Autopsy  4.19.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
EXIFProcessor.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2020-2021 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.modules.pictureanalyzer.impls;
20 
21 import com.drew.imaging.ImageMetadataReader;
22 import com.drew.imaging.ImageProcessingException;
23 import com.drew.lang.GeoLocation;
24 import com.drew.lang.Rational;
25 import com.drew.metadata.Metadata;
26 import com.drew.metadata.exif.ExifIFD0Directory;
27 import com.drew.metadata.exif.ExifSubIFDDirectory;
28 import com.drew.metadata.exif.GpsDirectory;
29 import java.io.BufferedInputStream;
30 import java.io.IOException;
31 import java.util.ArrayList;
32 import java.util.Arrays;
33 import java.util.Collection;
34 import java.util.Date;
35 import java.util.Set;
36 import java.util.HashSet;
37 import java.util.List;
38 import java.util.TimeZone;
39 import java.util.logging.Level;
40 import org.apache.commons.lang3.StringUtils;
41 import org.openide.util.NbBundle;
42 import org.openide.util.lookup.ServiceProvider;
46 import org.sleuthkit.datamodel.AbstractFile;
49 import org.sleuthkit.datamodel.Blackboard;
50 import org.sleuthkit.datamodel.BlackboardArtifact;
51 import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF;
52 import org.sleuthkit.datamodel.BlackboardAttribute;
53 import static org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
54 import org.sleuthkit.datamodel.Content;
55 import org.sleuthkit.datamodel.Image;
56 import org.sleuthkit.datamodel.ReadContentInputStream;
57 import org.sleuthkit.datamodel.TskCoreException;
59 import org.sleuthkit.datamodel.Score;
60 
67 @ServiceProvider(service = PictureProcessor.class)
68 public class EXIFProcessor implements PictureProcessor {
69 
70  private static final Logger logger = Logger.getLogger(EXIFProcessor.class.getName());
71  private static final BlackboardArtifact.Type EXIF_METADATA = new BlackboardArtifact.Type(TSK_METADATA_EXIF);
72 
73  @Override
74  @NbBundle.Messages({
75  "ExifProcessor.userContent.description=EXIF metadata data exists for this file."
76  })
77  public void process(IngestJobContext context, AbstractFile file) {
78  final String MODULE_NAME = PictureAnalyzerIngestModuleFactory.getModuleName();
79 
80  try (BufferedInputStream bin = new BufferedInputStream(new ReadContentInputStream(file));) {
81 
82  final Collection<BlackboardAttribute> attributes = new ArrayList<>();
83  final Metadata metadata = ImageMetadataReader.readMetadata(bin);
84 
85  // Date
86  final ExifSubIFDDirectory exifDir = metadata.getFirstDirectoryOfType(ExifSubIFDDirectory.class);
87  if (exifDir != null) {
88 
89  // set the timeZone for the current datasource.
