codex-admin/autopsy
1
0
Fork 0
mirror of https://github.com/elisspace/autopsy.git synced 2026-10-05 08:46:20 +00:00
Code Issues Releases Wiki Activity

3597: 5th test for file type filter test.

Browse Source
This commit is contained in:
U-BASIS\zhaohui
2018-04-05 14:40:03 -04:00
parent 3c652a20f3
commit a34cf8e531
1 changed files with 66 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java
+66 -12
View File
@@ -48,6 +48,7 @@ import org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.ExtensionCon
import org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.FullNameCondition;
import org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.MetaTypeCondition;
import org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.ParentPathCondition;
import org.sleuthkit.autopsy.modules.photoreccarver.PhotoRecCarverIngestModuleFactory;
import org.sleuthkit.autopsy.testutils.DataSourceProcessorRunner;
import org.sleuthkit.autopsy.testutils.DataSourceProcessorRunner.ProcessorCallback;
import org.sleuthkit.autopsy.testutils.IngestJobRunner;
@@ -133,11 +134,13 @@ public class IngestFileFiltersTest extends NbTestCase {
HashMap<String, Rule> rule = new HashMap<>();
rule.put("Rule", new Rule("testFileType", null, new MetaTypeCondition(MetaTypeCondition.Type.FILES), new ParentPathCondition("dir1"), null, null, null));
//Filter for dir1 and no unallocated space
FilesSet Files_Dirs_Unalloc_Ingest_Filter = new FilesSet("Filter", "Filter to find all files in dir1.", false, true, rule);
FilesSet dirFilter = new FilesSet("Filter", "Filter to find all files in dir1.", false, true, rule);
try {
Case openCase = Case.getOpenCase();
runIngestJob(openCase.getDataSources(), Files_Dirs_Unalloc_Ingest_Filter);
ArrayList<IngestModuleTemplate> templates = new ArrayList<>();
templates.add(getIngestModuleTemplate(new FileTypeIdModuleFactory()));
runIngestJob(openCase.getDataSources(), templates, dirFilter);
FileManager fileManager = openCase.getServices().getFileManager();
List<AbstractFile> results = fileManager.findFiles("file.jpg", "dir1");
String mimeType = results.get(0).getMIMEType();
@@ -171,7 +174,9 @@ public class IngestFileFiltersTest extends NbTestCase {
try {
Case openCase = Case.getOpenCase();
runIngestJob(openCase.getDataSources(), filesExtDirsFilter);
ArrayList<IngestModuleTemplate> templates = new ArrayList<>();
templates.add(getIngestModuleTemplate(new FileTypeIdModuleFactory()));
runIngestJob(openCase.getDataSources(), templates, filesExtDirsFilter);
FileManager fileManager = Case.getOpenCase().getServices().getFileManager();
List<AbstractFile> results = fileManager.findFiles("%%");
assertEquals(62, results.size());
@@ -200,7 +205,9 @@ public class IngestFileFiltersTest extends NbTestCase {
try {
Case openCase = Case.getOpenCase();
runIngestJob(openCase.getDataSources(), filesExtDirsFilter);
ArrayList<IngestModuleTemplate> templates = new ArrayList<>();
templates.add(getIngestModuleTemplate(new FileTypeIdModuleFactory()));
runIngestJob(openCase.getDataSources(), templates, filesExtDirsFilter);
FileManager fileManager = Case.getOpenCase().getServices().getFileManager();
List<AbstractFile> results = fileManager.findFiles("%%");
assertEquals(62, results.size());
@@ -236,7 +243,10 @@ public class IngestFileFiltersTest extends NbTestCase {
try {
Case openCase = Case.getOpenCase();
runIngestJob(openCase.getDataSources(), fullNameFilter);
ArrayList<IngestModuleTemplate> templates = new ArrayList<>();
templates.add(getIngestModuleTemplate(new FileTypeIdModuleFactory()));
runIngestJob(openCase.getDataSources(), templates, fullNameFilter);
FileManager fileManager = Case.getOpenCase().getServices().getFileManager();
