Autopsy  4.14.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
VMExtractorIngestModule.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2012-2018 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.modules.vmextractor;
20 
21 import java.io.File;
22 import java.io.IOException;
23 import java.nio.file.Files;
24 import java.nio.file.Path;
25 import java.nio.file.Paths;
26 import java.text.SimpleDateFormat;
27 import java.util.ArrayList;
28 import java.util.Calendar;
29 import java.util.HashMap;
30 import java.util.List;
31 import java.util.UUID;
32 import java.util.logging.Level;
33 import org.openide.util.NbBundle;
34 import org.openide.util.NbBundle.Messages;
52 import org.sleuthkit.datamodel.AbstractFile;
53 import org.sleuthkit.datamodel.Content;
54 import org.sleuthkit.datamodel.DataSource;
55 import org.sleuthkit.datamodel.ReadContentInputStream.ReadContentInputStreamException;
56 import org.sleuthkit.datamodel.SleuthkitCase;
57 import org.sleuthkit.datamodel.TskCoreException;
58 import org.sleuthkit.datamodel.TskDataException;
59 
64 @NbBundle.Messages({"# {0} - output directory name", "VMExtractorIngestModule.cannotCreateOutputDir.message=Unable to create output directory: {0}."
65 })
66 final class VMExtractorIngestModule extends DataSourceIngestModuleAdapter {
67 
68  private static final Logger logger = Logger.getLogger(VMExtractorIngestModule.class.getName());
69  private IngestJobContext context;
70  private Path ingestJobOutputDir;
71  private String parentDeviceId;
72  private String parentTimeZone;
73 
74  private final HashMap<String, String> imageFolderToOutputFolder = new HashMap<>();
75  private int folderId = 0;
76 
77  @Messages({"# {0} - data source name", "deviceIdQueryErrMsg=Data source {0} missing Device ID",
78  "VMExtractorIngestModule.noOpenCase.errMsg=No open case available."})
79  @Override
80  public void startUp(IngestJobContext context) throws IngestModuleException {
81  this.context = context;
82  long dataSourceObjId = context.getDataSource().getId();
83  try {
84  Case currentCase = Case.getCurrentCaseThrows();
85  SleuthkitCase caseDb = currentCase.getSleuthkitCase();
86  DataSource dataSource = caseDb.getDataSource(dataSourceObjId);
87  parentDeviceId = dataSource.getDeviceId();
88  parentTimeZone = dataSource.getTimeZone();
89  SimpleDateFormat dateFormat = new SimpleDateFormat("yyyy_MM_dd_HH_mm_ss");
90  String timeStamp = dateFormat.format(Calendar.getInstance().getTime());
91  String ingestJobOutputDirName = context.getDataSource().getName() + "_" + context.getDataSource().getId() + "_" + timeStamp;
92  ingestJobOutputDirName = ingestJobOutputDirName.replace(':', '_');
93  ingestJobOutputDir = Paths.get(currentCase.getModuleDirectory(), VMExtractorIngestModuleFactory.getModuleName(), ingestJobOutputDirName);
94  // create module output folder to write extracted virtual machine files to
95  Files.createDirectories(ingestJobOutputDir);
96  } catch (IOException | SecurityException | UnsupportedOperationException ex) {
97  throw new IngestModule.IngestModuleException(Bundle.VMExtractorIngestModule_cannotCreateOutputDir_message(ex.getLocalizedMessage()), ex);
98  } catch (TskDataException | TskCoreException ex) {
99  throw new IngestModule.IngestModuleException(Bundle.deviceIdQueryErrMsg(context.getDataSource().getName()), ex);
100  } catch (NoCurrentCaseException ex) {
101  throw new IngestModule.IngestModuleException(Bundle.VMExtractorIngestModule_noOpenCase_errMsg(), ex);
102  }
103  }
104 
105  @Override
106  public ProcessResult process(Content dataSource, DataSourceIngestModuleProgress progressBar) {
107 
108  String outputFolderForThisVM;
109  List<AbstractFile> vmFiles;
110 
111  // Configure and start progress bar - looking for VM files
112  progressBar.progress(NbBundle.getMessage(this.getClass(), "VMExtractorIngestModule.searchingImage.message"));
113  // Not sure how long it will take for search to complete.
