Autopsy  4.7.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
Util.java
Go to the documentation of this file.
1  /*
2  *
3  * Autopsy Forensic Browser
4  *
5  * Copyright 2012-2018 Basis Technology Corp.
6  *
7  * Copyright 2012 42six Solutions.
8  * Contact: aebadirad <at> 42six <dot> com
9  * Project Contact/Architect: carrier <at> sleuthkit <dot> org
10  *
11  * Licensed under the Apache License, Version 2.0 (the "License");
12  * you may not use this file except in compliance with the License.
13  * You may obtain a copy of the License at
14  *
15  * http://www.apache.org/licenses/LICENSE-2.0
16  *
17  * Unless required by applicable law or agreed to in writing, software
18  * distributed under the License is distributed on an "AS IS" BASIS,
19  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
20  * See the License for the specific language governing permissions and
21  * limitations under the License.
22  */
23 package org.sleuthkit.autopsy.recentactivity;
24 
26 import java.io.File;
27 import java.io.FileInputStream;
28 import java.io.IOException;
29 import java.net.MalformedURLException;
30 import java.net.URL;
31 import java.nio.MappedByteBuffer;
32 import java.nio.channels.FileChannel;
33 import java.nio.charset.Charset;
34 import java.sql.ResultSet;
35 import java.text.SimpleDateFormat;
36 import java.util.Date;
37 import java.util.List;
38 import java.util.StringTokenizer;
39 import java.util.logging.Level;
41 import java.util.regex.Matcher;
42 import java.util.regex.Pattern;
46 import org.sleuthkit.datamodel.AbstractFile;
47 import org.sleuthkit.datamodel.Content;
48 import org.sleuthkit.datamodel.TskCoreException;
49 
54 class Util {
55 
56  private static Logger logger = Logger.getLogger(Util.class.getName());
57 
58  private Util() {
59  }
60 
61  public static boolean pathexists(String path) {
62  File file = new File(path);
63  boolean exists = file.exists();
64  return exists;
65  }
66 
67  public static String utcConvert(String utc) {
68  SimpleDateFormat formatter = new SimpleDateFormat("MM-dd-yyyy HH:mm");
69  String tempconvert = formatter.format(new Date(Long.parseLong(utc)));
70  return tempconvert;
71  }
72 
73  public static String readFile(String path) throws IOException {
74  FileInputStream stream = new FileInputStream(new File(path));
75  try {
76  FileChannel fc = stream.getChannel();
77  MappedByteBuffer bb = fc.map(FileChannel.MapMode.READ_ONLY, 0, fc.size());
78  /*
79  * Instead of using default, pass in a decoder.
80  */
81  return Charset.defaultCharset().decode(bb).toString();
82  } finally {
83  stream.close();
84  }
85  }
86 
87  public static String getBaseDomain(String url) {
88  String host = null;
89  //strip protocol
90  String cleanUrl = url.replaceFirst("/.*:\\/\\//", "");
91 
92  //strip after slashes
93  String dirToks[] = cleanUrl.split("/\\//");
94  if (dirToks.length > 0) {
95  host = dirToks[0];
96  } else {
97  host = cleanUrl;
98  }
99 
100  //get the domain part from host (last 2)
101  StringTokenizer tok = new StringTokenizer(host, ".");
102  StringBuilder hostB = new StringBuilder();
103  int toks = tok.countTokens();
104 
105  for (int count = 0; count < toks; ++count) {
106  String part = tok.nextToken();
107  int diff = toks - count;
108  if (diff < 3) {
109  hostB.append(part);
110  }
111  if (diff == 2) {
112  hostB.append(".");
113  }
114  }
115 
116  return hostB.toString();
117  }
118 
119  public static String extractDomain(String value) {
120  if (value == null) {
121  return "";
122 
123  }
124  String result = "";
125  // String domainPattern = "(\\w+)\\.(AC|AD|AE|AERO|AF|AG|AI|AL|AM|AN|AO|AQ|AR|ARPA|AS|ASIA|AT|AU|AW|AX|AZ|BA|BB|BD|BE|BF|BG|BH|BI|BIZ|BJ|BM|BN|BO|BR|BS|BT|BV|BW|BY|BZ|CA|CAT|CC|CD|CF|CG|CH|CI|CK|CL|CM|CN|CO|COM|COOP|CR|CU|CV|CW|CX|CY|CZ|DE|DJ|DK|DM|DO|DZ|EC|EDU|EE|EG|ER|ES|ET|EU|FI|FJ|FK|FM|FO|FR|GA|GB|GD|GE|GF|GG|GH|GI|GL|GM|GN|GOV|GP|GQ|GR|GS|GT|GU|GW|GY|HK|HM|HN|HR|HT|HU|ID|IE|IL|IM|IN|INFO|INT|IO|IQ|IR|IS|IT|JE|JM|JO|JOBS|JP|KE|KG|KH|KI|KM|KN|KP|KR|KW|KY|KZ|LA|LB|LC|LI|LK|LR|LS|LT|LU|LV|LY|MA|MC|MD|ME|MG|MH|MIL|MK|ML|MM|MN|MO|MOBI|MP|MQ|MR|MS|MT|MU|MUSEUM|MV|MW|MX|MY|MZ|NA|NAME|NC|NE|NET|NF|NG|NI|NL|NO|NP|NR|NU|NZ|OM|ORG|PA|PE|PF|PG|PH|PK|PL|PM|PN|PR|PRO|PS|PT|PW|PY|QA|RE|RO|RS|RU|RW|SA|SB|SC|SD|SE|SG|SH|SI|SJ|SK|SL|SM|SN|SO|SR|ST|SU|SV|SX|SY|SZ|TC|TD|TEL|TF|TG|TH|TJ|TK|TL|TM|TN|TO|TP|TR|TRAVEL|TT|TV|TW|TZ|UA|UG|UK|US|UY|UZ|VA|VC|VE|VG|VI|VN|VU|WF|WS|XXX|YE|YT|ZA|ZM|ZW(co\\.[a-z].))";
