Autopsy  4.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
ArtifactTextExtractor.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011-2016 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.keywordsearch;
20 
21 import java.io.InputStream;
22 import java.io.InputStreamReader;
23 import java.io.Reader;
24 import java.nio.charset.StandardCharsets;
25 import java.util.logging.Level;
26 import org.apache.commons.io.IOUtils;
36 
41 class ArtifactTextExtractor implements TextExtractor<BlackboardArtifact> {
42 
43  static final private Logger logger = Logger.getLogger(ArtifactTextExtractor.class.getName());
44 
56  static Content getDataSource(BlackboardArtifact artifact) throws TskCoreException {
57 
58  Case currentCase;
59  try {
60  currentCase = Case.getCurrentCase();
61  } catch (IllegalStateException ignore) {
62  // thorown by Case.getCurrentCase() if currentCase is null
63  return null;
64  }
65 
66  SleuthkitCase sleuthkitCase = currentCase.getSleuthkitCase();
67  if (sleuthkitCase == null) {
68  return null;
69 
70  }
71  Content dataSource;
72  AbstractFile abstractFile = sleuthkitCase.getAbstractFileById(artifact.getObjectID());
73  if (abstractFile != null) {
74  dataSource = abstractFile.getDataSource();
75  } else {
76  dataSource = sleuthkitCase.getContentById(artifact.getObjectID());
77  }
78 
79  if (dataSource == null) {
80  return null;
81  }
82  return dataSource;
83  }
84 
85  @Override
86  public boolean isDisabled() {
87  return false;
88  }
89 
90  @Override
91  public void logWarning(final String msg, Exception ex) {
92  logger.log(Level.WARNING, msg, ex); //NON-NLS }
93  }
94 
95  private InputStream getInputStream(BlackboardArtifact artifact) throws TextExtractorException {
96  // Concatenate the string values of all attributes into a single
97  // "content" string to be indexed.
98  StringBuilder artifactContents = new StringBuilder();
99 
100  Content dataSource = null;
101  try {
102  dataSource = getDataSource(artifact);
103  } catch (TskCoreException tskCoreException) {
104  throw new TextExtractorException("Unable to get datasource for artifact: " + artifact.toString(), tskCoreException);
105  }
106  if (dataSource == null) {
107  throw new TextExtractorException("Datasource was null for artifact: " + artifact.toString());
108  }
109 
110  try {
111  for (BlackboardAttribute attribute : artifact.getAttributes()) {
112  artifactContents.append(attribute.getAttributeType().getDisplayName());
113  artifactContents.append(" : ");
114  // We have also discussed modifying BlackboardAttribute.getDisplayString()
115  // to magically format datetime attributes but that is complicated by
116  // the fact that BlackboardAttribute exists in Sleuthkit data model
117  // while the utility to determine the timezone to use is in ContentUtils
118  // in the Autopsy datamodel.
119  switch (attribute.getValueType()) {
120  case DATETIME:
121  artifactContents.append(ContentUtils.getStringTime(attribute.getValueLong(), dataSource));
122  break;
123  default:
124  artifactContents.append(attribute.getDisplayString());
125  }
126  artifactContents.append(System.lineSeparator());
127  }
128  } catch (TskCoreException tskCoreException) {
129  throw new TextExtractorException("Unable to get attributes for artifact: " + artifact.toString(), tskCoreException);
130  }
131 
132  return IOUtils.toInputStream(artifactContents, StandardCharsets.UTF_8);
133  }
134 
135  @Override
136  public Reader getReader(BlackboardArtifact source) throws TextExtractorException {
137  return new InputStreamReader(getInputStream(source), StandardCharsets.UTF_8);
138  }
139 
140  @Override
141  public long getID(BlackboardArtifact source) {
142  return source.getArtifactID();
143  }
144 
145  @Override
146  public String getName(BlackboardArtifact source) {
147  return source.getDisplayName() + "_" + source.getArtifactID();
148  }
149 }

Copyright © 2012-2016 Basis Technology. Generated on: Mon Apr 24 2017
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.