Autopsy  4.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
EmbeddedFileExtractorIngestModule.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2013-2014 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.modules.embeddedfileextractor;
20 
21 import java.io.File;
22 import java.util.logging.Level;
26 import org.sleuthkit.datamodel.AbstractFile;
28 import org.sleuthkit.datamodel.TskData;
35 
41 public final class EmbeddedFileExtractorIngestModule implements FileIngestModule {
42 
43  private static final Logger logger = Logger.getLogger(EmbeddedFileExtractorIngestModule.class.getName());
45  static final String[] SUPPORTED_EXTENSIONS = {"zip", "rar", "arj", "7z", "7zip", "gzip", "gz", "bzip2", "tar", "tgz",}; // "iso"}; NON-NLS
46 
48  private long jobId;
50 
51  private String moduleDirRelative;
52  private String moduleDirAbsolute;
53 
54  private boolean archivextraction;
55  private boolean imageExtraction;
56  private ImageExtractor imageExtractor;
57  private SevenZipExtractor archiveExtractor;
58  SupportedImageExtractionFormats abstractFileExtractionFormat;
59  FileTypeDetector fileTypeDetector;
60 
62  }
63 
64  @Override
65  public void startUp(IngestJobContext context) throws IngestModuleException {
66  this.context = context;
67  jobId = context.getJobId();
68 
69  final Case currentCase = Case.getCurrentCase();
70 
71  moduleDirRelative = currentCase.getModuleOutputDirectoryRelativePath() + File.separator + EmbeddedFileExtractorModuleFactory.getModuleName(); //relative to the case, to store in db
72  moduleDirAbsolute = currentCase.getModuleDirectory() + File.separator + EmbeddedFileExtractorModuleFactory.getModuleName(); //absolute, to extract to
73 
74  // initialize the folder where the embedded files are extracted.
75  File extractionDirectory = new File(moduleDirAbsolute);
76  if (!extractionDirectory.exists()) {
77  try {
78  extractionDirectory.mkdirs();
79  } catch (SecurityException ex) {
80  logger.log(Level.SEVERE, "Error initializing output dir: " + moduleDirAbsolute, ex); //NON-NLS
81  services.postMessage(IngestMessage.createErrorMessage(EmbeddedFileExtractorModuleFactory.getModuleName(), "Error initializing", "Error initializing output dir: " + moduleDirAbsolute)); //NON-NLS
82  throw new IngestModuleException(ex.getMessage(), ex);
83  }
84  }
85 
86  // initialize the filetypedetector
87  try {
88  fileTypeDetector = new FileTypeDetector();
90  throw new IngestModuleException(ex.getMessage(), ex);
91  }
92 
93  // initialize the extraction modules.
94  this.archiveExtractor = new SevenZipExtractor(context, fileTypeDetector, moduleDirRelative, moduleDirAbsolute);
95  this.imageExtractor = new ImageExtractor(context, fileTypeDetector, moduleDirRelative, moduleDirAbsolute);
96  }
97 
98  @Override
99  public ProcessResult process(AbstractFile abstractFile) {
100  // skip the unallocated blocks
101  if (abstractFile.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS)) {
102  return ProcessResult.OK;
103  }
104 
105  // skip known files
106  if (abstractFile.getKnown().equals(TskData.FileKnown.KNOWN)) {
107  return ProcessResult.OK;
108  }
109 
110  // check if the file is supported by either of the two embedded file extractors.
111  this.archivextraction = archiveExtractor.isSevenZipExtractionSupported(abstractFile);
112  this.imageExtraction = imageExtractor.isImageExtractionSupported(abstractFile);
113 
114  if (!abstractFile.isFile() && (!this.archivextraction || !this.imageExtraction)) {
115  return ProcessResult.OK;
116  }
117 
118  // call the archive extractor if archiveExtraction flag is set.
119  if (this.archivextraction) {
120  archiveExtractor.unpack(abstractFile);
121  }
122 
123  // calling the image extractor if imageExtraction flag set.
124  if (this.imageExtraction) {
125  imageExtractor.extractImage(abstractFile);
126  }
127 
128  return ProcessResult.OK;
129  }
130 
131  @Override
132  public void shutDown() {
133  // We don't need the value, but for cleanliness and consistency
134  refCounter.decrementAndGet(jobId);
135  }
136 
144  static String getUniqueName(AbstractFile archiveFile) {
145  return archiveFile.getName() + "_" + archiveFile.getId();
146  }
147 }
static IngestMessage createErrorMessage(String source, String subject, String detailsHtml)
void postMessage(final IngestMessage message)
synchronized static Logger getLogger(String name)
Definition: Logger.java:166
static synchronized IngestServices getInstance()

Copyright © 2012-2015 Basis Technology. Generated on: Wed Apr 6 2016
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.