FileType.java

Go to the documentation of this file.

/*
 * Autopsy Forensic Browser
 *
 * Copyright 2014-2015 Basis Technology Corp.
 * Contact: carrier <at> sleuthkit <dot> org
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.sleuthkit.autopsy.modules.filetypeid;

import java.util.Arrays;
import java.util.logging.Level;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.TskCoreException;

class FileType {

    private final String mimeType;
    private final Signature signature;
    private final String interestingFilesSetName;
    private final boolean alert;

    FileType(String mimeType, final Signature signature, String filesSetName, boolean alert) {
        this.mimeType = mimeType;
        this.signature = new Signature(signature.getSignatureBytes(), signature.getOffset(), signature.getType());
        this.interestingFilesSetName = filesSetName;
        this.alert = alert;
    }

    String getMimeType() {
        return mimeType;
    }

    Signature getSignature() {
        return new Signature(signature.getSignatureBytes(), signature.getOffset(), signature.getType());
    }

    boolean matches(final AbstractFile file) {
        return signature.containedIn(file);
    }

    boolean alertOnMatch() {
        return alert;
    }

    String getFilesSetName() {
        return interestingFilesSetName;
    }

    static class Signature {

        private static final Logger logger = Logger.getLogger(Signature.class.getName());

        enum Type {

            RAW, ASCII
        };

        private final byte[] signatureBytes;
        private final long offset;
        private final Type type;

        Signature(final byte[] signatureBytes, long offset, Type type) {
            this.signatureBytes = Arrays.copyOf(signatureBytes, signatureBytes.length);
            this.offset = offset;
            this.type = type;
        }

        byte[] getSignatureBytes() {
            return Arrays.copyOf(signatureBytes, signatureBytes.length);
        }

        long getOffset() {
            return offset;
        }

        Type getType() {
            return type;
        }

        boolean containedIn(final AbstractFile file) {
            try {
                byte[] buffer = new byte[signatureBytes.length];
                int bytesRead = file.read(buffer, offset, signatureBytes.length);
                return ((bytesRead == signatureBytes.length) && (Arrays.equals(buffer, signatureBytes)));
            } catch (TskCoreException ex) {
                Signature.logger.log(Level.WARNING, "Error reading from file with objId = " + file.getId(), ex); //NON-NLS
                return false;
            }
        }
    }

}