From 4ee75ef41b1f82a707501f5c8ff593eb890790ca Mon Sep 17 00:00:00 2001
From: adam-m <amalinowski@basistech.com>
Date: Mon, 4 Mar 2013 18:14:50 -0500
Subject: [PATCH] add signature-based check for JPEG to EXIF module

---
 .../ExifParserFileIngestModule.java           | 38 ++++++++++++++++++-
 1 file changed, 37 insertions(+), 1 deletion(-)

diff --git a/ExifParser/src/org/sleuthkit/autopsy/exifparser/ExifParserFileIngestModule.java b/ExifParser/src/org/sleuthkit/autopsy/exifparser/ExifParserFileIngestModule.java
index e217f1aefd..8ed704691f 100644
--- a/ExifParser/src/org/sleuthkit/autopsy/exifparser/ExifParserFileIngestModule.java
+++ b/ExifParser/src/org/sleuthkit/autopsy/exifparser/ExifParserFileIngestModule.java
@@ -31,6 +31,7 @@ import com.drew.metadata.exif.GpsDirectory;
 import java.io.BufferedInputStream;
 import java.io.IOException;
 import java.io.InputStream;
+import java.nio.ByteBuffer;
 import java.util.ArrayList;
 import java.util.Calendar;
 import java.util.Collection;
@@ -70,6 +71,10 @@ public final class ExifParserFileIngestModule implements IngestModuleAbstractFil
     
     private String args;
     
+    private static final int readHeaderSize = 2;
+    private final byte[] fileHeaderBuffer = new byte[readHeaderSize];
+    private static final char JPEG_SIGNATURE_BE = 0xFFD8;
+    
     private static final Logger logger = Logger.getLogger(ExifParserFileIngestModule.class.getName());
     private static ExifParserFileIngestModule defaultInstance = null;
     private static int messageId = 0;
@@ -183,6 +188,12 @@ public final class ExifParserFileIngestModule implements IngestModuleAbstractFil
         return IngestModuleAbstractFile.ProcessResult.ERROR;
     }
     
+    /**
+     * Checks if should try to attempt to extract exif.
+     * Currently checks if JPEG image, first by extension, then by signature (if extension fails)
+     * @param f file to be checked 
+     * @return true if to be processed 
+     */
     private boolean parsableFormat(AbstractFile f) {
         // Get the name, extension
         String name = f.getName();
@@ -195,8 +206,33 @@ public final class ExifParserFileIngestModule implements IngestModuleAbstractFil
             return true;
         }
         
-        return false;
+        return isJpegFileHeader(f);
+        
     }
+    
+        /**
+     * Check if is jpeg file based on header
+     * @param file
+     * @return true if jpeg file, false otherwise
+     */
+    private boolean isJpegFileHeader(AbstractFile file) {
+        int bytesRead = 0;
+        try {
+            bytesRead = file.read(fileHeaderBuffer, 0, readHeaderSize);
+        } catch (TskCoreException ex) {
+            logger.log(Level.SEVERE, "Error reading file header to determine if Jpeg/Exif file: " + file.getName(), ex);
+        }
+        if (bytesRead != readHeaderSize) {
+            return false;
+        }
+        
+        ByteBuffer bytes = ByteBuffer.wrap(fileHeaderBuffer);
+        char signature = bytes.getChar();
+        
+        return signature == JPEG_SIGNATURE_BE;
+        
+    }
+    
 
     @Override
     public void complete() {