Autopsy  4.6.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
SampleDataSourceIngestModule.java
Go to the documentation of this file.
1 /*
2  * Sample module in the public domain. Feel free to use this as a template
3  * for your modules.
4  *
5  * Contact: Brian Carrier [carrier <at> sleuthkit [dot] org]
6  *
7  * This is free and unencumbered software released into the public domain.
8  *
9  * Anyone is free to copy, modify, publish, use, compile, sell, or
10  * distribute this software, either in source code form or as a compiled
11  * binary, for any purpose, commercial or non-commercial, and by any
12  * means.
13  *
14  * In jurisdictions that recognize copyright laws, the author or authors
15  * of this software dedicate any and all copyright interest in the
16  * software to the public domain. We make this dedication for the benefit
17  * of the public at large and to the detriment of our heirs and
18  * successors. We intend this dedication to be an overt act of
19  * relinquishment in perpetuity of all present and future rights to this
20  * software under copyright law.
21  *
22  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
23  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
24  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
25  * IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
26  * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
27  * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
28  * OTHER DEALINGS IN THE SOFTWARE.
29  */
30 package org.sleuthkit.autopsy.examples;
31 
32 import java.util.List;
33 import java.util.logging.Level;
40 import org.sleuthkit.datamodel.AbstractFile;
41 import org.sleuthkit.datamodel.Content;
42 import org.sleuthkit.datamodel.FsContent;
43 import org.sleuthkit.datamodel.SleuthkitCase;
44 import org.sleuthkit.datamodel.TskCoreException;
50 import org.sleuthkit.datamodel.TskData;
51 
58 class SampleDataSourceIngestModule implements DataSourceIngestModule {
59 
60  private final boolean skipKnownFiles;
61  private IngestJobContext context = null;
62 
63  SampleDataSourceIngestModule(SampleModuleIngestJobSettings settings) {
64  this.skipKnownFiles = settings.skipKnownFiles();
65  }
66 
67  @Override
68  public void startUp(IngestJobContext context) throws IngestModuleException {
69  this.context = context;
70  }
71 
72  @Override
73  public ProcessResult process(Content dataSource, DataSourceIngestModuleProgress progressBar) {
74 
75  // There are two tasks to do.
76  progressBar.switchToDeterminate(2);
77 
78  try {
79  // Get count of files with .doc extension.
80  FileManager fileManager = Case.getOpenCase().getServices().getFileManager();
81  List<AbstractFile> docFiles = fileManager.findFiles(dataSource, "%.doc");
82 
83  long fileCount = 0;
84  for (AbstractFile docFile : docFiles) {
85  if (!skipKnownFiles || docFile.getKnown() != TskData.FileKnown.KNOWN) {
86  ++fileCount;
87  }
88  }
89  progressBar.progress(1);
90 
91  // check if we were cancelled
92  if (context.dataSourceIngestIsCancelled()) {
93  return IngestModule.ProcessResult.OK;
94  }
95 
96  // Get files by creation time.
97  long currentTime = System.currentTimeMillis() / 1000;
98  long minTime = currentTime - (14 * 24 * 60 * 60); // Go back two weeks.
99  List<AbstractFile> otherFiles = fileManager.findFiles(dataSource, "crtime > " + minTime);
100  for (AbstractFile otherFile : otherFiles) {
101  if (!skipKnownFiles || otherFile.getKnown() != TskData.FileKnown.KNOWN) {
102  ++fileCount;
103  }
104  }
105  progressBar.progress(1);
106 
107  if (context.dataSourceIngestIsCancelled()) {
108  return IngestModule.ProcessResult.OK;
109  }
110 
111  // Post a message to the ingest messages in box.
112  String msgText = String.format("Found %d files", fileCount);
113  IngestMessage message = IngestMessage.createMessage(
114  IngestMessage.MessageType.DATA,
115  SampleIngestModuleFactory.getModuleName(),
116  msgText);
117  IngestServices.getInstance().postMessage(message);
118 
119  return IngestModule.ProcessResult.OK;
120 
121  } catch (TskCoreException | NoCurrentCaseException ex) {
122  IngestServices ingestServices = IngestServices.getInstance();
123  Logger logger = ingestServices.getLogger(SampleIngestModuleFactory.getModuleName());
124  logger.log(Level.SEVERE, "File query failed", ex);
125  return IngestModule.ProcessResult.ERROR;
126  }
127  }
128 }

Copyright © 2012-2016 Basis Technology. Generated on: Mon May 7 2018
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.