From a34cf8e53193d677a9bca655b4d3f424bbef52ed Mon Sep 17 00:00:00 2001 From: "U-BASIS\\zhaohui" Date: Thu, 5 Apr 2018 14:40:03 -0400 Subject: [PATCH] 3597: 5th test for file type filter test. --- .../autopsy/ingest/IngestFileFiltersTest.java | 78 ++++++++++++++++--- 1 file changed, 66 insertions(+), 12 deletions(-) diff --git a/Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java b/Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java index 972c3488e8..ad51847434 100644 --- a/Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java +++ b/Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/IngestFileFiltersTest.java @@ -48,6 +48,7 @@ import org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.ExtensionCon import org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.FullNameCondition; import org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.MetaTypeCondition; import org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.ParentPathCondition; +import org.sleuthkit.autopsy.modules.photoreccarver.PhotoRecCarverIngestModuleFactory; import org.sleuthkit.autopsy.testutils.DataSourceProcessorRunner; import org.sleuthkit.autopsy.testutils.DataSourceProcessorRunner.ProcessorCallback; import org.sleuthkit.autopsy.testutils.IngestJobRunner; @@ -133,11 +134,13 @@ public class IngestFileFiltersTest extends NbTestCase { HashMap rule = new HashMap<>(); rule.put("Rule", new Rule("testFileType", null, new MetaTypeCondition(MetaTypeCondition.Type.FILES), new ParentPathCondition("dir1"), null, null, null)); //Filter for dir1 and no unallocated space - FilesSet Files_Dirs_Unalloc_Ingest_Filter = new FilesSet("Filter", "Filter to find all files in dir1.", false, true, rule); + FilesSet dirFilter = new FilesSet("Filter", "Filter to find all files in dir1.", false, true, rule); try { Case openCase = Case.getOpenCase(); - runIngestJob(openCase.getDataSources(), Files_Dirs_Unalloc_Ingest_Filter); + ArrayList templates = new ArrayList<>(); + templates.add(getIngestModuleTemplate(new FileTypeIdModuleFactory())); + runIngestJob(openCase.getDataSources(), templates, dirFilter); FileManager fileManager = openCase.getServices().getFileManager(); List results = fileManager.findFiles("file.jpg", "dir1"); String mimeType = results.get(0).getMIMEType(); @@ -171,7 +174,9 @@ public class IngestFileFiltersTest extends NbTestCase { try { Case openCase = Case.getOpenCase(); - runIngestJob(openCase.getDataSources(), filesExtDirsFilter); + ArrayList templates = new ArrayList<>(); + templates.add(getIngestModuleTemplate(new FileTypeIdModuleFactory())); + runIngestJob(openCase.getDataSources(), templates, filesExtDirsFilter); FileManager fileManager = Case.getOpenCase().getServices().getFileManager(); List results = fileManager.findFiles("%%"); assertEquals(62, results.size()); @@ -200,7 +205,9 @@ public class IngestFileFiltersTest extends NbTestCase { try { Case openCase = Case.getOpenCase(); - runIngestJob(openCase.getDataSources(), filesExtDirsFilter); + ArrayList templates = new ArrayList<>(); + templates.add(getIngestModuleTemplate(new FileTypeIdModuleFactory())); + runIngestJob(openCase.getDataSources(), templates, filesExtDirsFilter); FileManager fileManager = Case.getOpenCase().getServices().getFileManager(); List results = fileManager.findFiles("%%"); assertEquals(62, results.size()); @@ -236,7 +243,10 @@ public class IngestFileFiltersTest extends NbTestCase { try { Case openCase = Case.getOpenCase(); - runIngestJob(openCase.getDataSources(), fullNameFilter); + ArrayList templates = new ArrayList<>(); + templates.add(getIngestModuleTemplate(new FileTypeIdModuleFactory())); + + runIngestJob(openCase.getDataSources(), templates, fullNameFilter); FileManager