Autopsy  4.17.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
Metadata.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2013-2018 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.contentviewers;
20 
21 import java.awt.Component;
22 import java.util.List;
23 import java.util.logging.Level;
24 import org.apache.commons.lang3.StringUtils;
25 import org.openide.nodes.Node;
26 import org.openide.util.NbBundle;
27 import org.openide.util.NbBundle.Messages;
28 import org.openide.util.lookup.ServiceProvider;
32 import org.sleuthkit.datamodel.AbstractFile;
33 import org.sleuthkit.datamodel.BlackboardArtifact;
34 import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
35 import org.sleuthkit.datamodel.BlackboardAttribute;
36 import org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
37 import org.sleuthkit.datamodel.DataSource;
38 import org.sleuthkit.datamodel.Image;
39 import org.sleuthkit.datamodel.FsContent;
40 import org.sleuthkit.datamodel.TskCoreException;
41 import org.sleuthkit.datamodel.TskData.TSK_DB_FILES_TYPE_ENUM;
42 
48 @ServiceProvider(service = DataContentViewer.class, position = 6)
49 @SuppressWarnings("PMD.SingularField") // UI widgets cause lots of false positives
50 public class Metadata extends javax.swing.JPanel implements DataContentViewer {
51 
52  private static final Logger LOGGER = Logger.getLogger(Metadata.class.getName());
53 
57  public Metadata() {
58  initComponents();
59  customizeComponents();
60  }
61 
67  @SuppressWarnings("unchecked")
68  // <editor-fold defaultstate="collapsed" desc="Generated Code">//GEN-BEGIN:initComponents
69  private void initComponents() {
70 
71  jPopupMenu1 = new javax.swing.JPopupMenu();
72  jScrollPane2 = new javax.swing.JScrollPane();
73  jTextPane1 = new javax.swing.JTextPane();
74 
75  setPreferredSize(new java.awt.Dimension(100, 52));
76 
77  jScrollPane2.setHorizontalScrollBarPolicy(javax.swing.ScrollPaneConstants.HORIZONTAL_SCROLLBAR_ALWAYS);
78  jScrollPane2.setVerticalScrollBarPolicy(javax.swing.ScrollPaneConstants.VERTICAL_SCROLLBAR_ALWAYS);
79  jScrollPane2.setPreferredSize(new java.awt.Dimension(610, 52));
80 
81  jTextPane1.setEditable(false);
82  jTextPane1.setPreferredSize(new java.awt.Dimension(600, 52));
83  jScrollPane2.setViewportView(jTextPane1);
84 
85  javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this);
86  this.setLayout(layout);
87  layout.setHorizontalGroup(
88  layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
89  .addComponent(jScrollPane2, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
90  );
91  layout.setVerticalGroup(
92  layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
93  .addComponent(jScrollPane2, javax.swing.GroupLayout.DEFAULT_SIZE, javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE)
94  );
95  }// </editor-fold>//GEN-END:initComponents
96  // Variables declaration - do not modify//GEN-BEGIN:variables
97  private javax.swing.JPopupMenu jPopupMenu1;
98  private javax.swing.JScrollPane jScrollPane2;
99  private javax.swing.JTextPane jTextPane1;
100  // End of variables declaration//GEN-END:variables
101 
102  private void customizeComponents() {
103  /*
104  * jTextPane1.setComponentPopupMenu(rightClickMenu); ActionListener
105  * actList = new ActionListener(){ @Override public void
106  * actionPerformed(ActionEvent e){ JMenuItem jmi = (JMenuItem)
107  * e.getSource(); if(jmi.equals(copyMenuItem)) outputViewPane.copy();
108  * else if(jmi.equals(selectAllMenuItem)) outputViewPane.selectAll(); }
109  * }; copyMenuItem.addActionListener(actList);
110  * selectAllMenuItem.addActionListener(actList);
111  */
112 
114  }
115 
116  private void setText(String str) {
117  jTextPane1.setText("<html><body>" + str + "</body></html>"); //NON-NLS
118  }
119 
120  private void startTable(StringBuilder sb) {
121  sb.append("<table>"); //NON-NLS
122  }
123 
124  private void endTable(StringBuilder sb) {
125  sb.append("</table>"); //NON-NLS
126  }
127 
128  private void addRow(StringBuilder sb, String key, String value) {
129  sb.append("<tr><td valign=\"top\">"); //NON-NLS
130  sb.append(key);
131  sb.append("</td><td>"); //NON-NLS
132  sb.append(value);
133  sb.append("</td></tr>"); //NON-NLS
134  }
135 
136  @Messages({
137  "Metadata.tableRowTitle.mimeType=MIME Type",
138  "Metadata.nodeText.truncated=(results truncated)",
139  "Metadata.tableRowTitle.sha1=SHA1",
140  "Metadata.tableRowTitle.sha256=SHA-256",
141  "Metadata.tableRowTitle.imageType=Type",