90  TimeZone timeZone = null;
91  try {
92  Content dataSource = file.getDataSource();
93  if ((dataSource != null) && (dataSource instanceof Image)) {
94  Image image = (Image) dataSource;
95  timeZone = TimeZone.getTimeZone(image.getTimeZone());
96  }
97  } catch (TskCoreException ex) {
98  logger.log(Level.INFO, "Error getting time zones", ex); //NON-NLS
99  }
100 
101  final Date date = exifDir.getDate(ExifSubIFDDirectory.TAG_DATETIME_ORIGINAL, timeZone);
102  if (date != null) {
103  attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME_CREATED, MODULE_NAME, date.getTime() / 1000));
104  }
105  }
106 
107  if (context.fileIngestIsCancelled()) {
108  return;
109  }
110 
111  // GPS Stuff
112  final GpsDirectory gpsDir = metadata.getFirstDirectoryOfType(GpsDirectory.class);
113  if (gpsDir != null) {
114  final GeoLocation loc = gpsDir.getGeoLocation();
115  if (loc != null) {
116  attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_GEO_LATITUDE, MODULE_NAME, loc.getLatitude()));
117  attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE, MODULE_NAME, loc.getLongitude()));
118  }
119 
120  final Rational altitude = gpsDir.getRational(GpsDirectory.TAG_ALTITUDE);
121  if (altitude != null) {
122  attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE, MODULE_NAME, altitude.doubleValue()));
123  }
124  }
125 
126  if (context.fileIngestIsCancelled()) {
127  return;
128  }
129 
130  // Device info
131  final ExifIFD0Directory devDir = metadata.getFirstDirectoryOfType(ExifIFD0Directory.class);
132  if (devDir != null) {
133  final String model = devDir.getString(ExifIFD0Directory.TAG_MODEL);
134  if (StringUtils.isNotBlank(model)) {
135  attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DEVICE_MODEL, MODULE_NAME, model));
136  }
137 
138  final String make = devDir.getString(ExifIFD0Directory.TAG_MAKE);
139  if (StringUtils.isNotBlank(make)) {
140  attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DEVICE_MAKE, MODULE_NAME, make));
141  }
142  }
143 
144  if (context.fileIngestIsCancelled()) {
145  return;
146  }
147 
148  final Blackboard blackboard = Case.getCurrentCaseThrows().getSleuthkitCase().getBlackboard();
149 
150  if (!attributes.isEmpty() && !blackboard.artifactExists(file, TSK_METADATA_EXIF, attributes)) {
151  List<BlackboardArtifact> artifacts = new ArrayList<>();
152  final BlackboardArtifact exifArtifact = (file.newAnalysisResult(
153  BlackboardArtifact.Type.TSK_METADATA_EXIF,
154  Score.SCORE_NONE,
155  null, null, null,
156  attributes)).getAnalysisResult();
157  artifacts.add(exifArtifact);
158 
159  final BlackboardArtifact userSuspectedArtifact = file.newAnalysisResult(
160  BlackboardArtifact.Type.TSK_USER_CONTENT_SUSPECTED,
161  Score.SCORE_UNKNOWN,
162  null, null, null,
163  Arrays.asList(new BlackboardAttribute(
164  BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT,
165  MODULE_NAME,
166  Bundle.ExifProcessor_userContent_description())))
167  .getAnalysisResult();
168  artifacts.add(userSuspectedArtifact);
169 
170  try {
171  blackboard.postArtifacts(artifacts, MODULE_NAME);
172  } catch (Blackboard.BlackboardException ex) {
173  logger.log(Level.SEVERE, String.format("Error posting TSK_METADATA_EXIF and TSK_USER_CONTENT_SUSPECTED artifacts for %s (object ID = %d)", file.getName(), file.getId()), ex); //NON-NLS
174  }
175  }
176  } catch (TskCoreException ex) {
177  logger.log(Level.SEVERE, String.format("Error creating TSK_METADATA_EXIF and TSK_USER_CONTENT_SUSPECTED artifacts for %s (object ID = %d)", file.getName(), file.getId()), ex); //NON-NLS
178  } catch (IOException | ImageProcessingException ex) {
179  logger.log(Level.WARNING, String.format("Error parsing %s (object ID = %d), presumed corrupt", file.getName(), file.getId()), ex); //NON-NLS
180  } catch (NoCurrentCaseException ex) {
181  logger.log(Level.SEVERE, String.format("Error processing %s (object ID = %d)", file.getName(), file.getId()), ex); //NON-NLS
182  }
183  }
184 
185  @Override
186  public Set<String> mimeTypes() {
187  return new HashSet<String>() {
188  {
189  add("audio/x-wav");
190  add("image/jpeg");
191  add("image/tiff");
192  }
193  };
194  }
195 }
void process(IngestJobContext context, AbstractFile file)
synchronized static Logger getLogger(String name)
Definition: Logger.java:124

Copyright © 2012-2021 Basis Technology. Generated on: Fri Aug 6 2021
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.