19 package org.sleuthkit.autopsy.modules.interestingitems;
21 import java.util.ArrayList;
22 import java.util.Collections;
23 import java.util.List;
25 import java.util.concurrent.ConcurrentHashMap;
26 import java.util.logging.Level;
27 import org.openide.util.NbBundle;
28 import org.openide.util.NbBundle.Messages;
49 "FilesIdentifierIngestModule.getFilesError=Error getting interesting files sets from file."
51 final class FilesIdentifierIngestModule implements FileIngestModule {
53 private static final Object sharedResourcesLock =
new Object();
54 private static final Logger logger = Logger.getLogger(FilesIdentifierIngestModule.class.getName());
55 private static final IngestModuleReferenceCounter refCounter =
new IngestModuleReferenceCounter();
56 private static final Map<Long, List<FilesSet>> interestingFileSetsByJob =
new ConcurrentHashMap<>();
57 private final FilesIdentifierIngestJobSettings settings;
58 private IngestJobContext context;
59 private Blackboard blackboard;
67 FilesIdentifierIngestModule(FilesIdentifierIngestJobSettings settings) {
68 this.settings = settings;
75 public void startUp(IngestJobContext context)
throws IngestModuleException {
76 this.context = context;
77 synchronized (FilesIdentifierIngestModule.sharedResourcesLock) {
78 if (FilesIdentifierIngestModule.refCounter.incrementAndGet(context.getJobId()) == 1) {
84 List<FilesSet> filesSets =
new ArrayList<>();
86 for (FilesSet set : InterestingItemDefsManager.getInstance().getInterestingFilesSets().values()) {
87 if (settings.interestingFilesSetIsEnabled(set.getName())) {
91 }
catch (InterestingItemDefsManager.InterestingItemDefsManagerException ex) {
92 throw new IngestModuleException(Bundle.FilesIdentifierIngestModule_getFilesError(), ex);
94 FilesIdentifierIngestModule.interestingFileSetsByJob.put(context.getJobId(), filesSets);
103 @Messages({
"FilesIdentifierIngestModule.indexError.message=Failed to index interesting file hit artifact for keyword search."})
104 public ProcessResult process(AbstractFile file) {
105 blackboard = Case.getCurrentCase().getServices().getBlackboard();
108 if (file.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.SLACK)) {
109 return ProcessResult.OK;
113 List<FilesSet> filesSets = FilesIdentifierIngestModule.interestingFileSetsByJob.get(this.context.getJobId());
114 for (FilesSet filesSet : filesSets) {
115 String ruleSatisfied = filesSet.fileIsMemberOf(file);
116 if (ruleSatisfied != null) {
120 String moduleName = InterestingItemsIngestModuleFactory.getModuleName();
121 BlackboardArtifact artifact = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT);
128 BlackboardAttribute setNameAttribute =
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME, moduleName, filesSet.getName());
129 artifact.addAttribute(setNameAttribute);
133 BlackboardAttribute ruleNameAttribute =
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY, moduleName, ruleSatisfied);
134 artifact.addAttribute(ruleNameAttribute);
138 blackboard.indexArtifact(artifact);
139 }
catch (Blackboard.BlackboardException ex) {
140 logger.log(Level.SEVERE,
"Unable to index blackboard artifact " + artifact.getArtifactID(), ex);
141 MessageNotifyUtil.Notify.error(Bundle.FilesIdentifierIngestModule_indexError_message(), artifact.getDisplayName());
144 IngestServices.getInstance().fireModuleDataEvent(
new ModuleDataEvent(moduleName, BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT, Collections.singletonList(artifact)));
146 }
catch (TskCoreException ex) {
147 FilesIdentifierIngestModule.logger.log(Level.SEVERE,
"Error posting to the blackboard", ex);
151 return ProcessResult.OK;
158 public void shutDown() {
159 if (context != null) {
160 if (refCounter.decrementAndGet(
this.context.getJobId()) == 0) {
164 FilesIdentifierIngestModule.interestingFileSetsByJob.remove(this.context.getJobId());