142  "Metadata.tableRowTitle.sectorSize=Sector Size",
143  "Metadata.tableRowTitle.timezone=Time Zone",
144  "Metadata.tableRowTitle.deviceId=Device ID",
145  "Metadata.tableRowTitle.acquisitionDetails=Acquisition Details",
146  "Metadata.tableRowTitle.downloadSource=Downloaded From",
147  "Metadata.nodeText.unknown=Unknown",
148  "Metadata.nodeText.none=None"})
149  @Override
150  public void setNode(Node node) {
151  AbstractFile file = node.getLookup().lookup(AbstractFile.class);
152  Image image = node.getLookup().lookup(Image.class);
153  DataSource dataSource = node.getLookup().lookup(DataSource.class);
154  if (file == null && image == null) {
155  setText(NbBundle.getMessage(this.getClass(), "Metadata.nodeText.nonFilePassedIn"));
156  return;
157  }
158 
159  StringBuilder sb = new StringBuilder();
160  startTable(sb);
161 
162  if (file != null) {
163  try {
164  addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.name"), file.getUniquePath());
165  } catch (TskCoreException ex) {
166  addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.name"), file.getParentPath() + "/" + file.getName());
167  }
168 
169  addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.type"), file.getType().getName());
170  addRow(sb, Bundle.Metadata_tableRowTitle_mimeType(), file.getMIMEType());
171  addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.size"), Long.toString(file.getSize()));
172  addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.fileNameAlloc"), file.getDirFlagAsString());
173  addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.metadataAlloc"), file.getMetaFlagsAsString());
174  addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.modified"), ContentUtils.getStringTime(file.getMtime(), file));
175  addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.accessed"), ContentUtils.getStringTime(file.getAtime(), file));
176  addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.created"), ContentUtils.getStringTime(file.getCrtime(), file));
177  addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.changed"), ContentUtils.getStringTime(file.getCtime(), file));
178 
179 
180  String md5 = file.getMd5Hash();
181  if (md5 == null) {
182  md5 = NbBundle.getMessage(this.getClass(), "Metadata.tableRowContent.md5notCalc");
183  }
184  addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.md5"), md5);
185  String sha256 = file.getSha256Hash();
186  if (sha256 == null) {
187  sha256 = NbBundle.getMessage(this.getClass(), "Metadata.tableRowContent.md5notCalc");
188  }
189  addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.sha256"), sha256);
190  addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.hashLookupResults"), file.getKnown().toString());
191  addAcquisitionDetails(sb, dataSource);
192 
193  addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.internalid"), Long.toString(file.getId()));
194  if (file.getType().compareTo(TSK_DB_FILES_TYPE_ENUM.LOCAL) == 0) {
195  addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.localPath"), file.getLocalAbsPath());
196  }
197 
198  try {
199  List<BlackboardArtifact> associatedObjectArtifacts = file.getArtifacts(ARTIFACT_TYPE.TSK_ASSOCIATED_OBJECT);
200  if (!associatedObjectArtifacts.isEmpty()) {
201  BlackboardArtifact artifact = associatedObjectArtifacts.get(0);
202  BlackboardAttribute associatedArtifactAttribute = artifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT));
203  if (associatedArtifactAttribute != null) {
204  long artifactId = associatedArtifactAttribute.getValueLong();
205  BlackboardArtifact associatedArtifact = artifact.getSleuthkitCase().getBlackboardArtifact(artifactId);
206  addDownloadSourceRow(sb, associatedArtifact);
207  }
208  }
209  } catch (TskCoreException ex) {
210  sb.append(NbBundle.getMessage(this.getClass(), "Metadata.nodeText.exceptionNotice.text")).append(ex.getLocalizedMessage());
211  }
212 
213  endTable(sb);
214 
215  /*
216  * If we have a file system file, grab the more detailed metadata text
217  * too
218  */
219  try {
220  if (file instanceof FsContent) {
221  FsContent fsFile = (FsContent) file;
222 
223  sb.append("<hr /><pre>\n"); //NON-NLS
224  sb.append(NbBundle.getMessage(this.getClass(), "Metadata.nodeText.text"));
225  sb.append(" <br /><br />"); // NON-NLS
226  for (String str : fsFile.getMetaDataText()) {
227  sb.append(str).append("<br />"); //NON-NLS
228 
229  /*
230  * Very long results can cause the UI to hang before displaying,
231  * so truncate the results if necessary.
