private void GetUserFromPaths() { foreach (PathsItem ri in FoundPaths.Items) { string strUser = PathAnalysis.ExtractUserFromPath(ri.Path); FoundUsers.AddUniqueItem(strUser, ri.IsComputerFolder, ri.Path); } }
public override void analyzeFile() { try { if (IsWPD(stm)) { long entryPoint = 0; MetadataType tipo; while ((entryPoint = EntryPointString(stm, out tipo)) > -1) { stm.Seek(entryPoint + 2, SeekOrigin.Begin); var aux = ReadBinaryString16(stm); if (!IsPossibleString(aux)) { continue; } if (tipo == MetadataType.Unknown && !PathAnalysis.IsValidPath(aux)) { if (aux.ToLower().Contains("jet") || aux.ToLower().Contains("printer") || aux.ToLower().Contains("hp") || aux.ToLower().Contains("series") || aux.ToLower().Contains("canon") || aux.ToLower().Contains("laser") || aux.ToLower().Contains("epson") || aux.ToLower().Contains("lj") || aux.ToLower().Contains("lexmark") || aux.ToLower().Contains("xerox") || aux.ToLower().Contains("sharp")) { FoundPrinters.AddUniqueItem(Functions.FilterPrinter(aux)); } else if (aux.ToLower().Contains("acrobat") || aux.ToLower().Contains("adobe") || aux.ToLower().Contains("creator") || aux.ToLower().Contains("writer") || aux.ToLower().Contains("pdf") || aux.ToLower().Contains("converter")) { FoundMetaData.Applications.Items.Add(new ApplicationsItem(Functions.FilterPrinter(Analysis.ApplicationAnalysis.GetApplicationsFromString(aux)))); } } else { var strPath = Functions.GetPathFolder(aux); if (!PathAnalysis.IsValidPath(strPath)) { continue; } FoundPaths.AddUniqueItem(PathAnalysis.CleanPath(strPath), true); var strUser = PathAnalysis.ExtractUserFromPath(strPath); if (!string.IsNullOrEmpty(strUser)) { FoundUsers.AddUniqueItem(strUser, true); } } } } } catch (Exception e) { System.Diagnostics.Debug.WriteLine(e.ToString()); } }
private void GetImagesPpt(OleDocument doc) { using (Stream stmPictures = doc.OpenStream("Pictures")) { if (stmPictures == null) { return; } int ImagesFound = 0; stmPictures.Seek(0, SeekOrigin.Begin); while (stmPictures.Position < stmPictures.Length - 0x19) { stmPictures.Seek(0x4, SeekOrigin.Current); BinaryReader brData = new BinaryReader(stmPictures); UInt32 PICLength = brData.ReadUInt32(); if (PICLength == 0 || stmPictures.Position + PICLength > stmPictures.Length) { break; } byte[] bufferPIC = brData.ReadBytes((int)PICLength); string strImageName = "Image" + ImagesFound++; using (MemoryStream msJPG = new MemoryStream(bufferPIC, 0x11, bufferPIC.Length - 0x11)) { EXIFDocument eDoc = new EXIFDocument(msJPG, ".jpg"); eDoc.analyzeFile(); eDoc.Close(); if (eDoc.Thumbnail != null) { lon += eDoc.Thumbnail.Length; } cont++; System.Diagnostics.Debug.WriteLine(cont.ToString()); System.Diagnostics.Debug.WriteLine(lon / (1024 * 1024) + " Megacas"); dicPictureEXIF.Add(strImageName, eDoc); foreach (UserItem uiEXIF in eDoc.FoundUsers.Items) { FoundUsers.AddUniqueItem(uiEXIF.Name, false, uiEXIF.Notes); } foreach (ApplicationsItem Application in eDoc.FoundMetaData.Applications.Items) { string strApplication = Application.Name; if (!string.IsNullOrEmpty(strApplication.Trim()) && !FoundMetaData.Applications.Items.Any(A => A.Name == strApplication.Trim())) { FoundMetaData.Applications.Items.Add(new ApplicationsItem(strApplication.Trim())); } } } } } }
public override void analyzeFile() { XmlTextReader avgReader = null; try { avgReader = new XmlTextReader(this.stm) { XmlResolver = null }; avgReader.Read(); while (avgReader.Read()) { // node's value, example: <a>/home/user/file</a> if (CheckPath(avgReader.Value)) { var cleanPath = PathAnalysis.CleanPath(avgReader.Value); var user = PathAnalysis.ExtractUserFromPath(cleanPath); if (user != string.Empty) { FoundUsers.AddUniqueItem(user, true); } FoundPaths.AddUniqueItem(cleanPath, true); } while (avgReader.MoveToNextAttribute()) { // attribute's value, example: <a atrib="/home/user/file"/> if (!CheckPath(avgReader.Value)) { continue; } var cleanPath = PathAnalysis.CleanPath(avgReader.Value); var user = PathAnalysis.ExtractUserFromPath(cleanPath); if (user != string.Empty) { FoundUsers.AddUniqueItem(user, true); } FoundPaths.AddUniqueItem(cleanPath, true); } } } catch (Exception ex) { System.Diagnostics.Debug.WriteLine("error: " + ex.Message); } finally { avgReader?.Close(); } }
