Autopsy  4.17.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
FileManager.java
Go to the documentation of this file.
1 /*
2  *
3  * Autopsy Forensic Browser
4  *
5  * Copyright 2012-2019 Basis Technology Corp.
6  * Copyright 2012 42six Solutions.
7  * Contact: aebadirad <at> 42six <dot> com
8  * Project Contact/Architect: carrier <at> sleuthkit <dot> org
9  *
10  * Licensed under the Apache License, Version 2.0 (the "License");
11  * you may not use this file except in compliance with the License.
12  * You may obtain a copy of the License at
13  *
14  * http://www.apache.org/licenses/LICENSE-2.0
15  *
16  * Unless required by applicable law or agreed to in writing, software
17  * distributed under the License is distributed on an "AS IS" BASIS,
18  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
19  * See the License for the specific language governing permissions and
20  * limitations under the License.
21  *
22  * TODO (AUT-2158): This class should not extend Closeable.
23  */
24 package org.sleuthkit.autopsy.casemodule.services;
25 
26 import java.io.Closeable;
27 import java.io.IOException;
28 import java.util.ArrayList;
29 import java.util.Collection;
30 import java.util.List;
31 import java.util.logging.Level;
32 import org.openide.util.NbBundle;
36 import org.sleuthkit.datamodel.AbstractFile;
37 import org.sleuthkit.datamodel.Content;
38 import org.sleuthkit.datamodel.DerivedFile;
39 import org.sleuthkit.datamodel.LayoutFile;
40 import org.sleuthkit.datamodel.LocalDirectory;
41 import org.sleuthkit.datamodel.SleuthkitCase;
42 import org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction;
43 import org.sleuthkit.datamodel.SpecialDirectory;
44 import org.sleuthkit.datamodel.TskCoreException;
45 import org.sleuthkit.datamodel.TskFileRange;
46 import org.sleuthkit.datamodel.VirtualDirectory;
47 import org.sleuthkit.datamodel.LocalFilesDataSource;
48 import org.sleuthkit.datamodel.TskDataException;
49 import org.apache.commons.lang3.StringUtils;
51 import org.sleuthkit.datamodel.CarvingResult;
52 import org.sleuthkit.datamodel.TskData;
53 
59 public class FileManager implements Closeable {
60 
61  private static final Logger LOGGER = Logger.getLogger(FileManager.class.getName());
62  private SleuthkitCase caseDb;
63 
71  public FileManager(SleuthkitCase caseDb) {
72  this.caseDb = caseDb;
73  }
74 
85  public synchronized List<AbstractFile> findFilesByMimeType(Collection<String> mimeTypes) throws TskCoreException {
86  if (null == caseDb) {
87  throw new TskCoreException("File manager has been closed");
88  }
89  return caseDb.findAllFilesWhere(createFileTypeInCondition(mimeTypes));
90  }
91 
104  public synchronized List<AbstractFile> findFilesByParentPath(long dataSourceObjectID, String parentPath) throws TskCoreException {
105  if (null == caseDb) {
106  throw new TskCoreException("File manager has been closed");
107  }
108  return caseDb.findAllFilesWhere(createParentPathCondition(dataSourceObjectID, parentPath));
109  }
110 
123  public synchronized List<AbstractFile> findFilesByMimeType(Content dataSource, Collection<String> mimeTypes) throws TskCoreException {
124  if (null == caseDb) {
125  throw new TskCoreException("File manager has been closed");
126  }
127  return caseDb.findAllFilesWhere("data_source_obj_id = " + dataSource.getId() + " AND " + createFileTypeInCondition(mimeTypes));
128  }
129 
140  public synchronized List<AbstractFile> findFilesExactName(long parentId, String name) throws TskCoreException{
141  if (null == caseDb) {
142  throw new TskCoreException("File manager has been closed");
143  }
144  String whereClause = "name = '%s'";
145  return caseDb.findAllFilesInFolderWhere(parentId, String.format(whereClause, name));
146  }
147 
155  private static String createFileTypeInCondition(Collection<String> mimeTypes) {
156  String types = StringUtils.join(mimeTypes, "', '");
157  return "mime_type IN ('" + types + "')";
158  }
159 
169  private static String createParentPathCondition(long dataSourceObjectID, String parentPath) {
170  return "data_source_obj_id = " + dataSourceObjectID + " AND parent_path LIKE '" + parentPath + "%'";
171  }
172 
185  public synchronized List<AbstractFile> findFiles(String fileName) throws TskCoreException {
186  if (null == caseDb) {
187  throw new TskCoreException("File manager has been closed");
188  }
189  List<AbstractFile> result = new ArrayList<>();
190  List<Content> dataSources = caseDb.getRootObjects();
191  for (Content dataSource : dataSources) {
192  result.addAll(findFiles(dataSource, fileName));
193  }
194  return result;
195  }
196 
