From cd5540dda0ab77a32ce6a80ebf918445c68663af Mon Sep 17 00:00:00 2001
From: apriestman <apriestman@basistech.com>
Date: Wed, 17 Jun 2020 10:07:28 -0400
Subject: [PATCH] Add method to add an image to the database.
---
bindings/java/jni/dataModel_SleuthkitJNI.cpp | 116 ++++++++++++++++--
bindings/java/jni/dataModel_SleuthkitJNI.h | 32 +++++
.../org/sleuthkit/datamodel/SleuthkitJNI.java | 40 ++++++
3 files changed, 181 insertions(+), 7 deletions(-)
diff --git a/bindings/java/jni/dataModel_SleuthkitJNI.cpp b/bindings/java/jni/dataModel_SleuthkitJNI.cpp
index 5452ccbea..abab86e0b 100644
--- a/bindings/java/jni/dataModel_SleuthkitJNI.cpp
+++ b/bindings/java/jni/dataModel_SleuthkitJNI.cpp
@@ -1125,7 +1125,6 @@ Java_org_sleuthkit_datamodel_SleuthkitJNI_finishAddImgNat(JNIEnv * env,
}
-
/*
* Open an image pointer for the given image.
* @return the created TSK_IMG_INFO pointer
@@ -1142,23 +1141,23 @@ JNIEXPORT jlong JNICALL
jboolean isCopy;
// get pointers to each of the file names
- char **imagepaths8 = (char **) tsk_malloc(num_imgs * sizeof(char *));
+ char **imagepaths8 = (char **)tsk_malloc(num_imgs * sizeof(char *));
if (imagepaths8 == NULL) {
setThrowTskCoreError(env);
return 0;
}
for (int i = 0; i < num_imgs; i++) {
imagepaths8[i] =
- (char *) env->
- GetStringUTFChars((jstring) env->GetObjectArrayElement(paths,
+ (char *)env->
+ GetStringUTFChars((jstring)env->GetObjectArrayElement(paths,
i), &isCopy);
// @@@ Error check
}
// open the image
img_info =
- tsk_img_open_utf8((int) num_imgs, imagepaths8, TSK_IMG_TYPE_DETECT,
- sector_size);
+ tsk_img_open_utf8((int)num_imgs, imagepaths8, TSK_IMG_TYPE_DETECT,
+ sector_size);
if (img_info == NULL) {
setThrowTskCoreError(env, tsk_error_get());
}
@@ -1167,13 +1166,116 @@ JNIEXPORT jlong JNICALL
for (int i = 0; i < num_imgs; i++) {
env->
ReleaseStringUTFChars((jstring)
- env->GetObjectArrayElement(paths, i), imagepaths8[i]);
+ env->GetObjectArrayElement(paths, i), imagepaths8[i]);
}
free(imagepaths8);
return (jlong) img_info;
}
+/*
+ * Get the full list of paths associated with an image.