/// <summary> /// Analiza las versiones antiguas de un documento OpenOffice /// </summary> /// <param name="stm">Stream que contiene el fichero VersionList.xml</param> /// <param name="zip">Fichero zip que contiene las versiones antiguas embebidas</param> private void analizeFileVersionList(Stream stm, ZipFile zip) { try { XmlDocument doc = new XmlDocument(); doc.XmlResolver = null; doc.Load(stm); XmlNodeList xnl = doc.GetElementsByTagName("VL:version-entry"); if (xnl != null && xnl.Count != 0) { foreach (XmlNode xn in xnl) { OldVersionsItem vai = new OldVersionsItem(); vai.Comments = xn.Attributes["VL:comment"].Value; vai.Author = xn.Attributes["VL:creator"].Value; //Añadimos el usuario de la versión antigua a los usuarios del documento FoundUsers.AddUniqueItem(vai.Author, false, "VL:creator"); DateTime d; if (DateTime.TryParse(xn.Attributes["dc:date-time"].Value.Replace('T', ' '), out d)) { vai.SpecificDate = true; vai.Date = d; } String strFile = "Versions/" + xn.Attributes["VL:title"].Value; if (zip.EntryFileNames.Contains(strFile)) { //Se analiza la versión antigua embebida al completo using (Stream stmXML = new MemoryStream()) { zip.Extract(strFile, stmXML); stmXML.Seek(0, SeekOrigin.Begin); OpenOfficeDocument ooDoc = new OpenOfficeDocument(stmXML, strExtlo); ooDoc.analyzeFile(); dicOldVersions.Add(xn.Attributes["VL:title"].Value, ooDoc); ooDoc.Close(); } } FoundOldVersions.Items.Add(vai); } } } catch (Exception e) { System.Diagnostics.Debug.WriteLine(String.Format("Error reading file content.xml ({0}).", e.ToString())); } }
public override void analyzeFile() { try { using (var sr = new StreamReader(this.stm)) { string line; while ((line = sr.ReadLine()) != null) { var parametro = string.Empty; var tipo = string.Empty; var valor = string.Empty; try { parametro = line.Split(new char[] { ':' })[0]; tipo = line.Split(new char[] { ':' })[1]; int entryPoint = parametro.Length + 1 + tipo.Length + 1; valor = line.Substring(entryPoint, line.Length - entryPoint); } catch { return; } if (string.IsNullOrEmpty(valor)) { continue; } switch (parametro.ToLower()) { case "shell working directory": case "remoteapplicationprogram": case "remoteapplicationname": case "remoteapplicationcmdline": FoundPaths.AddUniqueItem(valor, true); break; case "full address": FoundServers.AddUniqueItem(new ServersItem(valor, "RDP file Analysis")); break; case "gatewayhostname": FoundServers.AddUniqueItem(new ServersItem(valor.Split(new char[] { ':' })[0], "RDP file Analysis")); break; case "alternate shell": FoundPaths.AddUniqueItem(valor, true); var softName = Analysis.ApplicationAnalysis.GetApplicationsFromString(valor); FoundMetaData.Applications.AddUniqueItem(!string.IsNullOrEmpty(softName) ? new ApplicationsItem(softName) : new ApplicationsItem(valor)); break; case "username": FoundUsers.AddUniqueItem(valor, true); break; case "domain": break; case "password": FoundPasswords.AddUniqueItem(new PasswordsItem(valor, "RDP Password")); break; case "password 51": FoundPasswords.AddUniqueItem(new PasswordsItem(valor, "RDP Password (Type 51)")); break;; } } } } catch (Exception e) { System.Diagnostics.Debug.WriteLine(e.ToString()); } }
