Autopsy  4.19.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
RecentDocumentsByLnk.java
Go to the documentation of this file.
1  /*
2  *
3  * Autopsy Forensic Browser
4  *
5  * Copyright 2012-2021 Basis Technology Corp.
6  *
7  * Copyright 2012 42six Solutions.
8  * Contact: aebadirad <at> 42six <dot> com
9  * Project Contact/Architect: carrier <at> sleuthkit <dot> org
10  *
11  * Licensed under the Apache License, Version 2.0 (the "License");
12  * you may not use this file except in compliance with the License.
13  * You may obtain a copy of the License at
14  *
15  * http://www.apache.org/licenses/LICENSE-2.0
16  *
17  * Unless required by applicable law or agreed to in writing, software
18  * distributed under the License is distributed on an "AS IS" BASIS,
19  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
20  * See the License for the specific language governing permissions and
21  * limitations under the License.
22  */
23 package org.sleuthkit.autopsy.recentactivity;
24 
25 import java.io.File;
26 import java.util.ArrayList;
27 import java.util.List;
28 import java.util.logging.Level;
29 import org.apache.commons.io.FilenameUtils;
30 import org.openide.util.NbBundle;
32 import java.util.Collection;
33 import java.util.HashMap;
34 import org.openide.util.NbBundle.Messages;
40 import org.sleuthkit.datamodel.BlackboardArtifact;
41 import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
42 import org.sleuthkit.datamodel.BlackboardAttribute;
43 import org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
44 import org.sleuthkit.datamodel.Content;
45 import org.sleuthkit.datamodel.TskCoreException;
46 import org.sleuthkit.datamodel.AbstractFile;
47 import org.sleuthkit.datamodel.ReadContentInputStream;
48 import org.sleuthkit.datamodel.TskData;
49 
54 class RecentDocumentsByLnk extends Extract {
55 
56  private static final Logger logger = Logger.getLogger(RecentDocumentsByLnk.class.getName());
57  private Content dataSource;
58  private IngestJobContext context;
59 
60  @Messages({
61  "Progress_Message_Extract_Resent_Docs=Recent Documents",
62  })
63 
71  private void getRecentDocuments() {
72 
73  org.sleuthkit.autopsy.casemodule.services.FileManager fileManager = currentCase.getServices().getFileManager();
74  List<AbstractFile> recentFiles;
75  try {
76  recentFiles = fileManager.findFiles(dataSource, "%.lnk", "Recent"); //NON-NLS
77  } catch (TskCoreException ex) {
78  logger.log(Level.WARNING, "Error searching for .lnk files."); //NON-NLS
79  this.addErrorMessage(
80  NbBundle.getMessage(this.getClass(), "RecentDocumentsByLnk.getRecDoc.errMsg.errGetLnkFiles",
81  this.getName()));
82  return;
83  }
84 
85  if (recentFiles.isEmpty()) {
86  logger.log(Level.INFO, "Didn't find any recent files."); //NON-NLS
87  return;
88  }
89 
90  dataFound = true;
91  List<BlackboardArtifact> bbartifacts = new ArrayList<>();
92  HashMap<String, String> recentFileMap = new HashMap<>();
93  for (AbstractFile recentFile : recentFiles) {
94  if (context.dataSourceIngestIsCancelled()) {
95  break;
96  }
97 
98  if (recentFile.getSize() == 0) {
99  continue;
100  }
101  JLNK lnk;
102  JLnkParser lnkParser = new JLnkParser(new ReadContentInputStream(recentFile), (int) recentFile.getSize());
103  try {
104  lnk = lnkParser.parse();
105  } catch (JLnkParserException e) {
106  //TODO should throw a specific checked exception
107  boolean unalloc = recentFile.isMetaFlagSet(TskData.TSK_FS_META_FLAG_ENUM.UNALLOC)
108  || recentFile.isDirNameFlagSet(TskData.TSK_FS_NAME_FLAG_ENUM.UNALLOC);
109  if (unalloc == false) {
110  logger.log(Level.WARNING, "Error lnk parsing the file to get recent files {0}", recentFile); //NON-NLS
111  }
112  continue;
113  }
114 
115  Collection<BlackboardAttribute> bbattributes = new ArrayList<>();
116  String path = lnk.getBestPath();
117  if (recentFileMap.get(path + File.separator + recentFile.getName()) == null) {
118  recentFileMap.put(path + File.separator + recentFile.getName(), recentFile.getName());
119  bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PATH,
120  NbBundle.getMessage(this.getClass(),
121  "RecentDocumentsByLnk.parentModuleName.noSpace"),
122  path));
123  bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PATH_ID,
124  NbBundle.getMessage(this.getClass(),
125  "RecentDocumentsByLnk.parentModuleName.noSpace"),
126  Util.findID(dataSource, path)));
127  bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED,
128  NbBundle.getMessage(this.getClass(),
129  "RecentDocumentsByLnk.parentModuleName.noSpace"),
130  recentFile.getCrtime()));
131  try{
132  BlackboardArtifact bba = createArtifactWithAttributes(ARTIFACT_TYPE.TSK_RECENT_OBJECT, recentFile, bbattributes);
133  if(bba != null) {
134  bbartifacts.add(bba);
135  bba = createAssociatedArtifact(path, bba);
136  if (bba != null) {
137  bbartifacts.add(bba);
138  }
139  }
140  } catch(TskCoreException ex) {
141  logger.log(Level.SEVERE, String.format("Failed to create TSK_RECENT_OBJECT artifact for file %d", recentFile.getId()), ex);
142  }
143  }
144  }
145 
146  if (!context.dataSourceIngestIsCancelled()) {
147  postArtifacts(bbartifacts);
148  }
149  }
150 
160  private BlackboardArtifact createAssociatedArtifact(String filePathName, BlackboardArtifact bba) {
161  String normalizePathName = FilenameUtils.normalize(filePathName, true);
162  String fileName = FilenameUtils.getName(normalizePathName);
163  String filePath = FilenameUtils.getPath(normalizePathName);
164  List<AbstractFile> sourceFiles;
165  try {
166  sourceFiles = currentCase.getSleuthkitCase().getFileManager().findFilesExactNameExactPath(dataSource, fileName, filePath);
167  for (AbstractFile sourceFile : sourceFiles) {
168  if (sourceFile.getParentPath().endsWith(filePath)) {
169  return createAssociatedArtifact(sourceFile, bba);
170  }
171  }
172  } catch (TskCoreException ex) {
173  logger.log(Level.WARNING, String.format("Error finding actual file %s. file may not exist", filePathName), ex); //NON-NLS
174  }
175 
176  return null;
177  }
178 
179  @Override
180  public void process(Content dataSource, IngestJobContext context, DataSourceIngestModuleProgress progressBar) {
181  this.dataSource = dataSource;
182  this.context = context;
183  dataFound = false;
184 
185  progressBar.progress(Bundle.Progress_Message_Extract_Resent_Docs());
186  this.getRecentDocuments();
187  }
188 }
List< AbstractFile > findFiles(String fileName)

Copyright © 2012-2021 Basis Technology. Generated on: Fri Aug 6 2021
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.