114  progressBar.switchToIndeterminate();
115 
116  logger.log(Level.INFO, "Looking for virtual machine files in data source {0}", dataSource.getName()); //NON-NLS
117 
118  try {
119  // look for all VM files
120  vmFiles = findVirtualMachineFiles(dataSource);
121  } catch (TskCoreException ex) {
122  logger.log(Level.SEVERE, "Error querying case database", ex); //NON-NLS
123  return ProcessResult.ERROR;
124  } catch (NoCurrentCaseException ex) {
125  logger.log(Level.SEVERE, "Exception while getting open case.", ex); //NON-NLS
126  return ProcessResult.ERROR;
127  }
128 
129  if (vmFiles.isEmpty()) {
130  // no VM files found
131  logger.log(Level.INFO, "No virtual machine files found in data source {0}", dataSource.getName()); //NON-NLS
132  return ProcessResult.OK;
133  }
134  // display progress for saving each VM file to disk
135  progressBar.switchToDeterminate(vmFiles.size());
136  progressBar.progress(NbBundle.getMessage(this.getClass(), "VMExtractorIngestModule.exportingToDisk.message"));
137 
138  int numFilesSaved = 0;
139  for (AbstractFile vmFile : vmFiles) {
140  if (context.dataSourceIngestIsCancelled()) {
141  break;
142  }
143 
144  logger.log(Level.INFO, "Saving virtual machine file {0} to disk", vmFile.getName()); //NON-NLS
145 
146  // get vmFolderPathInsideTheImage to the folder where VM is located
147  String vmFolderPathInsideTheImage = vmFile.getParentPath();
148 
149  // check if the vmFolderPathInsideTheImage is already in hashmap
150  if (imageFolderToOutputFolder.containsKey(vmFolderPathInsideTheImage)) {
151  // if it is then we have already created output folder to write out all VM files in this parent folder
152  outputFolderForThisVM = imageFolderToOutputFolder.get(vmFolderPathInsideTheImage);
153  } else {
154  // if not - create output folder to write out VM files (can use any unique ID or number for folder name)
155  folderId++;
156  outputFolderForThisVM = Paths.get(ingestJobOutputDir.toString(), Integer.toString(folderId)).toString();
157 
158  // add vmFolderPathInsideTheImage to hashmap
159  imageFolderToOutputFolder.put(vmFolderPathInsideTheImage, outputFolderForThisVM);
160  }
161 
162  // write the vm file to output folder
163  try {
164  writeVirtualMachineToDisk(vmFile, outputFolderForThisVM);
165  } catch (ReadContentInputStreamException ex) {
166  logger.log(Level.WARNING, String.format("Failed to read virtual machine file '%s' (id=%d).",
167  vmFile.getName(), vmFile.getId()), ex); //NON-NLS
168  MessageNotifyUtil.Notify.error(NbBundle.getMessage(this.getClass(), "VMExtractorIngestModule.msgNotify.failedExtractVM.title.txt"),
169  NbBundle.getMessage(this.getClass(), "VMExtractorIngestModule.msgNotify.failedExtractVM.msg.txt", vmFile.getName()));
170  } catch (Exception ex) {
171  logger.log(Level.SEVERE, String.format("Failed to write virtual machine file '%s' (id=%d) to folder '%s'.",
172  vmFile.getName(), vmFile.getId(), outputFolderForThisVM), ex); //NON-NLS
173  MessageNotifyUtil.Notify.error(NbBundle.getMessage(this.getClass(), "VMExtractorIngestModule.msgNotify.failedExtractVM.title.txt"),
174  NbBundle.getMessage(this.getClass(), "VMExtractorIngestModule.msgNotify.failedExtractVM.msg.txt", vmFile.getName()));
175  }
176 
177  // Update progress bar
178  numFilesSaved++;
179  progressBar.progress(NbBundle.getMessage(this.getClass(), "VMExtractorIngestModule.exportingToDisk.message"), numFilesSaved);
180  }
181  logger.log(Level.INFO, "Finished saving virtual machine files to disk"); //NON-NLS
182 
183  // update progress bar
184  progressBar.switchToDeterminate(imageFolderToOutputFolder.size());
185  progressBar.progress(NbBundle.getMessage(this.getClass(), "VMExtractorIngestModule.queuingIngestJobs.message"));
186  // this is for progress bar purposes because at this point we only know in advance how many job folders to ingest, not how many data sources.
