23 package org.sleuthkit.autopsy.recentactivity;
26 import java.io.IOException;
27 import java.nio.file.Path;
28 import java.nio.file.Paths;
29 import java.sql.ResultSet;
30 import java.sql.ResultSetMetaData;
31 import java.sql.SQLException;
32 import java.util.ArrayList;
33 import java.util.Collection;
34 import java.util.Collections;
35 import java.util.HashMap;
36 import java.util.List;
37 import java.util.logging.Level;
38 import org.openide.util.NbBundle;
39 import org.openide.util.NbBundle.Messages;
59 abstract class Extract {
61 protected Case currentCase;
62 protected SleuthkitCase tskCase;
63 private final Logger logger = Logger.getLogger(this.getClass().getName());
64 private final ArrayList<String> errorMessages =
new ArrayList<>();
65 String moduleName =
"";
66 boolean dataFound =
false;
71 final void init() throws IngestModuleException {
73 currentCase = Case.getCurrentCaseThrows();
74 tskCase = currentCase.getSleuthkitCase();
75 }
catch (NoCurrentCaseException ex) {
76 throw new IngestModuleException(Bundle.Extract_indexError_message(), ex);
86 void configExtractor() throws IngestModuleException {
89 abstract void process(Content dataSource, IngestJobContext context, DataSourceIngestModuleProgress progressBar);
99 List<String> getErrorMessages() {
100 return errorMessages;
108 protected void addErrorMessage(String message) {
109 errorMessages.add(message);
124 protected BlackboardArtifact addArtifact(BlackboardArtifact.ARTIFACT_TYPE type, Content content, Collection<BlackboardAttribute> bbattributes) {
126 BlackboardArtifact bbart = content.newArtifact(type);
127 bbart.addAttributes(bbattributes);
129 this.indexArtifact(bbart);
131 }
catch (TskException ex) {
132 logger.log(Level.SEVERE,
"Error while trying to add an artifact", ex);
142 @Messages({
"Extract.indexError.message=Failed to index artifact for keyword search.",
143 "Extract.noOpenCase.errMsg=No open case available."})
144 void indexArtifact(BlackboardArtifact bbart) {
146 Blackboard blackboard = Case.getCurrentCaseThrows().getServices().getBlackboard();
148 blackboard.indexArtifact(bbart);
149 }
catch (Blackboard.BlackboardException ex) {
150 logger.log(Level.SEVERE,
"Unable to index blackboard artifact " + bbart.getDisplayName(), ex);
151 MessageNotifyUtil.Notify.error(Bundle.Extract_indexError_message(), bbart.getDisplayName());
152 }
catch (NoCurrentCaseException ex) {
153 logger.log(Level.SEVERE,
"Exception while getting open case.", ex);
154 MessageNotifyUtil.Notify.error(Bundle.Extract_noOpenCase_errMsg(), bbart.getDisplayName());
169 protected List<HashMap<String, Object>> dbConnect(String path, String query) {
171 List<HashMap<String, Object>> list;
172 String connectionString =
"jdbc:sqlite:" + path;
173 SQLiteDBConnect tempdbconnect = null;
175 tempdbconnect =
new SQLiteDBConnect(
"org.sqlite.JDBC", connectionString);
176 temprs = tempdbconnect.executeQry(query);
177 list = this.resultSetToArrayList(temprs);
178 }
catch (SQLException ex) {
179 logger.log(Level.SEVERE,
"Error while trying to read into a sqlite db." + connectionString, ex);
180 errorMessages.add(NbBundle.getMessage(
this.getClass(),
"Extract.dbConn.errMsg.failedToQueryDb", getName()));
181 return Collections.<HashMap<String, Object>>emptyList();
184 if (tempdbconnect != null) {
185 tempdbconnect.closeConnection();
198 private List<HashMap<String, Object>> resultSetToArrayList(ResultSet rs)
throws SQLException {
199 ResultSetMetaData md = rs.getMetaData();
200 int columns = md.getColumnCount();
201 List<HashMap<String, Object>> list =
new ArrayList<>(50);
203 HashMap<String, Object> row =
new HashMap<>(columns);
204 for (
int i = 1; i <= columns; ++i) {
205 if (rs.getObject(i) == null) {
206 row.put(md.getColumnName(i),
"");
208 row.put(md.getColumnName(i), rs.getObject(i));
222 protected String getName() {
230 public boolean foundData() {
238 protected void setFoundData(
boolean foundData){
239 dataFound = foundData;
246 protected Case getCurrentCase(){
247 return this.currentCase;
263 protected Collection<BlackboardAttribute> createHistoryAttribute(String url, Long accessTime,
264 String referrer, String title, String programName, String domain, String user)
throws TskCoreException {
266 Collection<BlackboardAttribute> bbattributes =
new ArrayList<>();
267 bbattributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL,
268 RecentActivityExtracterModuleFactory.getModuleName(),
269 (url != null) ? url :
""));
271 if (accessTime != null) {
272 bbattributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED,
273 RecentActivityExtracterModuleFactory.getModuleName(), accessTime));
276 bbattributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_REFERRER,
277 RecentActivityExtracterModuleFactory.getModuleName(),
278 (referrer != null) ? referrer :
""));
280 bbattributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE,
281 RecentActivityExtracterModuleFactory.getModuleName(),