213  public synchronized List<AbstractFile> findFiles(String fileName, String parentSubString) throws TskCoreException {
214  if (null == caseDb) {
215  throw new TskCoreException("File manager has been closed");
216  }
217  List<AbstractFile> result = new ArrayList<>();
218  List<Content> dataSources = caseDb.getRootObjects();
219  for (Content dataSource : dataSources) {
220  result.addAll(findFiles(dataSource, fileName, parentSubString));
221  }
222  return result;
223  }
224 
239  public synchronized List<AbstractFile> findFiles(String fileName, AbstractFile parent) throws TskCoreException {
240  if (null == caseDb) {
241  throw new TskCoreException("File manager has been closed");
242  }
243  List<AbstractFile> result = new ArrayList<>();
244  List<Content> dataSources = caseDb.getRootObjects();
245  for (Content dataSource : dataSources) {
246  result.addAll(findFiles(dataSource, fileName, parent));
247  }
248  return result;
249  }
250 
265  public synchronized List<AbstractFile> findFiles(Content dataSource, String fileName) throws TskCoreException {
266  if (null == caseDb) {
267  throw new TskCoreException("File manager has been closed");
268  }
269  return caseDb.findFiles(dataSource, fileName);
270  }
271 
290  public synchronized List<AbstractFile> findFiles(Content dataSource, String fileName, String parentSubString) throws TskCoreException {
291  if (null == caseDb) {
292  throw new TskCoreException("File manager has been closed");
293  }
294  return caseDb.findFiles(dataSource, fileName, parentSubString);
295  }
296 
313  public synchronized List<AbstractFile> findFiles(Content dataSource, String fileName, AbstractFile parent) throws TskCoreException {
314  if (null == caseDb) {
315  throw new TskCoreException("File manager has been closed");
316  }
317  return findFiles(dataSource, fileName, parent.getName());
318  }
319 
336  public synchronized List<AbstractFile> openFiles(Content dataSource, String filePath) throws TskCoreException {
337  if (null == caseDb) {
338  throw new TskCoreException("File manager has been closed");
339  }
340  return caseDb.openFiles(dataSource, filePath);
341  }
342 
372  public synchronized DerivedFile addDerivedFile(String fileName,
373  String localPath,
374  long size,
375  long ctime, long crtime, long atime, long mtime,
376  boolean isFile,
377  Content parentObj,
378  String rederiveDetails, String toolName, String toolVersion, String otherDetails,
379  TskData.EncodingType encodingType) throws TskCoreException {
380  if (null == caseDb) {
381  throw new TskCoreException("File manager has been closed");
382  }
383  return caseDb.addDerivedFile(fileName, localPath, size,
384  ctime, crtime, atime, mtime,
385  isFile, parentObj, rederiveDetails, toolName, toolVersion, otherDetails, encodingType);
386  }
387 
418  public synchronized DerivedFile updateDerivedFile(DerivedFile derivedFile, String localPath,
419  long size,
420  long ctime, long crtime, long atime, long mtime,
421  boolean isFile, String mimeType,
422  String rederiveDetails, String toolName, String toolVersion, String otherDetails,
423  TskData.EncodingType encodingType) throws TskCoreException {
424  if (null == caseDb) {
425  throw new TskCoreException("File manager has been closed");
426  }
427  return caseDb.updateDerivedFile(derivedFile, localPath, size,
428  ctime, crtime, atime, mtime,
429  isFile, mimeType, rederiveDetails, toolName, toolVersion, otherDetails, encodingType);
430  }
431 
443  public synchronized List<LayoutFile> addCarvedFiles(CarvingResult carvingResult) throws TskCoreException {
444  if (null == caseDb) {
445  throw new TskCoreException("File manager has been closed");
446  }
447  return caseDb.addCarvedFiles(carvingResult);
448  }
449 
454  public interface FileAddProgressUpdater {
455 
461  void fileAdded(AbstractFile newFile);
462  }
463 
492  public synchronized LocalFilesDataSource addLocalFilesDataSource(String deviceId, String rootVirtualDirectoryName, String timeZone, List<String> localFilePaths, FileAddProgressUpdater progressUpdater) throws TskCoreException, TskDataException {
493  if (null == caseDb) {
494  throw new TskCoreException("File manager has been closed");
495  }
496  List<java.io.File> localFiles = getFilesAndDirectories(localFilePaths);
497  CaseDbTransaction trans = null;
498  try {
499  String rootDirectoryName = rootVirtualDirectoryName;
500  if (rootDirectoryName.isEmpty()) {
501  rootDirectoryName = generateFilesDataSourceName(caseDb);
502  }
503 
504  /*
505  * Add the root virtual directory and its local/logical file
506  * children to the case database.
