Autopsy  4.9.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
EncryptionDetectionTools.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2018 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.modules.encryptiondetection;
20 
21 import java.io.BufferedInputStream;
22 import java.io.IOException;
23 import java.io.InputStream;
24 import org.openide.util.NbBundle;
26 import org.sleuthkit.datamodel.ReadContentInputStream;
27 import org.sleuthkit.datamodel.Content;
28 
32 final class EncryptionDetectionTools {
33 
34  private static final double ONE_OVER_LOG2 = 1.4426950408889634073599246810019; // (1 / log(2))
35  private static final int BYTE_OCCURENCES_BUFFER_SIZE = 256;
36  static final double MINIMUM_ENTROPY_INPUT_RANGE_MIN = 6.0;
37  static final double MINIMUM_ENTROPY_INPUT_RANGE_MAX = 8.0;
38  static final int MINIMUM_FILE_SIZE_INPUT_RANGE_MIN = 1;
39 
40  @NbBundle.Messages({
41  "EncryptionDetectionTools.errorMessage.minimumEntropyInput=Minimum entropy input must be a number between 6.0 and 8.0."
42  })
47  static void validateMinEntropyValue(double minimumEntropy) throws IngestModule.IngestModuleException {
48  if (minimumEntropy < MINIMUM_ENTROPY_INPUT_RANGE_MIN || minimumEntropy > MINIMUM_ENTROPY_INPUT_RANGE_MAX) {
49  throw new IngestModule.IngestModuleException(Bundle.EncryptionDetectionTools_errorMessage_minimumEntropyInput());
50  }
51  }
52 
53  @NbBundle.Messages({
54  "EncryptionDetectionTools.errorMessage.minimumFileSizeInput=Minimum file size input must be an integer (in megabytes) of 1 or greater."
55  })
60  static void validateMinFileSizeValue(int minimumFileSize) throws IngestModule.IngestModuleException {
61  if (minimumFileSize < MINIMUM_FILE_SIZE_INPUT_RANGE_MIN) {
62  throw new IngestModule.IngestModuleException(Bundle.EncryptionDetectionTools_errorMessage_minimumFileSizeInput());
63  }
64  }
65 
66 
80  static double calculateEntropy(Content content) throws ReadContentInputStream.ReadContentInputStreamException, IOException {
81  /*
82  * Logic in this method is based on
83  * https://github.com/willjasen/entropy/blob/master/entropy.java
84  */
85 
86  InputStream in = null;
87  BufferedInputStream bin = null;
88 
89  try {
90  in = new ReadContentInputStream(content);
91  bin = new BufferedInputStream(in);
92 
93  /*
94  * Determine the number of times each byte value appears.
95  */
96  int[] byteOccurences = new int[BYTE_OCCURENCES_BUFFER_SIZE];
97  int readByte;
98  while ((readByte = bin.read()) != -1) {
99  byteOccurences[readByte]++;
100  }
101 
102  /*
103  * Calculate the entropy based on the byte occurence counts.
104  */
105  long dataLength = content.getSize() - 1;
106  double entropyAccumulator = 0;
107  for (int i = 0; i < BYTE_OCCURENCES_BUFFER_SIZE; i++) {
108  if (byteOccurences[i] > 0) {
109  double byteProbability = (double) byteOccurences[i] / (double) dataLength;
110  entropyAccumulator += (byteProbability * Math.log(byteProbability) * ONE_OVER_LOG2);
111  }
112  }
113 
114  return -entropyAccumulator;
115 
116  } finally {
117  if (in != null) {
118  in.close();
119  }
120  if (bin != null) {
121  bin.close();
122  }
123  }
124  }
125 
129  private EncryptionDetectionTools() {
130  }
131 }

Copyright © 2012-2018 Basis Technology. Generated on: Tue Dec 18 2018
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.