30 package org.sleuthkit.autopsy.examples;
32 import java.util.HashMap;
33 import java.util.logging.Level;
53 class SampleFileIngestModule
implements FileIngestModule {
55 private static final HashMap<Long, Long> artifactCountsForIngestJobs =
new HashMap<>();
56 private static final BlackboardAttribute.ATTRIBUTE_TYPE ATTR_TYPE = BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COUNT;
57 private final boolean skipKnownFiles;
58 private IngestJobContext context = null;
59 private static final IngestModuleReferenceCounter refCounter =
new IngestModuleReferenceCounter();
61 SampleFileIngestModule(SampleModuleIngestJobSettings settings) {
62 this.skipKnownFiles = settings.skipKnownFiles();
66 public void startUp(IngestJobContext context)
throws IngestModuleException {
67 this.context = context;
68 refCounter.incrementAndGet(context.getJobId());
72 public IngestModule.ProcessResult process(AbstractFile file) {
75 if ((file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS)
76 || (file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS)
77 || (file.isFile() ==
false)) {
78 return IngestModule.ProcessResult.OK;
82 if (skipKnownFiles && file.getKnown() == TskData.FileKnown.KNOWN) {
83 return IngestModule.ProcessResult.OK;
90 byte buffer[] =
new byte[1024];
91 int len = file.read(buffer, 0, 1024);
93 for (
int i = 0; i < len; i++) {
94 if (buffer[i] == 0x00) {
101 BlackboardAttribute attr =
new BlackboardAttribute(ATTR_TYPE, SampleIngestModuleFactory.getModuleName(), count);
106 BlackboardArtifact art = file.getGenInfoArtifact();
107 art.addAttribute(attr);
111 addToBlackboardPostCount(context.getJobId(), 1L);
117 file.getSleuthkitCase().getBlackboard().postArtifact(art, SampleIngestModuleFactory.getModuleName());
119 return IngestModule.ProcessResult.OK;
121 }
catch (TskCoreException | Blackboard.BlackboardException ex) {
122 IngestServices ingestServices = IngestServices.getInstance();
123 Logger logger = ingestServices.getLogger(SampleIngestModuleFactory.getModuleName());
124 logger.log(Level.SEVERE,
"Error processing file (id = " + file.getId() +
")", ex);
125 return IngestModule.ProcessResult.ERROR;
130 public void shutDown() {
133 reportBlackboardPostCount(context.getJobId());
136 synchronized static void addToBlackboardPostCount(
long ingestJobId,
long countToAdd) {
137 Long fileCount = artifactCountsForIngestJobs.get(ingestJobId);
140 if (fileCount == null) {
142 artifactCountsForIngestJobs.put(ingestJobId, fileCount);
145 fileCount += countToAdd;
146 artifactCountsForIngestJobs.put(ingestJobId, fileCount);
149 synchronized static void reportBlackboardPostCount(
long ingestJobId) {
150 Long refCount = refCounter.decrementAndGet(ingestJobId);
152 Long filesCount = artifactCountsForIngestJobs.remove(ingestJobId);
153 String msgText = String.format(
"Posted %d times to the blackboard", filesCount);
154 IngestMessage message = IngestMessage.createMessage(
155 IngestMessage.MessageType.INFO,
156 SampleIngestModuleFactory.getModuleName(),
158 IngestServices.getInstance().postMessage(message);