diff --git a/bindings/java/src/org/sleuthkit/datamodel/AbstractFile.java b/bindings/java/src/org/sleuthkit/datamodel/AbstractFile.java
index 4d7d0adaa0c6a508520ddfc80f22086f323d2028..cf79c881a0a384e37a78eaa1216b250a86619e5a 100644
--- a/bindings/java/src/org/sleuthkit/datamodel/AbstractFile.java
+++ b/bindings/java/src/org/sleuthkit/datamodel/AbstractFile.java
@@ -21,6 +21,7 @@
import java.io.FileNotFoundException;
import java.io.IOException;
import java.io.RandomAccessFile;
+import java.lang.ref.SoftReference;
import java.sql.SQLException;
import java.sql.Statement;
import java.text.MessageFormat;
@@ -37,6 +38,7 @@
import java.util.logging.Level;
import java.util.logging.Logger;
import org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction;
+import org.sleuthkit.datamodel.TskData.CollectedStatus;
import org.sleuthkit.datamodel.TskData.FileKnown;
import org.sleuthkit.datamodel.TskData.TSK_FS_META_FLAG_ENUM;
import org.sleuthkit.datamodel.TskData.TSK_FS_META_TYPE_ENUM;
@@ -116,6 +118,10 @@ public abstract class AbstractFile extends AbstractContent {
private volatile String uniquePath;
private volatile FileSystem parentFileSystem;
+
+ private final boolean tryContentProviderStream;
+ private Object contentProviderStreamLock = new Object();
+ private SoftReference<ContentProviderStream> contentProviderStreamRef = null;
/**
* Initializes common fields used by AbstactFile implementations (objects in
@@ -227,6 +233,9 @@ public abstract class AbstractFile extends AbstractContent {
this.ownerUid = ownerUid;
this.osAccountObjId = osAccountObjectId;
this.collected = collected;
+ // any item that is marked as YES_REPO and there is a custom content provider for the db will attempt to use the content provider to provide data
+ // this will be flipped to false if there is no content provider stream from the content provider for this file
+ this.tryContentProviderStream = collected == CollectedStatus.YES_REPO && db.getContentProvider() != null;
if (Objects.nonNull(fileAttributes) && !fileAttributes.isEmpty()) {
this.fileAttributesCache.addAll(fileAttributes);
loadedAttributesCacheFromDb = true;
@@ -1062,12 +1071,48 @@ void removeMetaFlag(TSK_FS_META_FLAG_ENUM metaFlag) {
short getMetaFlagsAsInt() {
return TSK_FS_META_FLAG_ENUM.toInt(metaFlags);
}
+
+ /**
+ * Attempts to get cached or load the content provider stream for this file.
+ * If none exists, returns null.
+ *
+ * NOTE: Does not check the value for tryContentProviderStream before
+ * attempting.
+ *
+ * @return The content stream for this file or null if none exists.
+ *
+ * @throws TskCoreException
+ */
+ private ContentProviderStream getContentProviderStream() throws TskCoreException {
+ synchronized (contentProviderStreamLock) {
+ // try to get soft reference content provider stream
+ ContentProviderStream contentProviderStream = contentProviderStreamRef == null ? null : contentProviderStreamRef.get();
+ // load if not cached and then cache if present
+ if (contentProviderStream == null) {
+ ContentStreamProvider provider = getSleuthkitCase().getContentProvider();
+ contentProviderStream = provider == null ? null : provider.getContentStream(this).orElse(null);
+
+ if (contentProviderStream == null) {
+ throw new TskCoreException(MessageFormat.format("Could not get content provider string for file with obj id: {0}, path: {1}",
+ getId(),
+ getUniquePath()));
+ }
+
+ this.contentProviderStreamRef = new SoftReference<>(contentProviderStream);
+ }
+ return contentProviderStream;
+ }
+ }
+
@Override
public final int read(byte[] buf, long offset, long len) throws TskCoreException {
- //template method
- //if localPath is set, use local, otherwise, use readCustom() supplied by derived class
- if (localPathSet) {
+ // try to use content provider stream if should use
+ if (tryContentProviderStream) {
+ ContentProviderStream contentProviderStream = getContentProviderStream();
+ return contentProviderStream.read(buf, offset, len);
+ } else if (localPathSet) {
+ //if localPath is set, use local, otherwise, use readCustom() supplied by derived class
return readLocal(buf, offset, len);
} else {
return readInt(buf, offset, len);
@@ -1233,13 +1278,14 @@ final void setEncodingType(TskData.EncodingType encodingType) {
}
/**
- * Check if the file exists. If non-local always true, if local, checks if
