From fef91bca201502dcdfdb4e97e8ddfcba52600122 Mon Sep 17 00:00:00 2001 From: Richard Cordovano Date: Thu, 20 Feb 2014 13:14:30 -0500 Subject: [PATCH] Make HashDbIngestModule implement FileINgestModule instead of extend IngestModuleAbstractFile --- .../hashdatabase/HashDbIngestModule.java | 289 +++++------------- 1 file changed, 82 insertions(+), 207 deletions(-) diff --git a/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbIngestModule.java b/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbIngestModule.java index 8910292525..c18916b250 100644 --- a/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbIngestModule.java +++ b/HashDatabase/src/org/sleuthkit/autopsy/hashdatabase/HashDbIngestModule.java @@ -23,15 +23,10 @@ import java.util.ArrayList; import java.util.Collections; import java.util.List; import java.util.logging.Level; - import org.openide.util.NbBundle; import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.coreutils.Logger; -import org.sleuthkit.autopsy.coreutils.Version; -import org.sleuthkit.autopsy.ingest.PipelineContext; import org.sleuthkit.autopsy.ingest.IngestMessage; -import org.sleuthkit.autopsy.ingest.IngestModuleAbstractFile; -import org.sleuthkit.autopsy.ingest.IngestModuleInit; import org.sleuthkit.autopsy.ingest.IngestServices; import org.sleuthkit.autopsy.ingest.ModuleDataEvent; import org.sleuthkit.datamodel.AbstractFile; @@ -48,17 +43,9 @@ import org.sleuthkit.autopsy.hashdatabase.HashDbManager.HashDb; import org.sleuthkit.autopsy.ingest.FileIngestModule; import org.sleuthkit.datamodel.HashInfo; -public class HashDbIngestModule extends IngestModuleAbstractFile implements FileIngestModule { - private static HashDbIngestModule instance = null; - public final static String MODULE_NAME = NbBundle.getMessage(HashDbIngestModule.class, - "HashDbIngestModule.moduleName"); - public final static String MODULE_DESCRIPTION = NbBundle.getMessage(HashDbIngestModule.class, - "HashDbIngestModule.moduleDescription"); - final public static String MODULE_VERSION = Version.getVersion(); +public class HashDbIngestModule implements FileIngestModule { private static final Logger logger = Logger.getLogger(HashDbIngestModule.class.getName()); private static final int MAX_COMMENT_SIZE = 500; - private HashDbSimpleConfigPanel simpleConfigPanel; - private HashDbConfigPanel advancedConfigPanel; private IngestServices services; private SleuthkitCase skCase; private static int messageId = 0; @@ -72,78 +59,6 @@ public class HashDbIngestModule extends IngestModuleAbstractFile implements File HashDbIngestModule() { } - - public static synchronized HashDbIngestModule getDefault() { - if (instance == null) { - instance = new HashDbIngestModule(); - } - return instance; - } - - @Override - public String getName() { - return MODULE_NAME; - } - - @Override - public String getDescription() { - return MODULE_DESCRIPTION; - } - - @Override - public String getVersion() { - return MODULE_VERSION; - } - - @Override - public boolean hasSimpleConfiguration() { - return true; - } - - @Override - public javax.swing.JPanel getSimpleConfiguration(String context) { - if (null == simpleConfigPanel) { - simpleConfigPanel = new HashDbSimpleConfigPanel(); - } - else { - simpleConfigPanel.load(); - } - - return simpleConfigPanel; - } - - @Override - public void saveSimpleConfiguration() { - if (simpleConfigPanel != null) { - simpleConfigPanel.store(); - } - } - - @Override - public boolean hasAdvancedConfiguration() { - return true; - } - - @Override - public javax.swing.JPanel getAdvancedConfiguration(String context) { - if (advancedConfigPanel == null) { - advancedConfigPanel = new HashDbConfigPanel(); - } - - advancedConfigPanel.load(); - return advancedConfigPanel; - } - - @Override - public void saveAdvancedConfiguration() { - if (advancedConfigPanel != null) { - advancedConfigPanel.store(); - } - - if (simpleConfigPanel != null) { - simpleConfigPanel.load(); - } - } @Override public void init(long dataSourceTaskId) { @@ -156,51 +71,25 @@ public class HashDbIngestModule extends IngestModuleAbstractFile implements File calcHashesIsSet = hashDbManager.getAlwaysCalculateHashes(); if (knownHashSets.isEmpty()) { - services.postMessage(IngestMessage.createWarningMessage(++messageId, - this, - NbBundle.getMessage(this.getClass(), - "HashDbIngestModule.noKnownHashDbSetMsg"), - NbBundle.getMessage(this.getClass(), - "HashDbIngestModule.knownFileSearchWillNotExecuteWarn"))); + // RJCTODO +// services.postMessage(IngestMessage.createWarningMessage(++messageId, +// this, +// NbBundle.getMessage(this.getClass(), +// "HashDbIngestModule.noKnownHashDbSetMsg"), +// NbBundle.getMessage(this.getClass(), +// "HashDbIngestModule.knownFileSearchWillNotExecuteWarn"))); } if (knownBadHashSets.isEmpty()) { - services.postMessage(IngestMessage.createWarningMessage(++messageId, - this, - NbBundle.getMessage(this.getClass(), - "HashDbIngestModule.noKnownBadHashDbSetMsg"), - NbBundle.getMessage(this.getClass(), - "HashDbIngestModule.knownBadFileSearchWillNotExecuteWarn"))); + // RJCTODO +// services.postMessage(IngestMessage.createWarningMessage(++messageId, +// this, +// NbBundle.getMessage(this.getClass(), +// "HashDbIngestModule.noKnownBadHashDbSetMsg"), +// NbBundle.getMessage(this.getClass(), +// "HashDbIngestModule.knownBadFileSearchWillNotExecuteWarn"))); } } - @Override - public void init(IngestModuleInit initContext) { - services = IngestServices.getDefault(); - skCase = Case.getCurrentCase().getSleuthkitCase(); - - HashDbManager hashDbManager = HashDbManager.getInstance(); - getHashSetsUsableForIngest(hashDbManager.getKnownBadFileHashSets(), knownBadHashSets); - getHashSetsUsableForIngest(hashDbManager.getKnownFileHashSets(), knownHashSets); - calcHashesIsSet = hashDbManager.getAlwaysCalculateHashes(); - - if (knownHashSets.isEmpty()) { - services.postMessage(IngestMessage.createWarningMessage(++messageId, - this, - NbBundle.getMessage(this.getClass(), - "HashDbIngestModule.noKnownHashDbSetMsg"), - NbBundle.getMessage(this.getClass(), - "HashDbIngestModule.knownFileSearchWillNotExecuteWarn"))); - } - if (knownBadHashSets.isEmpty()) { - services.postMessage(IngestMessage.createWarningMessage(++messageId, - this, - NbBundle.getMessage(this.getClass(), - "HashDbIngestModule.noKnownBadHashDbSetMsg"), - NbBundle.getMessage(this.getClass(), - "HashDbIngestModule.knownBadFileSearchWillNotExecuteWarn"))); - } - } - private void getHashSetsUsableForIngest(List hashDbs, List hashDbsForIngest) { assert hashDbs != null; assert hashDbsForIngest != null; @@ -219,11 +108,6 @@ public class HashDbIngestModule extends IngestModuleAbstractFile implements File } } - @Override - public boolean hasBackgroundJobsRunning() { - return false; - } - @Override public void process(AbstractFile file) { // Skip unallocated space files. @@ -231,23 +115,10 @@ public class HashDbIngestModule extends IngestModuleAbstractFile implements File return; } - processFile(file); - } - - @Override - public ProcessResult process(PipelineContextpipelineContext, AbstractFile file) { - //skip unalloc - if (file.