282 (title != null) ? title :
""));
284 bbattributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME,
285 RecentActivityExtracterModuleFactory.getModuleName(),
286 (programName != null) ? programName :
""));
288 bbattributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN,
289 RecentActivityExtracterModuleFactory.getModuleName(),
290 (domain != null) ? domain :
""));
292 bbattributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_NAME,
293 RecentActivityExtracterModuleFactory.getModuleName(),
294 (user != null) ? user :
""));
310 protected Collection<BlackboardAttribute> createCookieAttributes(String url,
311 Long creationTime, String name, String value, String programName, String domain) {
313 Collection<BlackboardAttribute> bbattributes =
new ArrayList<>();
314 bbattributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL,
315 RecentActivityExtracterModuleFactory.getModuleName(),
316 (url != null) ? url :
""));
318 if (creationTime != null) {
319 bbattributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME,
320 RecentActivityExtracterModuleFactory.getModuleName(), creationTime));
323 bbattributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME,
324 RecentActivityExtracterModuleFactory.getModuleName(),
325 (name != null) ? name :
""));
327 bbattributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_VALUE,
328 RecentActivityExtracterModuleFactory.getModuleName(),
329 (value != null) ? value :
""));
331 bbattributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME,
332 RecentActivityExtracterModuleFactory.getModuleName(),
333 (programName != null) ? programName :
""));
335 bbattributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN,
336 RecentActivityExtracterModuleFactory.getModuleName(),
337 (domain != null) ? domain :
""));
352 protected Collection<BlackboardAttribute> createBookmarkAttributes(String url, String title, Long creationTime, String programName, String domain) {
353 Collection<BlackboardAttribute> bbattributes =
new ArrayList<>();
355 bbattributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL,
356 RecentActivityExtracterModuleFactory.getModuleName(),
357 (url != null) ? url :
""));
359 bbattributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE,
360 RecentActivityExtracterModuleFactory.getModuleName(),
361 (title != null) ? title :
""));
363 if (creationTime != null) {
364 bbattributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED,
365 RecentActivityExtracterModuleFactory.getModuleName(), creationTime));
368 bbattributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME,
369 RecentActivityExtracterModuleFactory.getModuleName(),
370 (programName != null) ? programName :
""));
372 bbattributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN,
373 RecentActivityExtracterModuleFactory.getModuleName(),
374 (domain != null) ? domain :
""));
389 protected Collection<BlackboardAttribute> createDownloadAttributes(String path, Long pathID, String url, Long accessTime, String domain, String programName) {
390 Collection<BlackboardAttribute> bbattributes =
new ArrayList<>();
392 bbattributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH,
393 RecentActivityExtracterModuleFactory.getModuleName(),
394 (path != null) ? path :
""));
396 if (pathID != null && pathID != -1) {
397 bbattributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID,
398 RecentActivityExtracterModuleFactory.getModuleName(),
402 bbattributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL,
403 RecentActivityExtracterModuleFactory.getModuleName(),
404 (url != null) ? url :
""));
406 if (accessTime != null) {
407 bbattributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED,
408 RecentActivityExtracterModuleFactory.getModuleName(), accessTime));
411 bbattributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN,
412 RecentActivityExtracterModuleFactory.getModuleName(),
413 (domain != null) ? domain :
""));
415 bbattributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME,
416 RecentActivityExtracterModuleFactory.getModuleName(),
417 (programName != null) ? programName :
""));
428 protected Collection<BlackboardAttribute> createDownloadSourceAttributes(String url) {
429 Collection<BlackboardAttribute> bbattributes =
new ArrayList<>();
431 bbattributes.add(
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL,
432 RecentActivityExtracterModuleFactory.getModuleName(),
433 (url != null) ? url :
""));
447 protected File createTemporaryFile(IngestJobContext context, AbstractFile file)
throws IOException{
448 Path tempFilePath = Paths.get(RAImageIngestModule.getRATempPath(
449 getCurrentCase(), getName()), file.getName() + file.getId() + file.getNameExtension());
450 java.io.File tempFile = tempFilePath.toFile();
453 ContentUtils.writeToFile(file, tempFile, context::dataSourceIngestIsCancelled);
454 }
catch (IOException ex) {
455 throw new IOException(
"Error writingToFile: " + file, ex);