- * actual local path exists
+ * Check if the file exists. If non-local or file is marked with YES_REPO
+ * and there is a content provider always true, if local, checks if actual
+ * local path exists
*
* @return true if the file exists, false otherwise
*/
public boolean exists() {
- if (!localPathSet) {
+ if (tryContentProviderStream || !localPathSet) {
return true;
} else {
try {
@@ -1254,13 +1300,13 @@ public boolean exists() {
/**
* Check if the file exists and is readable. If non-local (e.g. within an
- * image), always true, if local, checks if actual local path exists and is
- * readable
+ * image) or file is marked with YES_REPO and there is a content provider,
+ * always true, if local, checks if actual local path exists and is readable
*
* @return true if the file is readable
*/
public boolean canRead() {
- if (!localPathSet) {
+ if (tryContentProviderStream || !localPathSet) {
return true;
} else {
try {
diff --git a/bindings/java/src/org/sleuthkit/datamodel/ContentProviderStream.java b/bindings/java/src/org/sleuthkit/datamodel/ContentProviderStream.java
new file mode 100644
index 0000000000000000000000000000000000000000..5617362036bb1a9f2c55991bd7d39072c5e44552
--- /dev/null
+++ b/bindings/java/src/org/sleuthkit/datamodel/ContentProviderStream.java
@@ -0,0 +1,41 @@
+/*
+ * SleuthKit Java Bindings
+ *
+ * Copyright 2023 Basis Technology Corp.
+ * Contact: carrier <at> sleuthkit <dot> org
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.sleuthkit.datamodel;
+
+/**
+ * Custom provider for content bytes.
+ */
+@SuppressWarnings("try")
+public interface ContentProviderStream extends AutoCloseable {
+
+ /**
+ * Reads data that this content object is associated with (file contents,
+ * volume contents, etc.).
+ *
+ * @param buf a character array of data (in bytes) to copy read data to
+ * @param offset byte offset in the content to start reading from
+ * @param len number of bytes to read into buf.
+ *
+ * @return num of bytes read, or -1 on error
+ *
+ * @throws TskCoreException if critical error occurred during read in the
+ * tsk core
+ */
+ public int read(byte[] buf, long offset, long len) throws TskCoreException;
+}
diff --git a/bindings/java/src/org/sleuthkit/datamodel/ContentStreamProvider.java b/bindings/java/src/org/sleuthkit/datamodel/ContentStreamProvider.java
new file mode 100644
index 0000000000000000000000000000000000000000..c7b09bd2bd46e803ee7d64511d871569bd65efe8
--- /dev/null
+++ b/bindings/java/src/org/sleuthkit/datamodel/ContentStreamProvider.java
@@ -0,0 +1,38 @@
+/*
+ * SleuthKit Java Bindings
+ *
+ * Copyright 2023 Basis Technology Corp.
+ * Contact: carrier <at> sleuthkit <dot> org
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.sleuthkit.datamodel;
+
+import java.util.Optional;
+
+/**
+ * Custom provider for bytes of an abstract file.
+ */
+public interface ContentStreamProvider {
+
+ /**
+ * Provides a content stream for a content object or empty if this provider
+ * has none to provide.
+ *
+ * @param content The content.
+ *
+ * @return The content stream or empty if no stream can be provided for this
+ * content.
+ */
+ Optional<ContentProviderStream> getContentStream(Content content) throws TskCoreException;
+}
diff --git a/bindings/java/src/org/sleuthkit/datamodel/SleuthkitCase.java b/bindings/java/src/org/sleuthkit/datamodel/SleuthkitCase.java
index 39ae825cca0ebbc85470e1eabdcdbfbced43465d..03f6651654479baa3cec364b3f1b75e8381aeda4 100644
--- a/bindings/java/src/org/sleuthkit/datamodel/SleuthkitCase.java
+++ b/bindings/java/src/org/sleuthkit/datamodel/SleuthkitCase.java
@@ -203,7 +203,9 @@ public class SleuthkitCase {
private final Map<RootDirectoryKey, Long> rootDirectoryMap = new HashMap<>();
private final Cache<Long, Boolean> isRootDirectoryCache
= CacheBuilder.newBuilder().maximumSize(200000).expireAfterAccess(5, TimeUnit.MINUTES).build();
-
+ // custom provider for file bytes (can be null)
+ private final ContentStreamProvider contentProvider;
+
/*
* First parameter is used to specify the SparseBitSet to use, as object IDs
* can be larger than the max size of a SparseBitSet
@@ -332,10 +334,11 @@ public static void tryConnect(CaseDbConnectionInfo info) throws TskCoreException
* @param caseHandle A handle to a case database object in the native code
* SleuthKit layer.