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS)) { - return IngestModuleAbstractFile.ProcessResult.OK; - } - - return processFile(file); - } - - private ProcessResult processFile(AbstractFile file) { // bail out if we have no hashes set if ((knownHashSets.isEmpty()) && (knownBadHashSets.isEmpty()) && (calcHashesIsSet == false)) { - return ProcessResult.OK; +// return ProcessResult.OK; + return; } // calc hash value @@ -260,21 +131,22 @@ public class HashDbIngestModule extends IngestModuleAbstractFile implements File calctime += (System.currentTimeMillis() - calcstart); } catch (IOException ex) { logger.log(Level.WARNING, "Error calculating hash of file " + name, ex); - services.postMessage(IngestMessage.createErrorMessage(++messageId, - HashDbIngestModule.this, - NbBundle.getMessage(this.getClass(), - "HashDbIngestModule.fileReadErrorMsg", - name), - NbBundle.getMessage(this.getClass(), - "HashDbIngestModule.calcHashValueErr", - name))); - return ProcessResult.ERROR; +// services.postMessage(IngestMessage.createErrorMessage(++messageId, +// HashDbIngestModule.this, +// NbBundle.getMessage(this.getClass(), +// "HashDbIngestModule.fileReadErrorMsg", +// name), +// NbBundle.getMessage(this.getClass(), +// "HashDbIngestModule.calcHashValueErr", +// name))); +// return ProcessResult.ERROR; + return; } } // look up in known bad first boolean foundBad = false; - ProcessResult ret = ProcessResult.OK; +// ProcessResult ret = ProcessResult.OK; for (HashDb db : knownBadHashSets) { try { long lookupstart = System.currentTimeMillis(); @@ -286,15 +158,15 @@ public class HashDbIngestModule extends IngestModuleAbstractFile implements File skCase.setKnown(file, TskData.FileKnown.BAD); } catch (TskException ex) { logger.log(Level.WARNING, "Couldn't set known bad state for file " + name + " - see sleuthkit log for details", ex); - services.postMessage(IngestMessage.createErrorMessage(++messageId, - HashDbIngestModule.this, - NbBundle.getMessage(this.getClass(), - "HashDbIngestModule.hashLookupErrorMsg", - name), - NbBundle.getMessage(this.getClass(), - "HashDbIngestModule.settingKnownBadStateErr", - name))); - ret = ProcessResult.ERROR; +// services.postMessage(IngestMessage.createErrorMessage(++messageId, +// HashDbIngestModule.this, +// NbBundle.getMessage(this.getClass(), +// "HashDbIngestModule.hashLookupErrorMsg", +// name), +// NbBundle.getMessage(this.getClass(), +// "HashDbIngestModule.settingKnownBadStateErr", +// name))); +// ret = ProcessResult.ERROR; } String hashSetName = db.getHashSetName(); @@ -317,15 +189,15 @@ public class HashDbIngestModule extends IngestModuleAbstractFile implements File lookuptime += (System.currentTimeMillis() - lookupstart); } catch (TskException ex) { logger.log(Level.WARNING, "Couldn't lookup known bad hash for file " + name + " - see sleuthkit log for details", ex); - services.postMessage(IngestMessage.createErrorMessage(++messageId, - HashDbIngestModule.this, - NbBundle.getMessage(this.getClass(), - "HashDbIngestModule.hashLookupErrorMsg", - name), - NbBundle.getMessage(this.getClass(), - "HashDbIngestModule.lookingUpKnownBadHashValueErr", - name))); - ret = ProcessResult.ERROR; +// services.postMessage(IngestMessage.createErrorMessage(++messageId, +// HashDbIngestModule.this, +// NbBundle.getMessage(this.getClass(), +// "HashDbIngestModule.hashLookupErrorMsg", +// name), +// NbBundle.getMessage(this.getClass(), +// "HashDbIngestModule.lookingUpKnownBadHashValueErr", +// name))); +// ret = ProcessResult.ERROR; } } @@ -342,38 +214,41 @@ public class HashDbIngestModule extends IngestModuleAbstractFile implements File break; } catch (TskException ex) { logger.log(Level.WARNING, "Couldn't