+ */
+JNIEXPORT jobjectArray JNICALL
+Java_org_sleuthkit_datamodel_SleuthkitJNI_getPathsForImageNat(JNIEnv * env,
+ jclass obj, jlong a_img_info) {
+
+ TSK_IMG_INFO *img_info = castImgInfo(env, a_img_info);
+ if (img_info == 0) {
+ //exception already set
+ return 0;
+ }
+
+ char **img_ptrs;
+#ifdef TSK_WIN32
+ // convert image paths to UTF-8
+ img_ptrs = (char **)tsk_malloc(img_info->num_img * sizeof(char *));
+ if (img_ptrs == NULL) {
+ return (jobjectArray)env->NewObjectArray(0, env->FindClass("java/lang/String"), env->NewStringUTF(""));
+ }
+
+ for (int i = 0; i < img_info->num_img; i++) {
+ char * img2 = (char*)tsk_malloc(1024 * sizeof(char));
+ UTF8 *ptr8;
+ UTF16 *ptr16;
+
+ ptr8 = (UTF8 *)img2;
+ ptr16 = (UTF16 *)img_info->images[i];
+
+ uint8_t retval =
+ tsk_UTF16toUTF8_lclorder((const UTF16 **)&ptr16, (UTF16 *)
+ & ptr16[TSTRLEN(img_info->images[i]) + 1], &ptr8,
+ (UTF8 *)((uintptr_t)ptr8 + 1024), TSKlenientConversion);
+ if (retval != TSKconversionOK) {
+ tsk_error_reset();
+ tsk_error_set_errno(TSK_ERR_AUTO_UNICODE);
+ tsk_error_set_errstr("Error converting image to UTF-8\n");
+ return (jobjectArray)env->NewObjectArray(0, env->FindClass("java/lang/String"), env->NewStringUTF(""));
+ }
+ img_ptrs[i] = img2;
+ }
+#else
+ img_ptrs = img_info->images;
+#endif
+
+ jobjectArray path_list = (jobjectArray)env->NewObjectArray(img_info->num_img, env->FindClass("java/lang/String"), env->NewStringUTF(""));
+ for (int i = 0; i < img_info->num_img; i++) {
+ env->SetObjectArrayElement(path_list, i, env->NewStringUTF(img_ptrs[i]));
+ }
+
+ return path_list;
+}
+
+
+/*
+ * Get the size of an image.
+ */
+JNIEXPORT jlong JNICALL
+Java_org_sleuthkit_datamodel_SleuthkitJNI_getSizeForImageNat(JNIEnv * env,
+ jclass obj, jlong a_img_info) {
+
+ TSK_IMG_INFO *img_info = castImgInfo(env, a_img_info);
+ if (img_info == 0) {
+ //exception already set
+ return 0;
+ }
+
+ return img_info->size;
+}
+
+
+/*
+ * Get the type of an image.
+ */
+JNIEXPORT jlong JNICALL
+Java_org_sleuthkit_datamodel_SleuthkitJNI_getTypeForImageNat(JNIEnv * env,
+ jclass obj, jlong a_img_info) {
+
+ TSK_IMG_INFO *img_info = castImgInfo(env, a_img_info);
+ if (img_info == 0) {
+ //exception already set
+ return 0;
+ }
+
+ return img_info->itype;
+}
+
+
+/*
+* Get the computed sector size of an image.
+*/
+JNIEXPORT jlong JNICALL
+Java_org_sleuthkit_datamodel_SleuthkitJNI_getSectorSizeForImageNat(JNIEnv * env,
+ jclass obj, jlong a_img_info) {
+
+ TSK_IMG_INFO *img_info = castImgInfo(env, a_img_info);
+ if (img_info == 0) {
+ //exception already set
+ return 0;
+ }
+
+ return img_info->sector_size;
+}
/*
diff --git a/bindings/java/jni/dataModel_SleuthkitJNI.h b/bindings/java/jni/dataModel_SleuthkitJNI.h
index ebd2b8fc3..2029a21c2 100644
--- a/bindings/java/jni/dataModel_SleuthkitJNI.h
+++ b/bindings/java/jni/dataModel_SleuthkitJNI.h
@@ -327,6 +327,38 @@ JNIEXPORT jint JNICALL Java_org_sleuthkit_datamodel_SleuthkitJNI_readFileNat
JNIEXPORT jint JNICALL Java_org_sleuthkit_datamodel_SleuthkitJNI_saveFileMetaDataTextNat
(JNIEnv *, jclass, jlong, jstring);
+/*
+ * Class: org_sleuthkit_datamodel_SleuthkitJNI
+ * Method: getPathsForImageNat
+ * Signature: (J)[Ljava/lang/String;
+ */
+JNIEXPORT jobjectArray JNICALL Java_org_sleuthkit_datamodel_SleuthkitJNI_getPathsForImageNat
+ (JNIEnv *, jclass, jlong);
