Ingest module check if file is a image or video

Autopsy Development
1

Im writing a ingest module that will find all images and videoes, then copy them out to a new directory.

  1. If I want to check for images ending with .jpg I can do this:
    if file.getName().lower().endswith(".jpg"):
    However if a user has images stored as my_image.jpg-secret-format then the module will not pick up that image. How can I ensure that the script takes all images and vidoes? Is there not a better way of doing this without endswith?

  2. I tried to get the path of the file with str(file.getLocalPath()), however it returned None.
    How can i get the path of the file (including partition number)?

Script:
https://paste.ubuntu.com/p/9YbttYkCc3/

1 Like
2

  1. Run the File Type ID ingest module to add MIME types to your files (File Type ID will run before your module so don’t worry about timing). Then use FileTypeUtils to see if the MIME type is an image or video.
    https://github.com/sleuthkit/autopsy/blob/develop/Core/src/org/sleuthkit/autopsy/coreutils/FileTypeUtils.java

  2. getLocalPath() is generally for logical file sets - it saves where a file is located on your computer. Try getUniquePath().

3

How do I use the FileTypeUtils?

I tried this, but it didnt work:
mime = FileTypeUtils(file);

4

No the MIME type is on your abstract file. file.getMIMEType() will return it. Then you want to see if it’s in the set of image MIME types which you can get from FileTypeUtils.IMAGE_MIME_TYPES

5

Here is an example of what you can do in a plugin module, you may want to add the check for the mimetype but that should be fairly easy to do. The plugin is here Mass_Export_Files_By_Extension. The plugin has a GUI component that allows the user to specify a file extension(s) to export, file extensions are seperated by commas. Once the ingest module starts it will create a directory named mass_export in the export directory and then a subdirectory based on the file extensions you want to export. It will then find all files based on extension and write them out to their specific subdirectory, it uses file-id and filename to write out file to avoid overwriting any duplicate data. At this point this is where you could check the mimetype since you have a list of AbstractFiles.

Hope this all makes sense. If you have any questions please let me know.

6

So how do I use the FileTypeUtils.IMAGE_MIME_TYPES in my script to check if the file is a image?

if(file.getMIMEType() == FileTypeUtils.IMAGE_MIME_TYPES) { ?

7

Try “in” instead of ==

8

if(file.getMIMEType() in FileTypeUtils.IMAGE_MIME_TYPES):

gives error:

NameError: global name ‘FileTypeUtils’ is not defined

9

Did you import the FileTypeUtils?

10

Thanks for the help.
I got the script working.
I will try it on a case tomorrow. If it works then I can post the code.