Autopsy  4.8.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
TextMessageAnalyzer.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2014-2018 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.modules.iOS;
20 
21 import java.sql.Connection;
22 import java.sql.DriverManager;
23 import java.sql.ResultSet;
24 import java.sql.SQLException;
25 import java.sql.Statement;
26 import java.util.ArrayList;
27 import java.util.Collection;
28 import java.util.List;
29 import java.util.logging.Level;
30 import org.openide.util.NbBundle;
31 import org.openide.util.NbBundle.Messages;
39 import org.sleuthkit.datamodel.AbstractFile;
40 import org.sleuthkit.datamodel.BlackboardArtifact;
41 import org.sleuthkit.datamodel.BlackboardAttribute;
42 import org.sleuthkit.datamodel.ReadContentInputStream;
43 import org.sleuthkit.datamodel.SleuthkitCase;
44 import org.sleuthkit.datamodel.TskCoreException;
45 
50 class TextMessageAnalyzer {
51 
52  private Connection connection = null;
53  private ResultSet resultSet = null;
54  private Statement statement = null;
55  private String dbPath = "";
56  private long fileId = 0;
57  private java.io.File jFile = null;
58  List<AbstractFile> absFiles;
59  private final String moduleName = iOSModuleFactory.getModuleName();
60  private static final Logger logger = Logger.getLogger(TextMessageAnalyzer.class.getName());
61  private Blackboard blackboard;
62 
68  void findTexts(IngestJobContext context) {
69  Case openCase;
70  try {
71  openCase = Case.getCurrentCaseThrows();
72  } catch (NoCurrentCaseException ex) {
73  logger.log(Level.SEVERE, "Exception while getting open case.", ex); //NON-NLS
74  return;
75  }
76  blackboard = openCase.getServices().getBlackboard();
77  try {
78  SleuthkitCase skCase = openCase.getSleuthkitCase();
79  absFiles = skCase.findAllFilesWhere("name ='mmssms.db'"); //NON-NLS //get exact file name
80  if (absFiles.isEmpty()) {
81  return;
82  }
83  for (AbstractFile file : absFiles) {
84  try {
85  jFile = new java.io.File(Case.getCurrentCaseThrows().getTempDirectory(), file.getName().replaceAll("[<>%|\"/:*\\\\]", ""));
86  dbPath = jFile.toString(); //path of file as string
87  fileId = file.getId();
88  ContentUtils.writeToFile(file, jFile, context::dataSourceIngestIsCancelled);
89  findTextsInDB(dbPath, fileId);
90  } catch (ReadContentInputStream.ReadContentInputStreamException ex) {
91  logger.log(Level.WARNING, String.format("Error reading content from file '%s' (id=%d).", file.getName(), fileId), ex); //NON-NLS
92  } catch (Exception ex) {
93  logger.log(Level.SEVERE, String.format("Error writing content from file '%s' (id=%d) to '%s'.", file.getName(), fileId, dbPath), ex); //NON-NLS
94  }
95  }
96  } catch (TskCoreException e) {
97  logger.log(Level.SEVERE, "Error finding text messages", e); //NON-NLS
98  }
99  }
100 
108  @Messages({"TextMessageAnalyzer.indexError.message=Failed to index text message artifact for keyword search."})
109  private void findTextsInDB(String DatabasePath, long fileId) {
110  if (DatabasePath == null || DatabasePath.isEmpty()) {
111  return;
112  }
113  Case currentCase;
114  try {
115  currentCase = Case.getCurrentCaseThrows();
116  } catch (NoCurrentCaseException ex) {
117  logger.log(Level.SEVERE, "Exception while getting open case.", ex); //NON-NLS
118  return;
119  }
120  try {
121  Class.forName("org.sqlite.JDBC"); //NON-NLS //load JDBC driver
122  connection = DriverManager.getConnection("jdbc:sqlite:" + DatabasePath); //NON-NLS
123  statement = connection.createStatement();
124  } catch (ClassNotFoundException | SQLException e) {
125  logger.log(Level.SEVERE, "Error opening database", e); //NON-NLS
126  }
127 
128  SleuthkitCase skCase = currentCase.getSleuthkitCase();
129  try {
130  AbstractFile file = skCase.getAbstractFileById(fileId);
131  if (file == null) {
132  logger.log(Level.SEVERE, "Error getting abstract file {0}", fileId); //NON-NLS
133  return;
134  }
135 
136  try {
137  resultSet = statement.executeQuery(
138  "SELECT address,date,type,subject,body FROM sms;"); //NON-NLS
139 
140  BlackboardArtifact bba;
141  String address; // may be phone number, or other addresses
142  String date;//unix time
143  String type; // message received in inbox = 1, message sent = 2
144  String subject;//message subject
145  String body; //message body
146  while (resultSet.next()) {
147  address = resultSet.getString("address"); //NON-NLS
148  date = resultSet.getString("date"); //NON-NLS
149  type = resultSet.getString("type"); //NON-NLS
150  subject = resultSet.getString("subject"); //NON-NLS
151  body = resultSet.getString("body"); //NON-NLS
152 
153  bba = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE); //create Message artifact and then add attributes from result set.
154  Collection<BlackboardAttribute> attributes = new ArrayList<>();
155  // @@@ NEed to put into more specific TO or FROM
156  if (type.equals("1")) {
157  attributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DIRECTION, moduleName, NbBundle.getMessage(this.getClass(), "TextMessageAnalyzer.bbAttribute.incoming")));
158  attributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM, moduleName, address));
159  } else {
160  attributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DIRECTION, moduleName, NbBundle.getMessage(this.getClass(), "TextMessageAnalyzer.bbAttribute.outgoing")));
161  attributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO, moduleName, address));
162  }
163  attributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, moduleName, date));
164  attributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DIRECTION, moduleName, type));
165  attributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SUBJECT, moduleName, subject));
166  attributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT, moduleName, body));
167  attributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE, moduleName, NbBundle.getMessage(this.getClass(), "TextMessageAnalyzer.bbAttribute.smsMessage")));
168 
169  bba.addAttributes(attributes);
170  try {
171  // index the artifact for keyword search
172  blackboard.indexArtifact(bba);
173  } catch (Blackboard.BlackboardException ex) {
174  logger.log(Level.SEVERE, "Unable to index blackboard artifact " + bba.getArtifactID(), ex); //NON-NLS
175  MessageNotifyUtil.Notify.error(
176  Bundle.TextMessageAnalyzer_indexError_message(), bba.getDisplayName());
177  }
178  }
179 
180  } catch (Exception e) {
181  logger.log(Level.SEVERE, "Error parsing text messages to Blackboard", e); //NON-NLS
182  } finally {
183  try {
184  resultSet.close();
185  statement.close();
186  connection.close();
187  } catch (Exception e) {
188  logger.log(Level.SEVERE, "Error closing database", e); //NON-NLS
189  }
190  }
191  } catch (Exception e) {
192  logger.log(Level.SEVERE, "Error parsing text messages to Blackboard", e); //NON-NLS
193  }
194 
195  }
196 
197 }

Copyright © 2012-2018 Basis Technology. Generated on: Thu Oct 4 2018
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.