19 package org.sleuthkit.autopsy.modules.interestingitems;
21 import java.util.ArrayList;
22 import java.util.Collection;
23 import java.util.Collections;
24 import java.util.List;
26 import java.util.concurrent.ConcurrentHashMap;
27 import java.util.logging.Level;
28 import org.openide.util.NbBundle;
29 import org.openide.util.NbBundle.Messages;
51 "FilesIdentifierIngestModule.getFilesError=Error getting interesting files sets from file."
53 final class FilesIdentifierIngestModule implements FileIngestModule {
55 private static final Object sharedResourcesLock =
new Object();
56 private static final Logger logger = Logger.getLogger(FilesIdentifierIngestModule.class.getName());
57 private static final IngestModuleReferenceCounter refCounter =
new IngestModuleReferenceCounter();
58 private static final Map<Long, List<FilesSet>> interestingFileSetsByJob =
new ConcurrentHashMap<>();
59 private final FilesIdentifierIngestJobSettings settings;
60 private final IngestServices services = IngestServices.getInstance();
61 private IngestJobContext context;
62 private Blackboard blackboard;
70 FilesIdentifierIngestModule(FilesIdentifierIngestJobSettings settings) {
71 this.settings = settings;
78 public void startUp(IngestJobContext context)
throws IngestModuleException {
79 this.context = context;
80 synchronized (FilesIdentifierIngestModule.sharedResourcesLock) {
81 if (FilesIdentifierIngestModule.refCounter.incrementAndGet(context.getJobId()) == 1) {
87 List<FilesSet> filesSets =
new ArrayList<>();
89 for (FilesSet set : FilesSetsManager.getInstance().getInterestingFilesSets().values()) {
90 if (settings.interestingFilesSetIsEnabled(set.getName())) {
94 }
catch (FilesSetsManager.FilesSetsManagerException ex) {
95 throw new IngestModuleException(Bundle.FilesIdentifierIngestModule_getFilesError(), ex);
97 FilesIdentifierIngestModule.interestingFileSetsByJob.put(context.getJobId(), filesSets);
106 @Messages({
"FilesIdentifierIngestModule.indexError.message=Failed to index interesting file hit artifact for keyword search."})
107 public ProcessResult process(AbstractFile file) {
108 blackboard = Case.getCurrentCase().getServices().getBlackboard();
111 if (file.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.SLACK)) {
112 return ProcessResult.OK;
116 List<FilesSet> filesSets = FilesIdentifierIngestModule.interestingFileSetsByJob.get(this.context.getJobId());
117 for (FilesSet filesSet : filesSets) {
118 String ruleSatisfied = filesSet.fileIsMemberOf(file);
119 if (ruleSatisfied != null) {
123 String moduleName = InterestingItemsIngestModuleFactory.getModuleName();
124 BlackboardArtifact artifact = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT);
125 Collection<BlackboardAttribute> attributes =
new ArrayList<>();
132 BlackboardAttribute setNameAttribute =
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME, moduleName, filesSet.getName());
133 attributes.add(setNameAttribute);
137 BlackboardAttribute ruleNameAttribute =
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY, moduleName, ruleSatisfied);
138 attributes.add(ruleNameAttribute);
140 artifact.addAttributes(attributes);
143 blackboard.indexArtifact(artifact);
144 }
catch (Blackboard.BlackboardException ex) {
145 logger.log(Level.SEVERE,
"Unable to index blackboard artifact " + artifact.getArtifactID(), ex);
146 MessageNotifyUtil.Notify.error(Bundle.FilesIdentifierIngestModule_indexError_message(), artifact.getDisplayName());
149 services.fireModuleDataEvent(
new ModuleDataEvent(moduleName, BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT, Collections.singletonList(artifact)));
152 StringBuilder detailsSb =
new StringBuilder();
153 detailsSb.append(
"File: " + file.getParentPath() + file.getName() +
"<br/>\n");
154 detailsSb.append(
"Rule Set: " + filesSet.getName());
156 services.postMessage(IngestMessage.createDataMessage(InterestingItemsIngestModuleFactory.getModuleName(),
157 "Interesting File Match: " + filesSet.getName() +
"(" + file.getName() +
")",
158 detailsSb.toString(),
162 }
catch (TskCoreException ex) {
163 FilesIdentifierIngestModule.logger.log(Level.SEVERE,
"Error posting to the blackboard", ex);
167 return ProcessResult.OK;
174 public void shutDown() {
175 if (context != null) {
176 if (refCounter.decrementAndGet(
this.context.getJobId()) == 0) {
180 FilesIdentifierIngestModule.interestingFileSetsByJob.remove(this.context.getJobId());