List<AbstractFile> results = fileManager.findFiles("%%");
assertEquals(62, results.size());
@@ -255,13 +265,51 @@ public class IngestFileFiltersTest extends NbTestCase {
Assert.fail(ex);
}
}
private void runIngestJob(List<Content> datasources, FilesSet filter) {
FileTypeIdModuleFactory factory = new FileTypeIdModuleFactory();
IngestModuleIngestJobSettings settings = factory.getDefaultIngestJobSettings();
IngestModuleTemplate template = new IngestModuleTemplate(factory, settings);
template.setEnabled(true);
ArrayList<IngestModuleTemplate> templates = new ArrayList<>();
templates.add(template);
public void testCarvingWithExtRuleAndUnallocSpace() {
HashMap<String, Rule> rules = new HashMap<>();
rules.put("rule1", new Rule("FindJpgExtention", new ExtensionCondition("jpg"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null));
rules.put("rule2", new Rule("FindGifExtention", new ExtensionCondition("gif"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null));
//Build the filter to find files with .jpg and .gif extension and unallocated space
FilesSet extensionFilter = new FilesSet("Filter", "Filter to files with .jpg and .gif extension.", false, false, rules);
try {
Case openCase = Case.getOpenCase();
ArrayList<IngestModuleTemplate> templates = new ArrayList<>();
templates.add(getIngestModuleTemplate(new FileTypeIdModuleFactory()));
templates.add(getIngestModuleTemplate(new PhotoRecCarverIngestModuleFactory()));
runIngestJob(openCase.getDataSources(), templates, extensionFilter);
FileManager fileManager = Case.getOpenCase().getServices().getFileManager();
List<AbstractFile> results = fileManager.findFiles("%%");
assertEquals(70, results.size());
int carvedJpgGifFiles = 0;
for (AbstractFile file : results) {
if (file.getNameExtension().equalsIgnoreCase("jpg") || file.getNameExtension().equalsIgnoreCase("gif")) { //Unalloc file and .jpg files in dir1, dir2, $CarvedFiles, root directory should have MIME type
String errMsg = String.format("File %s (objId=%d) unexpectedly blocked by the file filter.", file.getName(), file.getId());
assertTrue(errMsg, file.getMIMEType() != null && !file.getMIMEType().isEmpty());
if (file.getParentPath().equalsIgnoreCase("/$CarvedFiles/")) {
carvedJpgGifFiles++;
}
} else if (file.getName().startsWith("Unalloc_")) {
String errMsg = String.format("File %s (objId=%d) unexpectedly blocked by the file filter.", file.getName(), file.getId());
assertTrue(errMsg, file.getMIMEType() != null && !file.getMIMEType().isEmpty());
} else { //All other files should not have MIME type.
String errMsg = String.format("File %s (objId=%d) unexpectedly passed by the file filter.", file.getName(), file.getId());
assertTrue(errMsg, file.getMIMEType() == null);
}
}
//Make sure we have carved jpg/gif files
assertEquals(2, carvedJpgGifFiles);
} catch (NoCurrentCaseException | TskCoreException ex) {
Exceptions.printStackTrace(ex);
Assert.fail(ex);
}
}
private void runIngestJob(List<Content> datasources, ArrayList<IngestModuleTemplate> templates, FilesSet filter) {
IngestJobSettings ingestJobSettings = new IngestJobSettings(IngestFileFiltersTest.class.getCanonicalName(), IngestType.FILES_ONLY, templates, filter);
try {
List<IngestModuleError> errs = IngestJobRunner.runIngestJob(datasources, ingestJobSettings);
@@ -275,4 +323,10 @@ public class IngestFileFiltersTest extends NbTestCase {
}
}
private IngestModuleTemplate getIngestModuleTemplate(IngestModuleFactoryAdapter factory) {
IngestModuleIngestJobSettings settings = factory.getDefaultIngestJobSettings();
IngestModuleTemplate template = new IngestModuleTemplate(factory, settings);
template.setEnabled(true);
return template;
}
}