FileType.java

Go to the documentation of this file.

/*
 * Autopsy Forensic Browser
 *
 * Copyright 2014-2018 Basis Technology Corp.
 * Contact: carrier <at> sleuthkit <dot> org
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.sleuthkit.autopsy.modules.filetypeid;

import java.io.Serializable;
import java.io.UnsupportedEncodingException;
import java.nio.charset.StandardCharsets;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collections;
import java.util.List;
import java.util.Objects;
import java.util.logging.Level;
import javax.swing.JOptionPane;
import javax.xml.bind.DatatypeConverter;
import org.openide.windows.WindowManager;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.TskCoreException;

class FileType implements Serializable {

    private static final long serialVersionUID = 1L;
    private final String mimeType;
    private final List<Signature> signatures;
    private final boolean createInterestingFileHit;
    private final String interestingFilesSetName;

    FileType(String mimeType, List<Signature> signatures) throws IllegalArgumentException {
        this(mimeType, signatures, false, "");
    }

    FileType(String mimeType, List<Signature> signatures, boolean createInterestingFileHit, String setName) throws IllegalArgumentException {
        if (signatures.isEmpty()) {
            throw new IllegalArgumentException("Must have at least one signature.");
        }
        this.mimeType = mimeType;
        this.signatures = new ArrayList<>(signatures);
        this.createInterestingFileHit = createInterestingFileHit;
        this.interestingFilesSetName = setName;
    }

    String getMimeType() {
        return mimeType;
    }

    String getInterestingFilesSetName() {
        return interestingFilesSetName;
    }

    boolean shouldCreateInterestingFileHit() {
        return createInterestingFileHit;
    }

    List<Signature> getSignatures() {
        return Collections.unmodifiableList(this.signatures);
    }

    void addSignature(Signature sig) {
        this.signatures.add(sig);
    }

    boolean matches(final AbstractFile file) {
        for (Signature sig : this.signatures) {
            if (!sig.containedIn(file)) {
                return false;
            }
        }
        return true;
    }

    @Override
    public String toString() {
        return this.mimeType;
    }

    @Override
    public boolean equals(Object other) {
        if (other != null && other instanceof FileType) {
            FileType that = (FileType) other;
            if (this.getMimeType().equals(that.getMimeType()) && this.getSignatures().equals(that.getSignatures())) {
                return true;
            }
        }
        return false;
    }

    @Override
    public int hashCode() {
        int hash = 7;
        hash = 67 * hash + Objects.hashCode(this.mimeType);
        hash = 67 * hash + Objects.hashCode(this.signatures);
        return hash;
    }

    static class Signature implements Serializable {

        private static final long serialVersionUID = 1L;
        private static final Logger logger = Logger.getLogger(Signature.class.getName());

        enum Type {

            RAW, ASCII
        };

        private final byte[] signatureBytes;
        private final long offset;
        private final Type type;
        private final boolean isRelativeToStart;

        Signature(final byte[] signatureBytes, long offset, Type type) {
            this.signatureBytes = Arrays.copyOf(signatureBytes, signatureBytes.length);
            this.offset = offset;
            this.type = type;
            this.isRelativeToStart = true;
        }

        Signature(String signatureString, long offset) {
            this.signatureBytes = signatureString.getBytes(StandardCharsets.US_ASCII);
            this.offset = offset;
            this.type = Type.ASCII;
            this.isRelativeToStart = true;
        }

        Signature(final byte[] signatureBytes, long offset) {
            this.signatureBytes = Arrays.copyOf(signatureBytes, signatureBytes.length);
            this.offset = offset;
            this.type = Type.RAW;
            this.isRelativeToStart = true;
        }

        Signature(final byte[] signatureBytes, long offset, Type type, boolean isRelativeToStart) {
            this.signatureBytes = Arrays.copyOf(signatureBytes, signatureBytes.length);
            this.offset = offset;
            this.type = type;
            this.isRelativeToStart = isRelativeToStart;
        }

        Signature(String signatureString, long offset, boolean isRelativeToStart) {
            this.signatureBytes = signatureString.getBytes(StandardCharsets.US_ASCII);
            this.offset = offset;
            this.type = Type.ASCII;
            this.isRelativeToStart = isRelativeToStart;
        }

        Signature(final byte[] signatureBytes, long offset, boolean isRelativeToStart) {
            this.signatureBytes = Arrays.copyOf(signatureBytes, signatureBytes.length);
            this.offset = offset;
            this.type = Type.RAW;
            this.isRelativeToStart = isRelativeToStart;
        }

        byte[] getSignatureBytes() {
            return Arrays.copyOf(signatureBytes, signatureBytes.length);
        }

        long getOffset() {
            return offset;
        }

        Type getType() {
            return type;
        }

        boolean isRelativeToStart() {
            return isRelativeToStart;
        }

        boolean containedIn(final AbstractFile file) {
            if (offset >= file.getSize()) {
                return false; // File is too small, offset lies outside file.
            }
            long actualOffset = offset;
            if (!isRelativeToStart) {
                actualOffset = file.getSize() - 1 - offset;
            }
            if (file.getSize() < (actualOffset + signatureBytes.length)) {
                return false; 
            }
            try {
                byte[] buffer = new byte[signatureBytes.length];
                int bytesRead = file.read(buffer, actualOffset, signatureBytes.length);
                return ((bytesRead == signatureBytes.length) && (Arrays.equals(buffer, signatureBytes)));
            } catch (TskCoreException ex) {
                Signature.logger.log(Level.WARNING, "Error reading from file with objId = " + file.getId(), ex); //NON-NLS
                return false;
            }
        }

        @Override
        public boolean equals(Object other) {
            if (other != null && other instanceof Signature) {
                Signature that = (Signature) other;
                if (Arrays.equals(this.getSignatureBytes(), that.getSignatureBytes())
                        && this.getOffset() == that.getOffset()
                        && this.getType().equals(that.getType())) {
                    return true;
                }
            }
            return false;
        }

        @Override
        public int hashCode() {
            int hash = 3;
            hash = 97 * hash + Arrays.hashCode(this.signatureBytes);
            hash = 97 * hash + (int) (this.offset ^ (this.offset >>> 32));
            hash = 97 * hash + Objects.hashCode(this.type);
            return hash;
        }

        @Override
        public String toString() {
            String signatureBytesString;
            if (Signature.Type.RAW == this.getType()) {
                signatureBytesString = DatatypeConverter.printHexBinary(this.getSignatureBytes());
                signatureBytesString = "0x" + signatureBytesString;
            } else {
                try {
                    signatureBytesString = new String(this.getSignatureBytes(), "UTF-8");
                } catch (UnsupportedEncodingException ex) {
                    JOptionPane.showMessageDialog(WindowManager.getDefault().getMainWindow(),
                            ex.getLocalizedMessage(),
                            Bundle.AddFileTypeSignaturePanel_signatureStringFail_text(),
                            JOptionPane.ERROR_MESSAGE);
                    signatureBytesString = "";
                }
            }
            String startOrEnd;
            if (this.isRelativeToStart) {
                startOrEnd = "start";
            } else {
                startOrEnd = "end";
            }
            return signatureBytesString + ", " + offset + " bytes from " + startOrEnd;

        }
    }

}