23 package org.sleuthkit.autopsy.casemodule.services;
25 import java.io.Closeable;
26 import java.io.IOException;
27 import java.util.ArrayList;
28 import java.util.Collection;
29 import java.util.List;
30 import java.util.logging.Level;
31 import org.openide.util.NbBundle;
41 import org.
sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction;
48 import org.apache.commons.lang3.StringUtils;
84 public synchronized List<AbstractFile>
findFilesByMimeType(Collection<String> mimeTypes)
throws TskCoreException {
86 throw new TskCoreException(
"File manager has been closed");
103 public synchronized List<AbstractFile>
findFilesByMimeType(Content dataSource, Collection<String> mimeTypes)
throws TskCoreException {
104 if (null == caseDb) {
105 throw new TskCoreException(
"File manager has been closed");
107 return caseDb.findAllFilesWhere(
"data_source_obj_id = " + dataSource.getId() +
" AND " +
createFileTypeInCondition(mimeTypes));
118 String types = StringUtils.join(mimeTypes,
"', '");
119 return "mime_type IN ('" + types +
"')";
134 public synchronized List<AbstractFile>
findFiles(String fileName)
throws TskCoreException {
135 if (null == caseDb) {
136 throw new TskCoreException(
"File manager has been closed");
138 List<AbstractFile> result =
new ArrayList<>();
139 List<Content> dataSources = caseDb.getRootObjects();
140 for (Content dataSource : dataSources) {
141 result.addAll(
findFiles(dataSource, fileName));
160 public synchronized List<AbstractFile>
findFiles(String fileName, String parentName)
throws TskCoreException {
161 if (null == caseDb) {
162 throw new TskCoreException(
"File manager has been closed");
164 List<AbstractFile> result =
new ArrayList<>();
165 List<Content> dataSources = caseDb.getRootObjects();
166 for (Content dataSource : dataSources) {
167 result.addAll(
findFiles(dataSource, fileName, parentName));
186 public synchronized List<AbstractFile>
findFiles(String fileName, AbstractFile parent)
throws TskCoreException {
187 if (null == caseDb) {
188 throw new TskCoreException(
"File manager has been closed");
190 List<AbstractFile> result =
new ArrayList<>();
191 List<Content> dataSources = caseDb.getRootObjects();
192 for (Content dataSource : dataSources) {
193 result.addAll(
findFiles(dataSource, fileName, parent));
212 public synchronized List<AbstractFile>
findFiles(Content dataSource, String fileName)
throws TskCoreException {
213 if (null == caseDb) {
214 throw new TskCoreException(
"File manager has been closed");
216 return caseDb.findFiles(dataSource, fileName);
235 public synchronized List<AbstractFile>
findFiles(Content dataSource, String fileName, String parentName)
throws TskCoreException {
236 if (null == caseDb) {
237 throw new TskCoreException(
"File manager has been closed");
239 return caseDb.findFiles(dataSource, fileName, parentName);
258 public synchronized List<AbstractFile>
findFiles(Content dataSource, String fileName, AbstractFile parent)
throws TskCoreException {
259 if (null == caseDb) {
260 throw new TskCoreException(
"File manager has been closed");
262 return findFiles(dataSource, fileName, parent.getName());
281 public synchronized List<AbstractFile>
openFiles(Content dataSource, String filePath)
throws TskCoreException {
282 if (null == caseDb) {
283 throw new TskCoreException(
"File manager has been closed");
285 return caseDb.openFiles(dataSource, filePath);
320 long ctime,
long crtime,
long atime,
long mtime,
323 String rederiveDetails, String toolName, String toolVersion, String otherDetails,
324 TskData.EncodingType encodingType) throws TskCoreException {
325 if (null == caseDb) {
326 throw new TskCoreException(
"File manager has been closed");
328 return caseDb.addDerivedFile(fileName, localPath, size,
329 ctime, crtime, atime, mtime,