232  */
233  if(sb.length() > 50000){
234  sb.append(NbBundle.getMessage(this.getClass(), "Metadata.nodeText.truncated"));
235  break;
236  }
237  }
238  sb.append("</pre>\n"); //NON-NLS
239  }
240  } catch (TskCoreException ex) {
241  sb.append(NbBundle.getMessage(this.getClass(), "Metadata.nodeText.exceptionNotice.text")).append(ex.getLocalizedMessage());
242  }
243  } else {
244  try {
245  addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.name"), image.getUniquePath());
246  } catch (TskCoreException ex) {
247  addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.name"), image.getName());
248  }
249  addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.imageType"), image.getType().getName());
250  addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.size"), Long.toString(image.getSize()));
251 
252  try {
253  String md5 = image.getMd5();
254  if (md5 == null || md5.isEmpty()) {
255  md5 = NbBundle.getMessage(this.getClass(), "Metadata.tableRowContent.md5notCalc");
256  }
257  addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.md5"), md5);
258 
259  String sha1 = image.getSha1();
260  if (sha1 == null || sha1.isEmpty()) {
261  sha1 = NbBundle.getMessage(this.getClass(), "Metadata.tableRowContent.md5notCalc");
262  }
263  addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.sha1"), sha1);
264 
265  String sha256 = image.getSha256();
266  if (sha256 == null || sha256.isEmpty()) {
267  sha256 = NbBundle.getMessage(this.getClass(), "Metadata.tableRowContent.md5notCalc");
268  }
269  addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.sha256"), sha256);
270  } catch (TskCoreException ex) {
271  sb.append(NbBundle.getMessage(this.getClass(), "Metadata.nodeText.exceptionNotice.text")).append(ex.getLocalizedMessage());
272  }
273  addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.sectorSize"), Long.toString(image.getSsize()));
274  addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.timezone"), image.getTimeZone());
275  addAcquisitionDetails(sb, dataSource);
276  addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.deviceId"), image.getDeviceId());
277  addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.internalid"), Long.toString(image.getId()));
278 
279  // Add all the data source paths to the "Local Path" value cell.
280  String[] imagePaths = image.getPaths();
281  if (imagePaths.length > 0) {
282  StringBuilder pathValues = new StringBuilder("<div>");
283  pathValues.append(imagePaths[0]);
284  pathValues.append("</div>");
285  for (int i=1; i < imagePaths.length; i++) {
286  pathValues.append("<div>");
287  pathValues.append(imagePaths[i]);
288  pathValues.append("</div>");
289  }
290  addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.localPath"), pathValues.toString());
291  } else {
292  addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.localPath"),
293  NbBundle.getMessage(this.getClass(), "Metadata.nodeText.none"));
294  }
295  }
296 
297  setText(sb.toString());
298  jTextPane1.setCaretPosition(0);
299  this.setCursor(null);
300  }
301 
311  private void addDownloadSourceRow(StringBuilder sb, BlackboardArtifact associatedArtifact ) throws TskCoreException {
312  if (associatedArtifact != null &&
313  ((associatedArtifact.getArtifactTypeID() == ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID()) ||
314  (associatedArtifact.getArtifactTypeID() == ARTIFACT_TYPE.TSK_WEB_CACHE.getTypeID())) ) {
315  BlackboardAttribute urlAttr = associatedArtifact.getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_URL));
316  if (urlAttr != null) {
317  addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.downloadSource"), urlAttr.getValueString());
318  }
319  }
320  }
321 
328  private void addAcquisitionDetails(StringBuilder sb, DataSource dataSource) {
329  if (dataSource != null) {
330  try {
331  String details = dataSource.getAcquisitionDetails();
332  if (StringUtils.isEmpty(details)) {
333  details = Bundle.Metadata_nodeText_unknown();
334  }
335  details = details.replaceAll("\n", "<br>");
336  addRow(sb, NbBundle.getMessage(this.getClass(), "Metadata.tableRowTitle.acquisitionDetails"), details);
337  } catch (TskCoreException ex) {
338  LOGGER.log(Level.SEVERE, "Error reading acquisition details from case database", ex); //NON-NLS
339  }
340  }
341  }
342 
343  @Override
344  public String getTitle() {
345  return NbBundle.getMessage(this.getClass(), "Metadata.title");
346  }
347 
348  @Override
349  public String getToolTip() {
350  return NbBundle.getMessage(this.getClass(), "Metadata.toolTip");
351  }
352 
353  @Override
354  public DataContentViewer createInstance() {
355  return new Metadata();
356  }
357 
358  @Override
359  public Component getComponent() {
360  return this;
361  }
362 
363  @Override
364  public void resetComponent() {
365  setText("");
366  }
367 
368  @Override
369  public boolean isSupported(Node node) {
370  Image image = node.getLookup().lookup(Image.class);
371  AbstractFile file = node.getLookup().lookup(AbstractFile.class);
372  return (file != null) || (image != null);
373  }
374 
375  @Override
376  public int isPreferred(Node node) {
377  return 1;
378  }
379 }
static String getStringTime(long epochSeconds, TimeZone tzone)
void addRow(StringBuilder sb, String key, String value)
Definition: Metadata.java:128
void addAcquisitionDetails(StringBuilder sb, DataSource dataSource)
Definition: Metadata.java:328
static void configureTextPaneAsHtml(JTextPane pane)
Definition: Utilities.java:32
void addDownloadSourceRow(StringBuilder sb, BlackboardArtifact associatedArtifact)
Definition: Metadata.java:311
synchronized static Logger getLogger(String name)
Definition: Logger.java:124

Copyright © 2012-2021 Basis Technology. Generated on: Tue Jan 19 2021
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.