19 package org.sleuthkit.autopsy.externalresults;
22 import java.nio.file.Path;
23 import java.nio.file.Paths;
24 import java.util.ArrayList;
25 import java.util.Collection;
26 import java.util.HashSet;
27 import java.util.List;
28 import java.util.logging.Level;
29 import org.openide.util.NbBundle;
57 private final List<ErrorInfo>
errors =
new ArrayList<>();
61 for (BlackboardArtifact.ARTIFACT_TYPE artifactType : BlackboardArtifact.ARTIFACT_TYPE.values()) {
62 standardArtifactTypeIds.add(artifactType.getTypeID());
83 List<ErrorInfo> importErrors =
new ArrayList<>(this.
errors);
91 String localPath = fileData.getLocalPath();
93 File localFile =
new File(localPath);
94 if (localFile.exists()) {
96 if (!relativePath.isEmpty()) {
97 String parentFilePath = fileData.getParentPath();
99 if (parentFile != null) {
100 DerivedFile derivedFile = fileManager.
addDerivedFile(localFile.getName(), relativePath, localFile.length(),
106 String errorMessage = NbBundle.getMessage(this.getClass(),
107 "ExternalResultsImporter.importDerivedFiles.errMsg1.text",
108 localPath, parentFilePath);
114 String errorMessage = NbBundle.getMessage(this.getClass(),
115 "ExternalResultsImporter.importDerivedFiles.errMsg2.text",
120 }
catch (TskCoreException ex) {
121 String errorMessage = NbBundle.getMessage(this.getClass(),
122 "ExternalResultsImporter.importDerivedFiles.errMsg3.text",
135 int artifactTypeId = caseDb.getArtifactType(artifactData.getType()).getTypeID();
136 if (artifactTypeId == -1) {
137 artifactTypeId = caseDb.addBlackboardArtifactType(artifactData.getType(), artifactData.getType()).getTypeID();
140 if (sourceFile != null) {
141 BlackboardArtifact artifact = sourceFile.newArtifact(artifactTypeId);
144 Collection<BlackboardAttribute> attributes =
new ArrayList<>();
146 BlackboardAttribute.Type attributeType = caseDb.getAttributeType(attributeData.getType());
147 if (attributeType == null) {
148 switch (attributeData.getValueType()) {
150 attributeType = caseDb.addArtifactAttributeType(attributeData.getType(), BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.fromLabel(
"String"), attributeData.getType());
153 attributeType = caseDb.addArtifactAttributeType(attributeData.getType(), BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.fromLabel(
"Integer"), attributeData.getType());
156 attributeType = caseDb.addArtifactAttributeType(attributeData.getType(), BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.fromLabel(
"Long"), attributeData.getType());
159 attributeType = caseDb.addArtifactAttributeType(attributeData.getType(), BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.fromLabel(
"Double"), attributeData.getType());
162 attributeType = caseDb.addArtifactAttributeType(attributeData.getType(), BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.fromLabel(
"DateTime"), attributeData.getType());
166 switch (attributeData.getValueType()) {
168 attributes.add(
new BlackboardAttribute(attributeType, attributeData.getSourceModule(), attributeData.getValue()));
171 int intValue = Integer.parseInt(attributeData.getValue());
172 attributes.add(
new BlackboardAttribute(attributeType, attributeData.getSourceModule(), intValue));
175 long longValue = Long.parseLong(attributeData.getValue());
176 attributes.add(
new BlackboardAttribute(attributeType, attributeData.getSourceModule(), longValue));
179 double doubleValue = Double.parseDouble(attributeData.getValue());
180 attributes.add(
new BlackboardAttribute(attributeType, attributeData.getSourceModule(), doubleValue));
183 long dateTimeValue = Long.parseLong(attributeData.getValue());
184 attributes.add(
new BlackboardAttribute(attributeType, attributeData.getSourceModule(), dateTimeValue));
187 String errorMessage = NbBundle.getMessage(this.getClass(),
188 "ExternalResultsImporter.importArtifacts.caseErrMsg1.text",