330 isFile, parentObj, rederiveDetails, toolName, toolVersion, otherDetails, encodingType);
344 public synchronized List<LayoutFile>
addCarvedFiles(CarvingResult carvingResult)
throws TskCoreException {
345 if (null == caseDb) {
346 throw new TskCoreException(
"File manager has been closed");
348 return caseDb.addCarvedFiles(carvingResult);
393 public synchronized LocalFilesDataSource
addLocalFilesDataSource(String deviceId, String rootVirtualDirectoryName, String timeZone, List<String> localFilePaths,
FileAddProgressUpdater progressUpdater)
throws TskCoreException, TskDataException {
394 if (null == caseDb) {
395 throw new TskCoreException(
"File manager has been closed");
398 CaseDbTransaction trans = null;
400 String rootDirectoryName = rootVirtualDirectoryName;
401 if (rootDirectoryName.isEmpty()) {
409 trans = caseDb.beginTransaction();
410 LocalFilesDataSource dataSource = caseDb.addLocalFilesDataSource(deviceId, rootDirectoryName, timeZone, trans);
411 List<AbstractFile> filesAdded =
new ArrayList<>();
412 for (java.io.File localFile : localFiles) {
413 AbstractFile fileAdded =
addLocalFile(trans, dataSource, localFile, TskData.EncodingType.NONE, progressUpdater);
414 if (null != fileAdded) {
415 filesAdded.add(fileAdded);
417 throw new TskCoreException(NbBundle.getMessage(
this.getClass(),
"FileManager.addLocalFilesDirs.exception.cantAdd.msg", localFile.getAbsolutePath()));
425 for (AbstractFile fileAdded : filesAdded) {
431 }
catch (TskCoreException ex) {
435 }
catch (TskCoreException ex2) {
436 LOGGER.log(Level.SEVERE, String.format(
"Failed to rollback transaction after exception: %s", ex.getMessage()), ex2);
457 int localFileDataSourcesCounter = 0;
459 List<VirtualDirectory> localFileDataSources = caseDb.getVirtualDirectoryRoots();
460 for (VirtualDirectory vd : localFileDataSources) {
462 ++localFileDataSourcesCounter;
466 }
catch (TskCoreException ex) {
467 throw new TskCoreException(
"Error querying for existing local file data sources with defualt names", ex);
484 List<java.io.File> localFiles =
new ArrayList<>();
485 for (String path : localFilePaths) {
486 java.io.File localFile =
new java.io.File(path);
487 if (!localFile.exists() || !localFile.canRead()) {
488 throw new TskDataException(String.format(
"File at %s does not exist or cannot be read", localFile.getAbsolutePath()));
490 localFiles.add(localFile);
511 private AbstractFile
addLocalFile(CaseDbTransaction trans, SpecialDirectory parentDirectory, java.io.File localFile,
513 if (localFile.isDirectory()) {
517 LocalDirectory localDirectory = caseDb.addLocalDirectory(parentDirectory.getId(), localFile.getName(), trans);
518 progressUpdater.fileAdded(localDirectory);
523 final java.io.File[] childFiles = localFile.listFiles();
524 if (childFiles != null && childFiles.length > 0) {
525 for (java.io.File childFile : childFiles) {
526 addLocalFile(trans, localDirectory, childFile, progressUpdater);
530 return localDirectory;
532 return caseDb.addLocalFile(localFile.getName(), localFile.getAbsolutePath(), localFile.length(),
534 localFile.isFile(), encodingType, parentDirectory, trans);
544 public synchronized void close() throws IOException {
568 if (null == caseDb) {
569 throw new TskCoreException(
"File manager has been closed");
573 }
catch (TskDataException ex) {
574 throw new TskCoreException(ex.getLocalizedMessage(), ex);
597 public synchronized LayoutFile
addCarvedFile(String fileName,
long fileSize,
long parentObjId, List<TskFileRange> layout)
throws TskCoreException {
598 if (null == caseDb) {
599 throw new TskCoreException(
"File manager has been closed");
601 Content parent = caseDb.getContentById(parentObjId);
602 List<CarvingResult.CarvedFile> carvedFiles =
new ArrayList<>();
