19 package org.sleuthkit.autopsy.modules.encryptiondetection;
21 import java.io.IOException;
22 import java.util.Collections;
23 import java.util.List;
24 import java.util.logging.Level;
25 import org.openide.util.NbBundle.Messages;
48 final class EncryptionDetectionDataSourceIngestModule
implements DataSourceIngestModule {
50 private final IngestServices services = IngestServices.getInstance();
51 private final Logger logger = services.getLogger(EncryptionDetectionModuleFactory.getModuleName());
52 private Blackboard blackboard;
53 private double calculatedEntropy;
54 private final double minimumEntropy;
55 private IngestJobContext context;
63 EncryptionDetectionDataSourceIngestModule(EncryptionDetectionIngestJobSettings settings) {
64 minimumEntropy = settings.getMinimumEntropy();
68 public void startUp(IngestJobContext context)
throws IngestModule.IngestModuleException {
70 blackboard = Case.getCurrentCase().getServices().getBlackboard();
71 this.context = context;
75 "EncryptionDetectionDataSourceIngestModule.artifactComment.bitlocker=Bitlocker encryption detected.",
76 "EncryptionDetectionDataSourceIngestModule.artifactComment.suspected=Suspected encryption due to high entropy (%f).",
77 "EncryptionDetectionDataSourceIngestModule.processing.message=Checking image for encryption."
80 public ProcessResult process(Content dataSource, DataSourceIngestModuleProgress progressBar) {
83 if (dataSource instanceof Image) {
85 if (((Image) dataSource).getPaths().length == 0) {
86 logger.log(Level.SEVERE, String.format(
"Unable to process data source '%s' - image has no paths", dataSource.getName()));
87 return IngestModule.ProcessResult.ERROR;
90 List<VolumeSystem> volumeSystems = ((Image) dataSource).getVolumeSystems();
91 progressBar.switchToDeterminate(volumeSystems.size());
92 int numVolSystemsChecked = 0;
93 progressBar.progress(Bundle.EncryptionDetectionDataSourceIngestModule_processing_message(), 0);
94 for (VolumeSystem volumeSystem : volumeSystems) {
96 if (context.dataSourceIngestIsCancelled()) {
97 return ProcessResult.OK;
100 for (Volume volume : volumeSystem.getVolumes()) {
102 if (context.dataSourceIngestIsCancelled()) {
103 return ProcessResult.OK;
105 if (BitlockerDetection.isBitlockerVolume(volume)) {
106 return flagVolume(volume, BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED, Bundle.EncryptionDetectionDataSourceIngestModule_artifactComment_bitlocker());
109 if (context.dataSourceIngestIsCancelled()) {
110 return ProcessResult.OK;
112 if (isVolumeEncrypted(volume)) {
113 return flagVolume(volume, BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_SUSPECTED, String.format(Bundle.EncryptionDetectionDataSourceIngestModule_artifactComment_suspected(), calculatedEntropy));
117 numVolSystemsChecked++;
118 progressBar.progress(Bundle.EncryptionDetectionDataSourceIngestModule_processing_message(), numVolSystemsChecked);
121 }
catch (ReadContentInputStream.ReadContentInputStreamException ex) {
122 logger.log(Level.WARNING, String.format(
"Unable to read data source '%s'", dataSource.getName()), ex);
123 return IngestModule.ProcessResult.ERROR;
124 }
catch (IOException | TskCoreException ex) {
125 logger.log(Level.SEVERE, String.format(
"Unable to process data source '%s'", dataSource.getName()), ex);
126 return IngestModule.ProcessResult.ERROR;
129 return IngestModule.ProcessResult.OK;
140 private void validateSettings() throws IngestModule.IngestModuleException {
141 EncryptionDetectionTools.validateMinEntropyValue(minimumEntropy);
154 private IngestModule.ProcessResult flagVolume(Volume volume, BlackboardArtifact.ARTIFACT_TYPE artifactType, String comment) {
156 if (context.dataSourceIngestIsCancelled()) {
157 return ProcessResult.OK;
161 BlackboardArtifact artifact = volume.newArtifact(artifactType);
162 artifact.addAttribute(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT, EncryptionDetectionModuleFactory.getModuleName(), comment));
168 blackboard.indexArtifact(artifact);
169 }
catch (Blackboard.BlackboardException ex) {
170 logger.log(Level.SEVERE,
"Unable to index blackboard artifact " + artifact.getArtifactID(), ex);
176 services.fireModuleDataEvent(
new ModuleDataEvent(EncryptionDetectionModuleFactory.getModuleName(), artifactType, Collections.singletonList(artifact)));
181 StringBuilder detailsSb =
new StringBuilder(
"");
182 detailsSb.append(
"File: ");
183 Content parentFile = volume.getParent();
184 if (parentFile != null) {
185 detailsSb.append(volume.getParent().getUniquePath());
187 detailsSb.append(volume.getName());
188 if (artifactType.equals(BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_SUSPECTED)) {
189 detailsSb.append(
"<br/>\nEntropy: ").append(calculatedEntropy);
192 services.postMessage(IngestMessage.createDataMessage(EncryptionDetectionModuleFactory.getModuleName(),
193 artifactType.getDisplayName() +
" Match: " + volume.getName(),
194 detailsSb.toString(),
198 return IngestModule.ProcessResult.OK;
199 }
catch (TskCoreException ex) {
200 logger.log(Level.SEVERE, String.format(
"Failed to create blackboard artifact for '%s'.", volume.getName()), ex);
201 return IngestModule.ProcessResult.ERROR;
213 private boolean isVolumeEncrypted(Volume volume)
throws ReadContentInputStream.ReadContentInputStreamException, IOException, TskCoreException {
218 if (volume.getFileSystems().isEmpty()) {
219 calculatedEntropy = EncryptionDetectionTools.calculateEntropy(volume, context);
220 if (calculatedEntropy >= minimumEntropy) {