* @param dbType The type of database we're dealing with
+ * @param contentProvider Custom provider for file content (can be null).
*
* @throws Exception
*/
- private SleuthkitCase(String dbPath, SleuthkitJNI.CaseDbHandle caseHandle, DbType dbType) throws Exception {
+ private SleuthkitCase(String dbPath, SleuthkitJNI.CaseDbHandle caseHandle, DbType dbType, ContentStreamProvider contentProvider) throws Exception {
Class.forName("org.sqlite.JDBC");
this.dbPath = dbPath;
this.dbType = dbType;
@@ -345,6 +348,7 @@ private SleuthkitCase(String dbPath, SleuthkitJNI.CaseDbHandle caseHandle, DbTyp
this.connections = new SQLiteConnections(dbPath);
this.caseHandle = caseHandle;
this.caseHandleIdentifier = caseHandle.getCaseDbIdentifier();
+ this.contentProvider = contentProvider;
init();
logSQLiteJDBCDriverInfo();
}
@@ -363,10 +367,11 @@ private SleuthkitCase(String dbPath, SleuthkitJNI.CaseDbHandle caseHandle, DbTyp
* @param dbType The type of database we're dealing with SleuthKit
* layer.
* @param caseDirPath The path to the root case directory.
+ * @param contentProvider Custom provider for file content (can be null).
*
* @throws Exception
*/
- private SleuthkitCase(String host, int port, String dbName, String userName, String password, SleuthkitJNI.CaseDbHandle caseHandle, String caseDirPath, DbType dbType) throws Exception {
+ private SleuthkitCase(String host, int port, String dbName, String userName, String password, SleuthkitJNI.CaseDbHandle caseHandle, String caseDirPath, DbType dbType, ContentStreamProvider contentProvider) throws Exception {
this.dbPath = "";
this.databaseName = dbName;
this.dbType = dbType;
@@ -374,6 +379,7 @@ private SleuthkitCase(String host, int port, String dbName, String userName, Str
this.connections = new PostgreSQLConnections(host, port, dbName, userName, password);
this.caseHandle = caseHandle;
this.caseHandleIdentifier = caseHandle.getCaseDbIdentifier();
+ this.contentProvider = contentProvider;
init();
}
@@ -406,6 +412,17 @@ private void init() throws Exception {
personManager = new PersonManager(this);
hostAddressManager = new HostAddressManager(this);
}
+
+ /**
+ * Returns the custom content provider for this case if one exists.
+ * Otherwise, returns null.
+ *
+ * @return The custom content provider for this case if one exists.
+ * Otherwise, returns null.
+ */
+ ContentStreamProvider getContentProvider() {
+ return this.contentProvider;
+ }
/**
* Returns a set of core table names in the SleuthKit Case database.
@@ -2970,9 +2987,24 @@ public void releaseSingleUserCaseReadLock() {
* @throws org.sleuthkit.datamodel.TskCoreException
*/
public static SleuthkitCase openCase(String dbPath) throws TskCoreException {
+ return openCase(dbPath, null);
+ }
+
+ /**
+ * Open an existing case database.
+ *
+ * @param dbPath Path to SQLite case database.
+ * @param contentProvider Custom provider for file content bytes (can be null).
+ *
+ * @return Case database object.
+ *
+ * @throws org.sleuthkit.datamodel.TskCoreException
+ */
+ @Beta
+ public static SleuthkitCase openCase(String dbPath, ContentStreamProvider provider) throws TskCoreException {
try {
final SleuthkitJNI.CaseDbHandle caseHandle = SleuthkitJNI.openCaseDb(dbPath);
- return new SleuthkitCase(dbPath, caseHandle, DbType.SQLITE);
+ return new SleuthkitCase(dbPath, caseHandle, DbType.SQLITE, provider);
} catch (TskUnsupportedSchemaVersionException ex) {
//don't wrap in new TskCoreException
throw ex;
@@ -2993,6 +3025,23 @@ public static SleuthkitCase openCase(String dbPath) throws TskCoreException {
* @throws TskCoreException If there is a problem opening the database.
*/
public static SleuthkitCase openCase(String databaseName, CaseDbConnectionInfo info, String caseDir) throws TskCoreException {
+ return openCase(databaseName, info, caseDir, null);
+ }
+
+ /**
+ * Open an existing multi-user case database.
+ *
+ * @param databaseName The name of the database.
+ * @param info Connection information for the the database.
+ * @param caseDir The folder where the case metadata fils is stored.