507  */
508  trans = caseDb.beginTransaction();
509  LocalFilesDataSource dataSource = caseDb.addLocalFilesDataSource(deviceId, rootDirectoryName, timeZone, trans);
510  List<AbstractFile> filesAdded = new ArrayList<>();
511  for (java.io.File localFile : localFiles) {
512  AbstractFile fileAdded = addLocalFile(trans, dataSource, localFile, TskData.EncodingType.NONE, progressUpdater);
513  if (null != fileAdded) {
514  filesAdded.add(fileAdded);
515  } else {
516  throw new TskCoreException(NbBundle.getMessage(this.getClass(), "FileManager.addLocalFilesDirs.exception.cantAdd.msg", localFile.getAbsolutePath()));
517  }
518  }
519  trans.commit();
520  trans = null;
521 
522  /*
523  * Publish content added events for the added files and directories.
524  */
525  for (AbstractFile fileAdded : filesAdded) {
527  }
528 
529  return dataSource;
530 
531  } finally {
532  if (null != trans) {
533  try {
534  trans.rollback();
535  } catch (TskCoreException ex) {
536  LOGGER.log(Level.SEVERE, "Failed to rollback transaction after exception", ex);
537  }
538  }
539  }
540  }
541 
555  private static synchronized String generateFilesDataSourceName(SleuthkitCase caseDb) throws TskCoreException {
556  int localFileDataSourcesCounter = 0;
557  try {
558  List<VirtualDirectory> localFileDataSources = caseDb.getVirtualDirectoryRoots();
559  for (VirtualDirectory vd : localFileDataSources) {
560  if (vd.getName().startsWith(VirtualDirectoryNode.LOGICAL_FILE_SET_PREFIX)) {
561  ++localFileDataSourcesCounter;
562  }
563  }
564  return VirtualDirectoryNode.LOGICAL_FILE_SET_PREFIX + (localFileDataSourcesCounter + 1);
565  } catch (TskCoreException ex) {
566  throw new TskCoreException("Error querying for existing local file data sources with defualt names", ex);
567  }
568  }
569 
582  private List<java.io.File> getFilesAndDirectories(List<String> localFilePaths) throws TskDataException {
583  List<java.io.File> localFiles = new ArrayList<>();
584  for (String path : localFilePaths) {
585  java.io.File localFile = new java.io.File(path);
586  if (!localFile.exists() || !localFile.canRead()) {
587  throw new TskDataException(String.format("File at %s does not exist or cannot be read", localFile.getAbsolutePath()));
588  }
589  localFiles.add(localFile);
590  }
591  return localFiles;
592  }
593 
611  private AbstractFile addLocalFile(CaseDbTransaction trans, SpecialDirectory parentDirectory, java.io.File localFile,
612  TskData.EncodingType encodingType, FileAddProgressUpdater progressUpdater) throws TskCoreException {
613  if (localFile.isDirectory()) {
614  /*
615  * Add the directory as a local directory.
616  */
617  LocalDirectory localDirectory = caseDb.addLocalDirectory(parentDirectory.getId(), localFile.getName(), trans);
618  progressUpdater.fileAdded(localDirectory);
619 
620  /*
621  * Add its children, if any.
622  */
623  final java.io.File[] childFiles = localFile.listFiles();
624  if (childFiles != null && childFiles.length > 0) {
625  for (java.io.File childFile : childFiles) {
626  addLocalFile(trans, localDirectory, childFile, progressUpdater);
627  }
628  }
629 
630  return localDirectory;
631  } else {
632  return caseDb.addLocalFile(localFile.getName(), localFile.getAbsolutePath(), localFile.length(),
633  0, 0, 0, 0,
634  localFile.isFile(), encodingType, parentDirectory, trans);
635  }
636  }
637 
644  @Deprecated
645  @Override
646  public synchronized void close() throws IOException {
647  /*
648  * No-op maintained for backwards compatibility. Clients should not
649  * attempt to close case services.
