19 package org.sleuthkit.autopsy.modules.e01verify;
21 import java.security.MessageDigest;
22 import java.security.NoSuchAlgorithmException;
23 import java.util.logging.Level;
24 import javax.xml.bind.DatatypeConverter;
25 import org.openide.util.NbBundle;
26 import org.python.bouncycastle.util.Arrays;
38 import org.openide.util.NbBundle;
46 "UnableToCalculateHashes=Unable to calculate MD5 hashes."
51 private static final long DEFAULT_CHUNK_SIZE = 32 * 1024;
55 private boolean verified =
false;
56 private String calculatedHash =
"";
57 private String storedHash =
"";
65 this.context = context;
71 messageDigest = MessageDigest.getInstance(
"MD5");
72 }
catch (NoSuchAlgorithmException ex) {
79 String imgName = dataSource.getName();
82 if (!(dataSource instanceof Image)) {
83 logger.log(Level.INFO,
"Skipping non-image {0}", imgName);
85 NbBundle.getMessage(this.getClass(),
86 "EwfVerifyIngestModule.process.skipNonEwf",
90 Image img = (Image) dataSource;
93 if (img.getType() != TskData.TSK_IMG_TYPE_ENUM.TSK_IMG_TYPE_EWF_EWF) {
94 logger.log(Level.INFO,
"Skipping non-ewf image {0}", imgName);
96 NbBundle.getMessage(this.getClass(),
97 "EwfVerifyIngestModule.process.skipNonEwf",
103 if ((img.getMd5() == null) || img.getMd5().isEmpty()) {
105 NbBundle.getMessage(this.getClass(),
106 "EwfVerifyIngestModule.process.noStoredHash",
111 storedHash = img.getMd5().toLowerCase();
112 logger.log(Level.INFO,
"Hash value stored in {0}: {1}",
new Object[]{imgName, storedHash});
114 logger.log(Level.INFO,
"Starting hash verification of {0}", img.getName());
116 NbBundle.getMessage(this.getClass(),
117 "EwfVerifyIngestModule.process.startingImg",
120 long size = img.getSize();
122 logger.log(Level.WARNING,
"Size of image {0} was 0 when queried.", imgName);
124 NbBundle.getMessage(this.getClass(),
125 "EwfVerifyIngestModule.process.errGetSizeOfImg",
131 long chunkSize = 64 * img.getSsize();
132 chunkSize = (chunkSize == 0) ? DEFAULT_CHUNK_SIZE : chunkSize;
135 int totalChunks = (int) Math.ceil((
double) size / (
double) chunkSize);
136 logger.log(Level.INFO,
"Total chunks = {0}", totalChunks);
139 byte[] data =
new byte[(int) chunkSize];
143 for (
int i = 0; i < totalChunks; i++) {
148 read = img.read(data, i * chunkSize, chunkSize);
149 }
catch (TskCoreException ex) {
150 String msg = NbBundle.getMessage(this.getClass(),
151 "EwfVerifyIngestModule.process.errReadImgAtChunk", imgName, i);
153 logger.log(Level.SEVERE, msg, ex);
158 if (read == chunkSize) {
159 messageDigest.update(data);
161 byte[] subData = Arrays.copyOfRange(data, 0, read);
162 messageDigest.update(subData);
168 calculatedHash = DatatypeConverter.printHexBinary(messageDigest.digest()).toLowerCase();
169 verified = calculatedHash.equals(storedHash);
170 logger.log(Level.INFO,
"Hash calculated from {0}: {1}",
new Object[]{imgName, calculatedHash});
175 msg = NbBundle.getMessage(this.getClass(),
"EwfVerifyIngestModule.shutDown.verified");
177 msg = NbBundle.getMessage(this.getClass(),
"EwfVerifyIngestModule.shutDown.notVerified");
179 String extra = NbBundle
180 .getMessage(this.getClass(),
"EwfVerifyIngestModule.shutDown.verifyResultsHeader", imgName);
181 extra += NbBundle.getMessage(this.getClass(),
"EwfVerifyIngestModule.shutDown.resultLi", msg);
182 extra += NbBundle.getMessage(this.getClass(),
"EwfVerifyIngestModule.shutDown.calcHashLi", calculatedHash);
183 extra += NbBundle.getMessage(this.getClass(),
"EwfVerifyIngestModule.shutDown.storedHashLi", storedHash);
185 logger.log(Level.INFO,
"{0}{1}",
new Object[]{imgName, msg});
static IngestMessage createMessage(MessageType messageType, String source, String subject, String detailsHtml)
MessageDigest messageDigest
void startUp(IngestJobContext context)
void postMessage(final IngestMessage message)
ProcessResult process(Content dataSource, DataSourceIngestModuleProgress statusHelper)
boolean dataSourceIngestIsCancelled()
void switchToDeterminate(int workUnits)
synchronized static Logger getLogger(String name)
void progress(int workUnits)
static synchronized IngestServices getInstance()