+ * @param contentProvider Custom provider for file content bytes (can be null).
+ *
+ * @return A case database object.
+ *
+ * @throws TskCoreException If there is a problem opening the database.
+ */
+ @Beta
+ public static SleuthkitCase openCase(String databaseName, CaseDbConnectionInfo info, String caseDir, ContentStreamProvider contentProvider) throws TskCoreException {
try {
/*
* The flow of this method involves trying to open case and if
@@ -3007,7 +3056,7 @@ public static SleuthkitCase openCase(String databaseName, CaseDbConnectionInfo i
* are able, but do not lose any information if unable.
*/
final SleuthkitJNI.CaseDbHandle caseHandle = SleuthkitJNI.openCaseDb(databaseName, info);
- return new SleuthkitCase(info.getHost(), Integer.parseInt(info.getPort()), databaseName, info.getUserName(), info.getPassword(), caseHandle, caseDir, info.getDbType());
+ return new SleuthkitCase(info.getHost(), Integer.parseInt(info.getPort()), databaseName, info.getUserName(), info.getPassword(), caseHandle, caseDir, info.getDbType(), contentProvider);
} catch (PropertyVetoException exp) {
// In this case, the JDBC driver doesn't support PostgreSQL. Use the generic message here.
throw new TskCoreException(exp.getMessage(), exp);
@@ -3030,12 +3079,27 @@ public static SleuthkitCase openCase(String databaseName, CaseDbConnectionInfo i
* @throws org.sleuthkit.datamodel.TskCoreException
*/
public static SleuthkitCase newCase(String dbPath) throws TskCoreException {
+ return newCase(dbPath, null);
+ }
+
+ /**
+ * Creates a new SQLite case database.
+ *
+ * @param dbPath Path to where SQlite case database should be created.
+ * @param contentProvider Custom provider for file bytes (can be null).
+ *
+ * @return A case database object.
+ *
+ * @throws org.sleuthkit.datamodel.TskCoreException
+ */
+ @Beta
+ public static SleuthkitCase newCase(String dbPath, ContentStreamProvider contentProvider) throws TskCoreException {
try {
CaseDatabaseFactory factory = new CaseDatabaseFactory(dbPath);
factory.createCaseDatabase();
SleuthkitJNI.CaseDbHandle caseHandle = SleuthkitJNI.openCaseDb(dbPath);
- return new SleuthkitCase(dbPath, caseHandle, DbType.SQLITE);
+ return new SleuthkitCase(dbPath, caseHandle, DbType.SQLITE, contentProvider);
} catch (Exception ex) {
throw new TskCoreException("Failed to create case database at " + dbPath, ex);
}
@@ -3057,6 +3121,28 @@ public static SleuthkitCase newCase(String dbPath) throws TskCoreException {
* @throws org.sleuthkit.datamodel.TskCoreException
*/
public static SleuthkitCase newCase(String caseName, CaseDbConnectionInfo info, String caseDirPath) throws TskCoreException {
+ return newCase(caseName, info, caseDirPath, null);
+ }
+
+
+ /**
+ * Creates a new PostgreSQL case database.
+ *
+ * @param caseName The name of the case. It will be used to create a case
+ * database name that can be safely used in SQL commands
+ * and will not be subject to name collisions on the case
+ * database server. Use getDatabaseName to get the
+ * created name.
+ * @param info The information to connect to the database.
+ * @param caseDirPath The case directory path.
+ * @param contentProvider Custom provider for file bytes (can be null).
+ *
+ * @return A case database object.
+ *
+ * @throws org.sleuthkit.datamodel.TskCoreException
+ */
+ @Beta
+ public static SleuthkitCase newCase(String caseName, CaseDbConnectionInfo info, String caseDirPath, ContentStreamProvider contentProvider) throws TskCoreException {
String databaseName = createCaseDataBaseName(caseName);
try {
/**
@@ -3076,7 +3162,7 @@ public static SleuthkitCase newCase(String caseName, CaseDbConnectionInfo info,
final SleuthkitJNI.CaseDbHandle caseHandle = SleuthkitJNI.openCaseDb(databaseName, info);
return new SleuthkitCase(info.getHost(), Integer.parseInt(info.getPort()),
- databaseName, info.getUserName(), info.getPassword(), caseHandle, caseDirPath, info.getDbType());
+ databaseName, info.getUserName(), info.getPassword(), caseHandle, caseDirPath, info.getDbType(), contentProvider);
} catch (PropertyVetoException exp) {
// In this case, the JDBC driver doesn't support PostgreSQL. Use the generic message here.
throw new TskCoreException(exp.getMessage(), exp);