fileManager = Case.getOpenCase().getServices().getFileManager(); List results = fileManager.findFiles("%%"); assertEquals(62, results.size()); @@ -255,13 +265,51 @@ public class IngestFileFiltersTest extends NbTestCase { Assert.fail(ex); } } - private void runIngestJob(List datasources, FilesSet filter) { - FileTypeIdModuleFactory factory = new FileTypeIdModuleFactory(); - IngestModuleIngestJobSettings settings = factory.getDefaultIngestJobSettings(); - IngestModuleTemplate template = new IngestModuleTemplate(factory, settings); - template.setEnabled(true); - ArrayList templates = new ArrayList<>(); - templates.add(template); + + public void testCarvingWithExtRuleAndUnallocSpace() { + HashMap rules = new HashMap<>(); + rules.put("rule1", new Rule("FindJpgExtention", new ExtensionCondition("jpg"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null)); + rules.put("rule2", new Rule("FindGifExtention", new ExtensionCondition("gif"), new MetaTypeCondition(MetaTypeCondition.Type.FILES), null, null, null, null)); + + //Build the filter to find files with .jpg and .gif extension and unallocated space + FilesSet extensionFilter = new FilesSet("Filter", "Filter to files with .jpg and .gif extension.", false, false, rules); + + try { + Case openCase = Case.getOpenCase(); + ArrayList templates = new ArrayList<>(); + templates.add(getIngestModuleTemplate(new FileTypeIdModuleFactory())); + templates.add(getIngestModuleTemplate(new PhotoRecCarverIngestModuleFactory())); + runIngestJob(openCase.getDataSources(), templates, extensionFilter); + FileManager fileManager = Case.getOpenCase().getServices().getFileManager(); + List results = fileManager.findFiles("%%"); + assertEquals(70, results.size()); + int carvedJpgGifFiles = 0; + for (AbstractFile file : results) { + if (file.getNameExtension().equalsIgnoreCase("jpg") || file.getNameExtension().equalsIgnoreCase("gif")) { //Unalloc file and .jpg files in dir1, dir2, $CarvedFiles, root directory should have MIME type + String errMsg = String.format("File %s (objId=%d) unexpectedly blocked by the file filter.", file.getName(), file.getId()); + assertTrue(errMsg, file.getMIMEType() != null && !file.getMIMEType().isEmpty()); + + if (file.getParentPath().equalsIgnoreCase("/$CarvedFiles/")) { + carvedJpgGifFiles++; + } + } else if (file.getName().startsWith("Unalloc_")) { + String errMsg = String.format("File %s (objId=%d) unexpectedly blocked by the file filter.", file.getName(), file.getId()); + assertTrue(errMsg, file.getMIMEType() != null && !file.getMIMEType().isEmpty()); + } else { //All other files should not have MIME type. + String errMsg = String.format("File %s (objId=%d) unexpectedly passed by the file filter.", file.getName(), file.getId()); + assertTrue(errMsg, file.getMIMEType() == null); + } + } + //Make sure we have carved jpg/gif files + assertEquals(2, carvedJpgGifFiles); + + } catch (NoCurrentCaseException | TskCoreException ex) { + Exceptions.printStackTrace(ex); + Assert.fail(ex); + } + } + + private void runIngestJob(List datasources, ArrayList templates, FilesSet filter) { IngestJobSettings ingestJobSettings = new IngestJobSettings(IngestFileFiltersTest.class.getCanonicalName(), IngestType.FILES_ONLY, templates, filter); try { List errs = IngestJobRunner.runIngestJob(datasources, ingestJobSettings); @@ -275,4 +323,10 @@ public class IngestFileFiltersTest extends NbTestCase { } } + private IngestModuleTemplate getIngestModuleTemplate(IngestModuleFactoryAdapter factory) { + IngestModuleIngestJobSettings settings = factory.getDefaultIngestJobSettings(); + IngestModuleTemplate template = new IngestModuleTemplate(factory, settings); + template.setEnabled(true); + return template; + } }