19 package org.sleuthkit.autopsy.recentactivity;
21 import java.io.FileNotFoundException;
22 import java.io.IOException;
23 import java.util.ArrayList;
24 import java.util.Arrays;
25 import java.util.Collection;
26 import java.util.HashSet;
27 import java.util.List;
28 import java.util.Properties;
30 import java.util.logging.Level;
31 import org.apache.commons.lang3.StringUtils;
32 import org.openide.util.NbBundle.Messages;
41 import static org.
sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_DOWNLOAD_SOURCE;
42 import static org.
sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD;
44 import static org.
sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN;
45 import static org.
sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION;
46 import static org.
sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID;
47 import static org.
sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL;
57 final class ExtractZoneIdentifier
extends Extract {
59 private static final Logger LOG = Logger.getLogger(ExtractEdge.class.getName());
61 private static final String ZONE_IDENTIFIER_FILE =
"%:Zone.Identifier";
62 private static final String ZONE_IDENTIFIER =
":Zone.Identifier";
65 "ExtractZone_process_errMsg_find=A failure occured while searching for :Zone.Indentifier files.",
66 "ExtractZone_process_errMsg=An error occured processing ':Zone.Indentifier' files.",
67 "ExtractZone_progress_Msg=Extracting :Zone.Identifer files"
71 void process(Content dataSource, IngestJobContext context, DataSourceIngestModuleProgress progressBar) {
73 progressBar.progress(Bundle.ExtractZone_progress_Msg());
75 List<AbstractFile> zoneFiles = null;
77 zoneFiles = currentCase.getServices().getFileManager().findFiles(dataSource, ZONE_IDENTIFIER_FILE);
78 }
catch (TskCoreException ex) {
79 addErrorMessage(Bundle.ExtractZone_process_errMsg_find());
80 LOG.log(Level.SEVERE,
"Unable to find zone identifier files, exception thrown. ", ex);
83 if (zoneFiles == null || zoneFiles.isEmpty()) {
87 Set<Long> knownPathIDs = null;
89 knownPathIDs = getPathIDsForType(TSK_WEB_DOWNLOAD);
90 }
catch (TskCoreException ex) {
91 addErrorMessage(Bundle.ExtractZone_process_errMsg());
92 LOG.log(Level.SEVERE,
"Failed to build PathIDs List for TSK_WEB_DOWNLOAD", ex);
95 if (knownPathIDs == null) {
99 Collection<BlackboardArtifact> sourceArtifacts =
new ArrayList<>();
100 Collection<BlackboardArtifact> downloadArtifacts =
new ArrayList<>();
102 for (AbstractFile zoneFile : zoneFiles) {
104 if (context.dataSourceIngestIsCancelled()) {
109 processZoneFile(context, dataSource, zoneFile, sourceArtifacts, downloadArtifacts, knownPathIDs);
110 }
catch (TskCoreException ex) {
111 addErrorMessage(Bundle.ExtractZone_process_errMsg());
112 String message = String.format(
"Failed to process zone identifier file %s", zoneFile.getName());
113 LOG.log(Level.WARNING, message, ex);
117 IngestServices services = IngestServices.getInstance();
119 if (!sourceArtifacts.isEmpty()) {
120 services.fireModuleDataEvent(
new ModuleDataEvent(
121 RecentActivityExtracterModuleFactory.getModuleName(),
122 TSK_DOWNLOAD_SOURCE, sourceArtifacts));
125 if (!downloadArtifacts.isEmpty()) {
126 services.fireModuleDataEvent(
new ModuleDataEvent(
127 RecentActivityExtracterModuleFactory.getModuleName(),
128 TSK_WEB_DOWNLOAD, downloadArtifacts));
143 private void processZoneFile(IngestJobContext context, Content dataSource,
144 AbstractFile zoneFile, Collection<BlackboardArtifact> sourceArtifacts,
145 Collection<BlackboardArtifact> downloadArtifacts,
146 Set<Long> knownPathIDs)
throws TskCoreException {
148 ZoneIdentifierInfo zoneInfo = null;
151 zoneInfo =
new ZoneIdentifierInfo(zoneFile);
152 }
catch (IOException ex) {
153 String message = String.format(
"Unable to parse temporary File for %s", zoneFile.getName());
154 LOG.log(Level.WARNING, message, ex);
157 if (zoneInfo == null) {
161 AbstractFile downloadFile = getDownloadFile(dataSource, zoneFile);
163 if (downloadFile != null) {
165 if (!knownPathIDs.contains(downloadFile.getDataSourceObjectId())) {
168 BlackboardArtifact downloadBba = createDownloadArtifact(zoneFile, zoneInfo);
169 if (downloadBba != null) {
170 downloadArtifacts.add(downloadBba);
175 if (downloadFile.getArtifactsCount(TSK_DOWNLOAD_SOURCE) == 0) {
176 BlackboardArtifact sourceBba = createDownloadSourceArtifact(downloadFile, zoneInfo);
177 if (sourceBba != null) {
178 sourceArtifacts.add(sourceBba);
194 private AbstractFile getDownloadFile(Content dataSource, AbstractFile zoneFile)
throws TskCoreException {
195 AbstractFile downloadFile = null;
198 = currentCase.getServices().getFileManager();
200 String downloadFileName = zoneFile.getName().replace(ZONE_IDENTIFIER,
"");