187  int numJobsQueued = 0;
188  // start processing output folders after we are done writing out all vm files
189  for (String folder : imageFolderToOutputFolder.values()) {
190  if (context.dataSourceIngestIsCancelled()) {
191  break;
192  }
193  List<String> vmFilesToIngest = VirtualMachineFinder.identifyVirtualMachines(Paths.get(folder));
194  for (String file : vmFilesToIngest) {
195  try {
196  logger.log(Level.INFO, "Ingesting virtual machine file {0} in folder {1}", new Object[]{file, folder}); //NON-NLS
197 
198  // for extracted virtual machines there is no manifest XML file to read data source ID from so use parent data source ID.
199  // ingest the data sources
200  ingestVirtualMachineImage(Paths.get(folder, file));
201  logger.log(Level.INFO, "Ingest complete for virtual machine file {0} in folder {1}", new Object[]{file, folder}); //NON-NLS
202  } catch (InterruptedException ex) {
203  logger.log(Level.INFO, "Interrupted while ingesting virtual machine file " + file + " in folder " + folder, ex); //NON-NLS
204  } catch (IOException ex) {
205  logger.log(Level.SEVERE, "Failed to ingest virtual machine file " + file + " in folder " + folder, ex); //NON-NLS
206  MessageNotifyUtil.Notify.error(NbBundle.getMessage(this.getClass(), "VMExtractorIngestModule.msgNotify.failedIngestVM.title.txt"),
207  NbBundle.getMessage(this.getClass(), "VMExtractorIngestModule.msgNotify.failedIngestVM.msg.txt", file));
208  } catch (NoCurrentCaseException ex) {
209  logger.log(Level.SEVERE, "Exception while getting open case.", ex); //NON-NLS
210  MessageNotifyUtil.Notify.error(NbBundle.getMessage(this.getClass(), "VMExtractorIngestModule.msgNotify.failedIngestVM.title.txt"),
211  Bundle.VMExtractorIngestModule_noOpenCase_errMsg());
212  }
213  }
214  // Update progress bar
215  numJobsQueued++;
216  progressBar.progress(NbBundle.getMessage(this.getClass(), "VMExtractorIngestModule.queuingIngestJobs.message"), numJobsQueued);
217  }
218  logger.log(Level.INFO, "VMExtractorIngestModule completed processing of data source {0}", dataSource.getName()); //NON-NLS
219  return ProcessResult.OK;
220  }
221 
233  private static List<AbstractFile> findVirtualMachineFiles(Content dataSource) throws TskCoreException, NoCurrentCaseException {
234  List<AbstractFile> vmFiles = new ArrayList<>();
235  for (String vmExtension : GeneralFilter.VIRTUAL_MACHINE_EXTS) {
236  String searchString = "%" + vmExtension; // want a search string that looks like this "%.vmdk"
237  vmFiles.addAll(Case.getCurrentCaseThrows().getServices().getFileManager().findFiles(dataSource, searchString));
238  }
239  return vmFiles;
240  }
241 
251  private void writeVirtualMachineToDisk(AbstractFile vmFile, String outputFolderForThisVM) throws ReadContentInputStreamException, IOException {
252 
253  // TODO: check available disk space first? See IngestMonitor.getFreeSpace()
254  // check if output folder exists
255  File destinationFolder = Paths.get(outputFolderForThisVM).toFile();
256  if (!destinationFolder.exists()) {
257  destinationFolder.mkdirs();
258  }
259  /*
260  * Write the virtual machine file to disk.