603 carvedFiles.add(
new CarvingResult.CarvedFile(fileName, fileSize, layout));
604 List<LayoutFile> layoutFiles = caseDb.addCarvedFiles(
new CarvingResult(parent, carvedFiles));
605 return layoutFiles.get(0);
624 public synchronized List<LayoutFile>
addCarvedFiles(List<org.sleuthkit.datamodel.CarvedFileContainer> filesToAdd)
throws TskCoreException {
625 if (null == caseDb) {
626 throw new TskCoreException(
"File manager has been closed");
628 return caseDb.addCarvedFiles(filesToAdd);
665 long ctime,
long crtime,
long atime,
long mtime,
667 AbstractFile parentFile,
668 String rederiveDetails, String toolName, String toolVersion, String otherDetails)
throws TskCoreException {
669 return addDerivedFile(fileName, localPath, size, ctime, crtime, atime, mtime, isFile, parentFile,
670 rederiveDetails, toolName, toolVersion, otherDetails, TskData.EncodingType.NONE);
693 private AbstractFile
addLocalFile(CaseDbTransaction trans, SpecialDirectory parentDirectory, java.io.File localFile,
FileAddProgressUpdater progressUpdater)
throws TskCoreException {
694 return addLocalFile(trans, parentDirectory, localFile, TskData.EncodingType.NONE, progressUpdater);
synchronized List< AbstractFile > findFiles(String fileName, String parentName)
synchronized void close()
static String createFileTypeInCondition(Collection< String > mimeTypes)
synchronized VirtualDirectory addLocalFilesDirs(List< String > localFilePaths, FileAddProgressUpdater progressUpdater)
static final Logger LOGGER
synchronized LayoutFile addCarvedFile(String fileName, long fileSize, long parentObjId, List< TskFileRange > layout)
void fileAdded(AbstractFile newFile)
synchronized List< AbstractFile > findFiles(Content dataSource, String fileName)
synchronized DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, Content parentObj, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType)
synchronized DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parentFile, String rederiveDetails, String toolName, String toolVersion, String otherDetails)
AbstractFile addLocalFile(CaseDbTransaction trans, SpecialDirectory parentDirectory, java.io.File localFile, FileAddProgressUpdater progressUpdater)
synchronized List< AbstractFile > findFilesByMimeType(Collection< String > mimeTypes)
synchronized List< LayoutFile > addCarvedFiles(List< org.sleuthkit.datamodel.CarvedFileContainer > filesToAdd)
synchronized List< AbstractFile > openFiles(Content dataSource, String filePath)
synchronized LocalFilesDataSource addLocalFilesDataSource(String deviceId, String rootVirtualDirectoryName, String timeZone, List< String > localFilePaths, FileAddProgressUpdater progressUpdater)
static synchronized String generateFilesDataSourceName(SleuthkitCase caseDb)
synchronized List< AbstractFile > findFilesByMimeType(Content dataSource, Collection< String > mimeTypes)
void fireModuleContentEvent(ModuleContentEvent moduleContentEvent)
synchronized List< AbstractFile > findFiles(String fileName)
AbstractFile addLocalFile(CaseDbTransaction trans, SpecialDirectory parentDirectory, java.io.File localFile, TskData.EncodingType encodingType, FileAddProgressUpdater progressUpdater)
synchronized static Logger getLogger(String name)
synchronized List< LayoutFile > addCarvedFiles(CarvingResult carvingResult)
FileManager(SleuthkitCase caseDb)
static final String LOGICAL_FILE_SET_PREFIX
synchronized List< AbstractFile > findFiles(Content dataSource, String fileName, AbstractFile parent)
synchronized List< AbstractFile > findFiles(String fileName, AbstractFile parent)
List< java.io.File > getFilesAndDirectories(List< String > localFilePaths)
synchronized List< AbstractFile > findFiles(Content dataSource, String fileName, String parentName)
static synchronized IngestServices getInstance()