19 package org.sleuthkit.autopsy.modules.filetypeid;
21 import java.util.ArrayList;
22 import java.util.Collections;
23 import java.util.List;
24 import java.util.SortedSet;
25 import java.util.TreeSet;
26 import java.util.logging.Level;
27 import java.util.stream.Collectors;
28 import org.apache.tika.Tika;
29 import org.apache.tika.mime.MimeTypes;
30 import org.openide.util.NbBundle;
49 private static final Tika
tika =
new Tika();
68 userDefinedFileTypes = CustomFileTypesManager.getInstance().getUserDefinedFileTypes();
69 autopsyDefinedFileTypes = CustomFileTypesManager.getInstance().getAutopsyDefinedFileTypes();
70 }
catch (CustomFileTypesManager.CustomFileTypesException ex) {
71 throw new FileTypeDetectorInitException(
"Error loading custom file types", ex);
82 List<String> customFileTypes =
new ArrayList<>();
83 for (FileType fileType : userDefinedFileTypes) {
84 customFileTypes.add(fileType.getMimeType());
86 for (FileType fileType : autopsyDefinedFileTypes) {
87 customFileTypes.add(fileType.getMimeType());
89 return customFileTypes;
114 if (detectedTypes == null) {
115 detectedTypes =
org.apache.tika.mime.MimeTypes.getDefaultMimeTypes().getMediaTypeRegistry().getTypes()
116 .stream().filter(t -> !t.hasParameters()).map(s -> s.toString()).collect(Collectors.toCollection(TreeSet::new));
118 return Collections.unmodifiableSortedSet(detectedTypes);
131 for (FileType fileType : customTypes) {
132 if (fileType.getMimeType().equals(mimeType)) {
166 public String
getFileType(AbstractFile file)
throws TskCoreException {
167 return detect(file,
true);
182 public String
detect(AbstractFile file)
throws TskCoreException {
183 return detect(file,
false);
202 private String
detect(AbstractFile file,
boolean addToCaseDb)
throws TskCoreException {
207 String mimeType = file.getMIMEType();
208 if (null != mimeType) {
220 if (!file.isFile() || file.getSize() <= 0
221 || (file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS)
222 || (file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS)
223 || (file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.VIRTUAL_DIR)
224 || (file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.SLACK)) {
225 mimeType = MimeTypes.OCTET_STREAM;
232 if (null == mimeType) {
240 if (null == mimeType) {
248 if (null == mimeType) {
251 int len = file.read(buffer, 0, BUFFER_SIZE);
252 if (len < BUFFER_SIZE) {
254 System.arraycopy(buffer, 0, buf, 0, len);
258 String tikaType = tika.detect(buf, file.getName());
263 mimeType = tikaType.replace(
"tika-",
"");
269 }
catch (Exception ignored) {
277 mimeType = MimeTypes.OCTET_STREAM;
314 int indexOfSemicolon = mimeType.indexOf(
";");
315 if (indexOfSemicolon != -1 ) {
316 return mimeType.substring(0, indexOfSemicolon).trim();
333 for (FileType fileType : userDefinedFileTypes) {
334 if (fileType.matches(file)) {
335 if (fileType.createInterestingFileHit()) {
336 BlackboardArtifact artifact;
337 artifact = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT);
338 BlackboardAttribute setNameAttribute =
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME,
FileTypeIdModuleFactory.getModuleName(), fileType.getInterestingFilesSetName());
339 artifact.addAttribute(setNameAttribute);
346 BlackboardAttribute ruleNameAttribute =
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY,
FileTypeIdModuleFactory.getModuleName(), fileType.getMimeType());
347 artifact.addAttribute(ruleNameAttribute);
355 logger.log(Level.SEVERE, String.format(
"Unable to index blackboard artifact %d", artifact.getArtifactID()), ex);
357 NbBundle.getMessage(
Blackboard.class,
"Blackboard.unableToIndexArtifact.exception.msg"), artifact.getDisplayName());
361 return fileType.getMimeType();
378 for (FileType fileType : autopsyDefinedFileTypes) {
379 if (fileType.matches(file)) {
380 return fileType.getMimeType();
412 super(message, throwable);
static final int BUFFER_SIZE
static SortedSet< String > detectedTypes
String removeOptionalParameter(String mimeType)
static final long serialVersionUID
final List< FileType > userDefinedFileTypes
boolean isDetectable(String mimeType)
String detectUserDefinedType(AbstractFile file)
boolean isDetectableAsCustomType(List< FileType > customTypes, String mimeType)
final List< FileType > autopsyDefinedFileTypes
SleuthkitCase getSleuthkitCase()
Blackboard getBlackboard()
static synchronized SortedSet< String > getStandardDetectedTypes()
static void error(String title, String message)
String detect(AbstractFile file)
synchronized void indexArtifact(BlackboardArtifact artifact)
String detectAutopsyDefinedType(AbstractFile file)
static Case getCurrentCase()
synchronized static Logger getLogger(String name)
static final Logger logger
List< String > getUserDefinedTypes()
String getFileType(AbstractFile file)
String detect(AbstractFile file, boolean addToCaseDb)
boolean isDetectableByTika(String mimeType)
String detectAndPostToBlackboard(AbstractFile file)