+
+/*
+ * Class: org_sleuthkit_datamodel_SleuthkitJNI
+ * Method: getSizeForImageNat
+ * Signature: (J)J
+ */
+JNIEXPORT jlong JNICALL Java_org_sleuthkit_datamodel_SleuthkitJNI_getSizeForImageNat
+ (JNIEnv *, jclass, jlong);
+
+/*
+ * Class: org_sleuthkit_datamodel_SleuthkitJNI
+ * Method: getTypeForImageNat
+ * Signature: (J)J
+ */
+JNIEXPORT jlong JNICALL Java_org_sleuthkit_datamodel_SleuthkitJNI_getTypeForImageNat
+ (JNIEnv *, jclass, jlong);
+
+/*
+ * Class: org_sleuthkit_datamodel_SleuthkitJNI
+ * Method: getSectorSizeForImageNat
+ * Signature: (J)J
+ */
+JNIEXPORT jlong JNICALL Java_org_sleuthkit_datamodel_SleuthkitJNI_getSectorSizeForImageNat
+ (JNIEnv *, jclass, jlong);
+
/*
* Class: org_sleuthkit_datamodel_SleuthkitJNI
* Method: closeImgNat
diff --git a/bindings/java/src/org/sleuthkit/datamodel/SleuthkitJNI.java b/bindings/java/src/org/sleuthkit/datamodel/SleuthkitJNI.java
index ca10fccca..1f9645a07 100644
--- a/bindings/java/src/org/sleuthkit/datamodel/SleuthkitJNI.java
+++ b/bindings/java/src/org/sleuthkit/datamodel/SleuthkitJNI.java
@@ -36,6 +36,7 @@
import java.util.concurrent.locks.ReadWriteLock;
import java.util.concurrent.locks.ReentrantReadWriteLock;
import org.sleuthkit.datamodel.TskData.TSK_FS_ATTR_TYPE_ENUM;
+import org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction;
/**
* A utility class that provides a interface to the SleuthKit via JNI. Supports
@@ -874,6 +875,37 @@ private static long openImage(String[] imageFiles, int sSize, boolean useCache,
releaseTSKReadLock();
}
}
+
+ public static Image addImageToDatabase(SleuthkitCase skCase, String imagePath, int sectorSize,
+ String timeZone, String md5, String sha1, String sha256, String deviceId) throws TskCoreException {
+
+ // Open the image
+ long imageHandle = openImgNat(new String[]{imagePath}, 1, sectorSize);
+
+ // Get the fields stored in the native code
+ List<String> paths = Arrays.asList(getPathsForImageNat(imageHandle));
+ long size = getSizeForImageNat(imageHandle);
+ long type = getTypeForImageNat(imageHandle);
+ long computedSectorSize = getSectorSizeForImageNat(imageHandle);
+
+ // Now save to database
+ CaseDbTransaction transaction = skCase.beginTransaction();
+ try {
+ Image img = skCase.addImage(TskData.TSK_IMG_TYPE_ENUM.valueOf(type), computedSectorSize,
+ size, null, paths,
+ timeZone, md5, sha1, sha256,
+ deviceId, transaction);
+ transaction.commit();
+
+ // TODO may keep open - would need to add to cache here
+ closeImgNat(imageHandle);
+
+ return img;
+ } catch (TskCoreException ex) {
+ transaction.rollback();
+ throw(ex);
+ }
+ }
/**
* Get volume system Handle
@@ -2023,6 +2055,14 @@ public static long openFile(long fsHandle, long fileId, TSK_FS_ATTR_TYPE_ENUM at
private static native int readFileNat(long fileHandle, byte[] readBuffer, long offset, int offset_type, long len) throws TskCoreException;
private static native int saveFileMetaDataTextNat(long fileHandle, String fileName) throws TskCoreException;
+
+ private static native String[] getPathsForImageNat(long imgHandle);
+
+ private static native long getSizeForImageNat(long imgHandle);
+
+ private static native long getTypeForImageNat(long imgHandle);
+
+ private static native long getSectorSizeForImageNat(long imgHandle);
private static native void closeImgNat(long imgHandle);
--
GitLab