261  */
262  File localFile = Paths.get(outputFolderForThisVM, vmFile.getName()).toFile();
263  ContentUtils.writeToFile(vmFile, localFile, context::dataSourceIngestIsCancelled);
264  }
265 
272  private void ingestVirtualMachineImage(Path vmFile) throws InterruptedException, IOException, NoCurrentCaseException {
273 
274  /*
275  * Try to add the virtual machine file to the case as a data source.
276  */
277  UUID taskId = UUID.randomUUID();
278  Case.getCurrentCaseThrows().notifyAddingDataSource(taskId);
279  ImageDSProcessor dataSourceProcessor = new ImageDSProcessor();
280  AddDataSourceCallback dspCallback = new AddDataSourceCallback(vmFile);
281  synchronized (this) {
282  dataSourceProcessor.run(parentDeviceId, vmFile.toString(), parentTimeZone, false, new AddDataSourceProgressMonitor(), dspCallback);
283  /*
284  * Block the ingest thread until the data source processor finishes.
285  */
286  this.wait();
287  }
288 
289  /*
290  * If the image was added, analyze it with the ingest modules for this
291  * ingest context.
292  */
293  if (!dspCallback.vmDataSources.isEmpty()) {
294  Case.getCurrentCaseThrows().notifyDataSourceAdded(dspCallback.vmDataSources.get(0), taskId);
295  List<Content> dataSourceContent = new ArrayList<>(dspCallback.vmDataSources);
296  IngestJobSettings ingestJobSettings = new IngestJobSettings(context.getExecutionContext());
297  for (String warning : ingestJobSettings.getWarnings()) {
298  logger.log(Level.WARNING, String.format("Ingest job settings warning for virtual machine file %s : %s", vmFile.toString(), warning)); //NON-NLS
299  }
300  IngestServices.getInstance().postMessage(IngestMessage.createMessage(IngestMessage.MessageType.INFO,
301  VMExtractorIngestModuleFactory.getModuleName(),
302  NbBundle.getMessage(this.getClass(), "VMExtractorIngestModule.addedVirtualMachineImage.message", vmFile.toString())));
303  IngestManager.getInstance().queueIngestJob(dataSourceContent, ingestJobSettings);
304  } else {
305  Case.getCurrentCaseThrows().notifyFailedAddingDataSource(taskId);
306  }
307  }
308 
312  private static final class AddDataSourceProgressMonitor implements DataSourceProcessorProgressMonitor {
313 
314  @Override
315  public void setIndeterminate(final boolean indeterminate) {
316  }
317 
318  @Override
319  public void setProgress(final int progress) {
320  }
321 
322  @Override
323  public void setProgressText(final String text) {
324  }
325 
326  }
327 
333 
334  private final Path vmFile;
335  private final List<Content> vmDataSources;
336 
342  private AddDataSourceCallback(Path vmFile) {
343  this.vmFile = vmFile;
344  vmDataSources = new ArrayList<>();
345  }
346 
347  @Override
348  public void done(DataSourceProcessorCallback.DataSourceProcessorResult result, List<String> errList, List<Content> content) {
349  for (String error : errList) {
350  String logMessage = String.format("Data source processor error for virtual machine file %s: %s", vmFile.toString(), error); //NON-NLS
352  logger.log(Level.SEVERE, logMessage);
353  } else {
354  logger.log(Level.WARNING, logMessage);
355  }
356  }
357 
358  /*
359  * Save a reference to the content object so it can be used to
360  * create a new ingest job.
361  */
362  if (!content.isEmpty()) {
363  vmDataSources.add(content.get(0));
364  }
365 
366  /*
367  * Unblock the ingest thread.
368  */
369  synchronized (VMExtractorIngestModule.this) {
370  VMExtractorIngestModule.this.notify();
371  }
372  }
373 
374  @Override
375  public void doneEDT(DataSourceProcessorResult result, List<String> errList, List<Content> newContents) {
376  done(result, errList, newContents);
377  }
378 
379  }
380 
381 }
void doneEDT(DataSourceProcessorResult result, List< String > errList, List< Content > newContents)
void done(DataSourceProcessorCallback.DataSourceProcessorResult result, List< String > errList, List< Content > content)

Copyright © 2012-2020 Basis Technology. Generated on: Wed Apr 8 2020
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.