202 List<AbstractFile> fileList = fileManager.
findFiles(dataSource, downloadFileName, zoneFile.getParentPath());
204 if (fileList.size() == 1) {
205 downloadFile = fileList.get(0);
208 if (!downloadFile.getParentPath().equals(zoneFile.getParentPath())) {
210 }
else if (zoneFile.getMetaAddr() != downloadFile.getMetaAddr()) {
228 private BlackboardArtifact createDownloadSourceArtifact(AbstractFile downloadFile, ZoneIdentifierInfo zoneInfo) {
230 Collection<BlackboardAttribute> bbattributes =
new ArrayList<>();
232 bbattributes.addAll(Arrays.asList(
233 new BlackboardAttribute(TSK_URL,
234 RecentActivityExtracterModuleFactory.getModuleName(),
235 StringUtils.defaultString(zoneInfo.getURL(),
"")),
237 new BlackboardAttribute(TSK_DOMAIN,
238 RecentActivityExtracterModuleFactory.getModuleName(),
239 (zoneInfo.getURL() != null) ? NetworkUtils.extractDomain(zoneInfo.getURL()) :
""),
241 new BlackboardAttribute(TSK_LOCATION,
242 RecentActivityExtracterModuleFactory.getModuleName(),
243 StringUtils.defaultString(zoneInfo.getZoneIdAsString(),
""))));
245 return addArtifact(TSK_DOWNLOAD_SOURCE, downloadFile, bbattributes);
256 private BlackboardArtifact createDownloadArtifact(AbstractFile zoneFile, ZoneIdentifierInfo zoneInfo) {
258 Collection<BlackboardAttribute> bbattributes = createDownloadAttributes(
260 zoneInfo.getURL(), null,
261 (zoneInfo.getURL() != null ? NetworkUtils.extractDomain(zoneInfo.getURL()) :
""),
263 return addArtifact(TSK_WEB_DOWNLOAD, zoneFile, bbattributes);
275 private Set<Long> getPathIDsForType(BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException {
276 Set<Long> idList =
new HashSet<>();
277 for (BlackboardArtifact artifact : currentCase.getSleuthkitCase().getBlackboardArtifacts(type)) {
278 BlackboardAttribute pathIDAttribute = artifact.getAttribute(
new BlackboardAttribute.Type(TSK_PATH_ID));
280 if (pathIDAttribute != null) {
281 long contentID = pathIDAttribute.getValueLong();
282 if (contentID != -1) {
283 idList.add(contentID);
291 "ExtractZone_Local_Machine=Local Machine Zone",
292 "ExtractZone_Local_Intranet=Local Intranet Zone",
293 "ExtractZone_Trusted=Trusted Sites Zone",
294 "ExtractZone_Internet=Internet Zone",
295 "ExtractZone_Restricted=Restricted Sites Zone"
308 private static final String ZONE_ID =
"ZoneId";
309 private static final String REFERRER_URL =
"ReferrerUrl";
310 private static final String HOST_URL =
"HostUrl";
311 private static final String FAMILY_NAME =
"LastWriterPackageFamilyName";
313 private final Properties properties =
new Properties(null);
325 properties.load(
new ReadContentInputStream(zoneFile));
335 String value = properties.getProperty(ZONE_ID);
337 zoneValue = Integer.parseInt(value);
349 switch (getZoneId()) {
351 return Bundle.ExtractZone_Local_Machine();
353 return Bundle.ExtractZone_Local_Intranet();
355 return Bundle.ExtractZone_Trusted();
357 return Bundle.ExtractZone_Internet();
359 return Bundle.ExtractZone_Restricted();
371 return properties.getProperty(HOST_URL);
380 return properties.getProperty(REFERRER_URL);
389 return properties.getProperty(FAMILY_NAME);
synchronized List< AbstractFile > findFiles(String fileName)