required by applicable law or agreed to in writing, software
18  * distributed under the License is distributed on an "AS IS" BASIS,
19  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
20  * See the License for the specific language governing permissions and
21  * limitations under the License.
22  */
23 package org.sleuthkit.autopsy.recentactivity;
24 
25 import java.util.ArrayList;
26 import java.util.List;
27 import java.util.logging.Level;
28 
29 import org.openide.util.NbBundle;
31 import java.util.Collection;
39 import org.sleuthkit.datamodel.BlackboardArtifact;
40 import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
41 import org.sleuthkit.datamodel.BlackboardAttribute;
42 import org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
43 import org.sleuthkit.datamodel.Content;
44 import org.sleuthkit.datamodel.*;
45 
50 class RecentDocumentsByLnk extends Extract {
51 
52  private static final Logger logger = Logger.getLogger(RecentDocumentsByLnk.class.getName());
53  private IngestServices services = IngestServices.getInstance();
54  private Content dataSource;
55  private IngestJobContext context;
56 
64  private void getRecentDocuments() {
65 
66  org.sleuthkit.autopsy.casemodule.services.FileManager fileManager = currentCase.getServices().getFileManager();
67  List<AbstractFile> recentFiles;
68  try {
69  recentFiles = fileManager.findFiles(dataSource, "%.lnk", "Recent"); //NON-NLS
70  } catch (TskCoreException ex) {
71  logger.log(Level.WARNING, "Error searching for .lnk files."); //NON-NLS
72  this.addErrorMessage(
73  NbBundle.getMessage(this.getClass(), "RecentDocumentsByLnk.getRecDoc.errMsg.errGetLnkFiles",
74  this.getName()));
75  return;
76  }
77 
78  if (recentFiles.isEmpty()) {
79  logger.log(Level.INFO, "Didn't find any recent files."); //NON-NLS
80  return;
81  }
82 
83  dataFound = true;
84  for (AbstractFile recentFile : recentFiles) {
85  if (context.dataSourceIngestIsCancelled()) {
86  break;
87  }
88 
89  if (recentFile.getSize() == 0) {
90  continue;
91  }
92  JLNK lnk;
93  JLnkParser lnkParser = new JLnkParser(new ReadContentInputStream(recentFile), (int) recentFile.getSize());
94  try {
95  lnk = lnkParser.parse();
96  } catch (JLnkParserException e) {
97  //TODO should throw a specific checked exception
98  boolean unalloc = recentFile.isMetaFlagSet(TskData.TSK_FS_META_FLAG_ENUM.UNALLOC)
99  || recentFile.isDirNameFlagSet(TskData.TSK_FS_NAME_FLAG_ENUM.UNALLOC);
100  if (unalloc == false) {
101  logger.log(Level.WARNING, "Error lnk parsing the file to get recent files {0}", recentFile); //NON-NLS
102  }
103  continue;
104  }
105 
106  Collection<BlackboardAttribute> bbattributes = new ArrayList<>();
107  String path = lnk.getBestPath();
108  bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PATH,
109  NbBundle.getMessage(this.getClass(),
110  "RecentDocumentsByLnk.parentModuleName.noSpace"),
111  path));
112  bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PATH_ID,
113  NbBundle.getMessage(this.getClass(),
114  "RecentDocumentsByLnk.parentModuleName.noSpace"),
115  Util.findID(dataSource, path)));
116  bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME,
117  NbBundle.getMessage(this.getClass(),
118  "RecentDocumentsByLnk.parentModuleName.noSpace"),
119  recentFile.getCrtime()));
120  this.addArtifact(ARTIFACT_TYPE.TSK_RECENT_OBJECT, recentFile, bbattributes);
121  }
122  services.fireModuleDataEvent(new ModuleDataEvent(
123  NbBundle.getMessage(this.getClass(), "RecentDocumentsByLnk.parentModuleName"),
124  BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT));
125  }
126 
127  @Override
128  public void process(Content dataSource, IngestJobContext context) {
129  this.dataSource = dataSource;
130  this.context = context;
131  dataFound = false;
132  this.getRecentDocuments();
133  }
134 }
synchronized List< AbstractFile > findFiles(String fileName)

Copyright © 2012-2016 Basis Technology. Generated on: Mon May 7 2018
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.