126  // Pattern p = Pattern.compile(domainPattern,Pattern.CASE_INSENSITIVE);
127  // Matcher m = p.matcher(value);
128  // while (m.find()) {
129  // result = value.substring(m.start(0),m.end(0));
130  // }
131 
132  try {
133  URL url = new URL(value);
134  result = url.getHost();
135  } catch (MalformedURLException ex) {
136  //do not log if not a valid URL, and handle later
137  //Logger.getLogger(Util.class.getName()).log(Level.SEVERE, null, ex);
138  }
139 
140  //was not a valid URL, try a less picky method
141  if (result == null || result.trim().isEmpty()) {
142  return getBaseDomain(value);
143  }
144 
145  return result;
146  }
147 
148  public static String getFileName(String value) {
149  String filename = "";
150  String filematch = "^([a-zA-Z]\\:)(\\\\[^\\\\/:*?<>\"|]*(?<!\\[ \\]))*(\\.[a-zA-Z]{2,6})$"; //NON-NLS
151 
152  Pattern p = Pattern.compile(filematch, Pattern.CASE_INSENSITIVE | Pattern.DOTALL | Pattern.COMMENTS);
153  Matcher m = p.matcher(value);
154  if (m.find()) {
155  filename = m.group(1);
156 
157  }
158  int lastPos = value.lastIndexOf('\\');
159  filename = (lastPos < 0) ? value : value.substring(lastPos + 1);
160  return filename.toString();
161  }
162 
163  public static String getPath(String txt) {
164  String path = "";
165 
166  //String drive ="([a-z]:\\\\(?:[-\\w\\.\\d]+\\\\)*(?:[-\\w\\.\\d]+)?)"; // Windows drive
167  String drive = "([a-z]:\\\\\\S.+)"; //NON-NLS
168  Pattern p = Pattern.compile(drive, Pattern.CASE_INSENSITIVE | Pattern.COMMENTS);
169  Matcher m = p.matcher(txt);
170  if (m.find()) {
171  path = m.group(1);
172 
173  } else {
174 
175  String network = "(\\\\(?:\\\\[^:\\s?*\"<>|]+)+)"; // Windows network NON-NLS
176 
177  Pattern p2 = Pattern.compile(network, Pattern.CASE_INSENSITIVE | Pattern.DOTALL);
178  Matcher m2 = p2.matcher(txt);
179  if (m2.find()) {
180  path = m2.group(1);
181  }
182  }
183  return path;
184  }
185 
186  public static long findID(Content dataSource, String path) {
187  String parent_path = path.replace('\\', '/'); // fix Chrome paths
188  if (parent_path.length() > 2 && parent_path.charAt(1) == ':') {
189  parent_path = parent_path.substring(2); // remove drive letter (e.g., 'C:')
190  }
191  int index = parent_path.lastIndexOf('/');
192  String name = parent_path.substring(++index);
193  parent_path = parent_path.substring(0, index);
194  List<AbstractFile> files = null;
195  try {
196  FileManager fileManager = Case.getCurrentCaseThrows().getServices().getFileManager();
197  files = fileManager.findFiles(dataSource, name, parent_path);
198  } catch (TskCoreException | NoCurrentCaseException ex) {
199  logger.log(Level.WARNING, "Error fetching 'index.data' files for Internet Explorer history."); //NON-NLS
200  }
201 
202  if (files == null || files.isEmpty()) {
203  return -1;
204  }
205  return files.get(0).getId();
206  }
207 
208  public static boolean checkColumn(String column, String tablename, String connection) {
209  String query = "PRAGMA table_info(" + tablename + ")"; //NON-NLS
210  boolean found = false;
211  ResultSet temprs;
212  try {
213  SQLiteDBConnect tempdbconnect = new SQLiteDBConnect("org.sqlite.JDBC", "jdbc:sqlite:" + connection); //NON-NLS
214  temprs = tempdbconnect.executeQry(query);
215  while (temprs.next()) {
216  if (temprs.getString("name") == null ? column == null : temprs.getString("name").equals(column)) { //NON-NLS
217  found = true;
218  }
219  }
220  } catch (Exception ex) {
221  logger.log(Level.WARNING, "Error while trying to get columns from sqlite db." + connection, ex); //NON-NLS
222  }
223  return found;
224  }
225 
226  public static ResultSet runQuery(String query, String connection) {
227  ResultSet results = null;
228  try {
229  SQLiteDBConnect tempdbconnect = new SQLiteDBConnect("org.sqlite.JDBC", "jdbc:sqlite:" + connection); //NON-NLS
230  results = tempdbconnect.executeQry(query);
231  tempdbconnect.closeConnection();
232  } catch (Exception ex) {
233  logger.log(Level.WARNING, "Error while trying to run sql query: " + query + " : " + connection, ex); //NON-NLS
234  }
235  return results;
236  }
237 }

Copyright © 2012-2016 Basis Technology. Generated on: Mon Jun 18 2018
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.