set known state for file " + name + " - see sleuthkit log for details", ex); - services.postMessage(IngestMessage.createErrorMessage(++messageId, - HashDbIngestModule.this, - NbBundle.getMessage(this.getClass(), - "HashDbIngestModule.hashLookupErrorMsg", - name), - NbBundle.getMessage(this.getClass(), - "HashDbIngestModule.settingsKnownStateErr", - name))); - ret = ProcessResult.ERROR; +// services.postMessage(IngestMessage.createErrorMessage(++messageId, +// HashDbIngestModule.this, +// NbBundle.getMessage(this.getClass(), +// "HashDbIngestModule.hashLookupErrorMsg", +// name), +// NbBundle.getMessage(this.getClass(), +// "HashDbIngestModule.settingsKnownStateErr", +// name))); +// ret = ProcessResult.ERROR; } } lookuptime += (System.currentTimeMillis() - lookupstart); } catch (TskException ex) { logger.log(Level.WARNING, "Couldn't lookup known hash for file " + name + " - see sleuthkit log for details", ex); - services.postMessage(IngestMessage.createErrorMessage(++messageId, - HashDbIngestModule.this, - NbBundle.getMessage(this.getClass(), - "HashDbIngestModule.hashLookupErrorMsg", - name), - NbBundle.getMessage(this.getClass(), - "HashDbIngestModule.lookingUpKnownHashValueErr", - name))); - ret = ProcessResult.ERROR; +// services.postMessage(IngestMessage.createErrorMessage(++messageId, +// HashDbIngestModule.this, +// NbBundle.getMessage(this.getClass(), +// "HashDbIngestModule.hashLookupErrorMsg", +// name), +// NbBundle.getMessage(this.getClass(), +// "HashDbIngestModule.lookingUpKnownHashValueErr", +// name))); +// ret = ProcessResult.ERROR; } } } - return ret; +// return ret; } - + private void postHashSetHitToBlackboard(AbstractFile abstractFile, String md5Hash, String hashSetName, String comment, boolean showInboxMessage) { try { + // RJCTODO + String MODULE_NAME = NbBundle.getMessage(HashDbIngestModule.class, "HashDbIngestModule.moduleName"); + BlackboardArtifact badFile = abstractFile.newArtifact(ARTIFACT_TYPE.TSK_HASHSET_HIT); //TODO Revisit usage of deprecated constructor as per TSK-583 //BlackboardAttribute att2 = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), MODULE_NAME, "Known Bad", hashSetName); @@ -414,13 +289,13 @@ public class HashDbIngestModule extends IngestModuleAbstractFile implements File detailsSb.append(""); - services.postMessage(IngestMessage.createDataMessage(++messageId, this, - NbBundle.getMessage(this.getClass(), - "HashDbIngestModule.postToBB.knownBadMsg", - abstractFile.getName()), - detailsSb.toString(), - abstractFile.getName() + md5Hash, - badFile)); +// services.postMessage(IngestMessage.createDataMessage(++messageId, this, +// NbBundle.getMessage(this.getClass(), +// "HashDbIngestModule.postToBB.knownBadMsg", +// abstractFile.getName()), +// detailsSb.toString(), +// abstractFile.getName() + md5Hash, +// badFile)); } services.fireModuleDataEvent(new ModuleDataEvent(MODULE_NAME, ARTIFACT_TYPE.TSK_HASHSET_HIT, Collections.singletonList(badFile))); } catch (TskException ex) { @@ -457,12 +332,12 @@ public class HashDbIngestModule extends IngestModuleAbstractFile implements File } detailsSb.append(""); - services.postMessage(IngestMessage.createMessage(++messageId, - IngestMessage.MessageType.INFO, - this, - NbBundle.getMessage(this.getClass(), - "HashDbIngestModule.complete.hashLookupResults"), - detailsSb.toString())); +// services.postMessage(IngestMessage.createMessage(++messageId, +// IngestMessage.MessageType.INFO, +// this, +// NbBundle.getMessage(this.getClass(), +// "HashDbIngestModule.complete.hashLookupResults"), +// detailsSb.toString())); } }