189 attributeData.getType(), attributeData.getValue(),
190 artifactData.getType(), artifactData.getSourceFilePath(),
191 attributeData.getValueType());
197 artifact.addAttributes(attributes);
203 logger.log(Level.SEVERE, NbBundle.getMessage(
Blackboard.class,
"Blackboard.unableToIndexArtifact.error.msg", artifact.getDisplayName()), ex);
205 NbBundle.getMessage(
Blackboard.class,
"Blackboard.unableToIndexArtifact.exception.msg"), artifact.getDisplayName());
208 if (standardArtifactTypeIds.contains(artifactTypeId)) {
212 String errorMessage = NbBundle.getMessage(this.getClass(),
213 "ExternalResultsImporter.importArtifacts.errMsg1.text",
214 artifactData.getType(), artifactData.getSourceFilePath());
218 }
catch (TskCoreException | TskDataException ex) {
219 String errorMessage = NbBundle.getMessage(this.getClass(),
220 "ExternalResultsImporter.importArtifacts.errMsg2.text",
221 artifactData.getType(), artifactData.getSourceFilePath());
230 String reportPath = report.getLocalPath();
232 File reportFile =
new File(reportPath);
233 if (reportFile.exists()) {
236 String errorMessage = NbBundle.getMessage(this.getClass(),
"ExternalResultsImporter.importReports.errMsg1.text", reportPath);
240 }
catch (TskCoreException ex) {
241 String errorMessage = NbBundle.getMessage(this.getClass(),
"ExternalResultsImporter.importReports.errMsg2.text", reportPath);
249 AbstractFile file = null;
251 String fileName = filePath;
252 String parentPath =
"";
253 int charPos = filePath.lastIndexOf(
"/");
255 fileName = filePath.substring(charPos + 1);
256 parentPath = filePath.substring(0, charPos + 1);
259 String condition =
"name='" + fileName +
"' AND parent_path='" + parentPath +
"'";
261 if (!files.isEmpty()) {
263 if (files.size() > 1) {
264 String errorMessage = NbBundle.getMessage(this.getClass(),
"ExternalResultsImporter.findFileInCaseDatabase.errMsg1.text", filePath);
272 String relativePath =
"";
274 Path path = Paths.get(localPath);
275 if (path.isAbsolute()) {
276 Path pathBase = Paths.get(caseDirectoryPath);
278 Path pathRelative = pathBase.relativize(path);
279 relativePath = pathRelative.toString();
280 }
catch (IllegalArgumentException ex) {
281 String errorMessage = NbBundle.getMessage(this.getClass(),
282 "ExternalResultsImporter.getPathRelativeToCaseFolder.errMsg1.text",
283 localPath, caseDirectoryPath);
287 String errorMessage = NbBundle.getMessage(this.getClass(),
288 "ExternalResultsImporter.getPathRelativeToCaseFolder.errMsg2.text",
289 localPath, caseDirectoryPath);
297 this.errors.add(
new ErrorInfo(this.getClass().getName(), errorMessage));
302 this.errors.add(
new ErrorInfo(this.getClass().getName(), errorMessage));
void importArtifacts(ExternalResults results)
static final Logger logger
FileManager getFileManager()
void indexArtifact(BlackboardArtifact artifact)
String getCaseDirectory()
void importDerivedFiles(ExternalResults results)
void addReport(String localPath, String srcModuleName, String reportName)
static final HashSet< Integer > standardArtifactTypeIds
synchronized DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parentFile, String rederiveDetails, String toolName, String toolVersion, String otherDetails)
AbstractFile findFileInCaseDatabase(String filePath)
void recordError(String errorMessage, Exception ex)
void fireModuleDataEvent(ModuleDataEvent moduleDataEvent)
SleuthkitCase getSleuthkitCase()
void recordError(String errorMessage)
List< ErrorInfo > importResults(ExternalResults results)
Blackboard getBlackboard()
void fireModuleContentEvent(ModuleContentEvent moduleContentEvent)
static void error(String title, String message)
static Case getCurrentCase()
synchronized static Logger getLogger(String name)
void importReports(ExternalResults results)
String getPathRelativeToCaseFolder(String localPath)
final List< ErrorInfo > errors
static synchronized IngestServices getInstance()