650  */
651  }
652 
671  @Deprecated
672  public synchronized VirtualDirectory addLocalFilesDirs(List<String> localFilePaths, FileAddProgressUpdater progressUpdater) throws TskCoreException {
673  if (null == caseDb) {
674  throw new TskCoreException("File manager has been closed");
675  }
676  try {
677  return addLocalFilesDataSource("", "", "", localFilePaths, progressUpdater).getRootDirectory();
678  } catch (TskDataException ex) {
679  throw new TskCoreException(ex.getLocalizedMessage(), ex);
680  }
681  }
682 
701  @Deprecated
702  public synchronized LayoutFile addCarvedFile(String fileName, long fileSize, long parentObjId, List<TskFileRange> layout) throws TskCoreException {
703  if (null == caseDb) {
704  throw new TskCoreException("File manager has been closed");
705  }
706  Content parent = caseDb.getContentById(parentObjId);
707  List<CarvingResult.CarvedFile> carvedFiles = new ArrayList<>();
708  carvedFiles.add(new CarvingResult.CarvedFile(fileName, fileSize, layout));
709  List<LayoutFile> layoutFiles = caseDb.addCarvedFiles(new CarvingResult(parent, carvedFiles));
710  return layoutFiles.get(0);
711  }
712 
728  @Deprecated
729  public synchronized List<LayoutFile> addCarvedFiles(List<org.sleuthkit.datamodel.CarvedFileContainer> filesToAdd) throws TskCoreException {
730  if (null == caseDb) {
731  throw new TskCoreException("File manager has been closed");
732  }
733  return caseDb.addCarvedFiles(filesToAdd);
734  }
735 
766  @Deprecated
767  public synchronized DerivedFile addDerivedFile(String fileName,
768  String localPath,
769  long size,
770  long ctime, long crtime, long atime, long mtime,
771  boolean isFile,
772  AbstractFile parentFile,
773  String rederiveDetails, String toolName, String toolVersion, String otherDetails) throws TskCoreException {
774  return addDerivedFile(fileName, localPath, size, ctime, crtime, atime, mtime, isFile, parentFile,
775  rederiveDetails, toolName, toolVersion, otherDetails, TskData.EncodingType.NONE);
776  }
777 
797  @Deprecated
798  private AbstractFile addLocalFile(CaseDbTransaction trans, SpecialDirectory parentDirectory, java.io.File localFile, FileAddProgressUpdater progressUpdater) throws TskCoreException {
799  return addLocalFile(trans, parentDirectory, localFile, TskData.EncodingType.NONE, progressUpdater);
800  }
801 
802 }
static String createFileTypeInCondition(Collection< String > mimeTypes)
synchronized List< AbstractFile > findFilesExactName(long parentId, String name)
synchronized VirtualDirectory addLocalFilesDirs(List< String > localFilePaths, FileAddProgressUpdater progressUpdater)
synchronized LayoutFile addCarvedFile(String fileName, long fileSize, long parentObjId, List< TskFileRange > layout)
synchronized List< AbstractFile > findFiles(String fileName, String parentSubString)
synchronized List< AbstractFile > findFiles(Content dataSource, String fileName)
synchronized DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, Content parentObj, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType)
synchronized DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parentFile, String rederiveDetails, String toolName, String toolVersion, String otherDetails)
AbstractFile addLocalFile(CaseDbTransaction trans, SpecialDirectory parentDirectory, java.io.File localFile, FileAddProgressUpdater progressUpdater)
synchronized List< AbstractFile > findFilesByMimeType(Collection< String > mimeTypes)
synchronized List< LayoutFile > addCarvedFiles(List< org.sleuthkit.datamodel.CarvedFileContainer > filesToAdd)
synchronized List< AbstractFile > openFiles(Content dataSource, String filePath)
static String createParentPathCondition(long dataSourceObjectID, String parentPath)
synchronized LocalFilesDataSource addLocalFilesDataSource(String deviceId, String rootVirtualDirectoryName, String timeZone, List< String > localFilePaths, FileAddProgressUpdater progressUpdater)
static synchronized String generateFilesDataSourceName(SleuthkitCase caseDb)
synchronized List< AbstractFile > findFilesByMimeType(Content dataSource, Collection< String > mimeTypes)
synchronized List< AbstractFile > findFilesByParentPath(long dataSourceObjectID, String parentPath)
void fireModuleContentEvent(ModuleContentEvent moduleContentEvent)
synchronized List< AbstractFile > findFiles(String fileName)
AbstractFile addLocalFile(CaseDbTransaction trans, SpecialDirectory parentDirectory, java.io.File localFile, TskData.EncodingType encodingType, FileAddProgressUpdater progressUpdater)
synchronized static Logger getLogger(String name)
Definition: Logger.java:124
synchronized List< LayoutFile > addCarvedFiles(CarvingResult carvingResult)
synchronized DerivedFile updateDerivedFile(DerivedFile derivedFile, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, String mimeType, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType)
synchronized List< AbstractFile > findFiles(Content dataSource, String fileName, String parentSubString)
synchronized List< AbstractFile > findFiles(Content dataSource, String fileName, AbstractFile parent)
synchronized List< AbstractFile > findFiles(String fileName, AbstractFile parent)
List< java.io.File > getFilesAndDirectories(List< String > localFilePaths)
static synchronized IngestServices getInstance()

Copyright © 2012-2021 Basis Technology. Generated on: Tue Jan 19 2021
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.