/// <summary> /// Search the XMP metadata /// </summary> /// <param name="doc">A open PdfDocument</param> public void ReadXMPMetadata(string xmp) { if (xmp != string.Empty) { System.Xml.XmlDocument xDoc = new System.Xml.XmlDocument(); xDoc.XmlResolver = null; xDoc.LoadXml(xmp); #region Metadatos como atributos XmlNodeList xnl = xDoc.GetElementsByTagName("rdf:Description"); /*foreach (XmlNode xn in xnl) * { * XmlAttribute xa; * /*xa= xn.Attributes["pdf:Creator"]; * if (xa != null && !string.IsNullOrEmpty(xa.Value)) * { * string strValue = Analysis.ApplicationAnalysis.GetApplicationsFromString(xa.Value); * if (strValue.Trim() != string.Empty) * { * if (!FoundMetaData.Applications.Items.Any(A => A.Name == strValue.Trim())) * FoundMetaData.Applications.Items.Add(new ApplicationsItem(strValue.Trim())); * } * //No se ha localizado ninguna aplicación conocida, aun así mostrar la aplicación encontrada * else * { * if (xa.Value.Trim() != string.Empty && !FoundMetaData.Applications.Items.Any(A => A.Name == xa.Value.Trim())) * { * FoundMetaData.Applications.Items.Add(new ApplicationsItem(xa.Value.Trim())); * } * } * }*/ /*xa = xn.["xap:MetadataDate"]; * if (xa != null && !string.IsNullOrEmpty(xa.Value)) * { * string strValue = xa.Value; * DateTime d; * if (DateTime.TryParse(strValue.Replace('T', ' ').Replace('Z', ' '), out d)) * { * //Si existe una fecha de creación anterior, sobreescribir * if (!FoundDates.CreationDateSpecified || FoundDates.CreationDate > d) * { * FoundDates.CreationDateSpecified = true; * FoundDates.CreationDate = d; * } * } * } * xa = xn.Attributes["xap:ModifyDate"]; * if (xa != null && !string.IsNullOrEmpty(xa.Value)) * { * string strValue = xa.Value; * DateTime d; * if (DateTime.TryParse(strValue.Replace('T', ' ').Replace('Z', ' '), out d)) * { * FoundDates.ModificationDateSpecified = true; * FoundDates.ModificationDate = d; * } * } * /*xa = xn.Attributes["pdf:Title"]; * if (xa != null && !string.IsNullOrEmpty(xa.Value)) * { * string strValue = xa.Value; * if (string.IsNullOrEmpty(FoundMetaData.Title) || FoundMetaData.Title.Length < strValue.Length) * FoundMetaData.Title = strValue; * } * xa = xn.Attributes["pdf:Author"]; * if (xa != null && !string.IsNullOrEmpty(xa.Value)) * FoundUsers.AddUniqueItem(xa.Value, true); * xa = xn.Attributes["pdf:Producer"]; * if (xa != null && !string.IsNullOrEmpty(xa.Value)) * { * string strValue = Analysis.ApplicationAnalysis.GetApplicationsFromString(xa.Value); * if (strValue.Trim() != string.Empty) * { * if (!FoundMetaData.Applications.Items.Any(A => A.Name == strValue.Trim())) * FoundMetaData.Applications.Items.Add(new ApplicationsItem(strValue.Trim())); * } * //No se ha localizado ninguna aplicación conocida, aun así mostrar la aplicación encontrada * else * { * if (xa.Value.Trim() != string.Empty && !FoundMetaData.Applications.Items.Any(A => A.Name == xa.Value.Trim())) * { * FoundMetaData.Applications.Items.Add(new ApplicationsItem(xa.Value.Trim())); * } * } * } * xa = xn.Attributes["pdf:ModDate"]; * if (xa != null && !string.IsNullOrEmpty(xa.Value)) * { * string strValue = xa.Value; * DateTime d; * if (DateTime.TryParse(strValue.Replace('T', ' ').Replace('Z', ' '), out d)) * { * FoundDates.ModificationDateSpecified = true; * FoundDates.ModificationDate = d; * } * } * xa = xn.Attributes["xap:CreateDate"]; * if (xa != null && !string.IsNullOrEmpty(xa.Value)) * { * string strValue = xa.Value; * DateTime d; * if (DateTime.TryParse(strValue.Replace('T', ' ').Replace('Z', ' '), out d)) * { * //Si existe una fecha de creación anterior, sobreescribir * if (!FoundDates.CreationDateSpecified || FoundDates.CreationDate > d) * { * //Si existe una fecha de modificación posterior, sobreescribir * if (!FoundDates.ModificationDateSpecified || FoundDates.ModificationDate < d) * { * FoundDates.CreationDateSpecified = true; * FoundDates.CreationDate = d; * } * } * } * } * xa = xn.Attributes["xap:Title"]; * if (xa != null && !string.IsNullOrEmpty(xa.Value)) * { * string strValue = xa.Value; * //Si ya existe un título y es mas pequeño, sobreescribirle. * if ((string.IsNullOrEmpty(FoundMetaData.Title) || FoundMetaData.Title.Length < strValue.Length)) * FoundMetaData.Title = strValue; * } * xa = xn.Attributes["xap:Author"]; * if (xa != null && !string.IsNullOrEmpty(xa.Value)) * FoundUsers.AddUniqueItem(xa.Value, true); * xa = xn.Attributes["xap:ModifyDate"]; * if (xa != null && !string.IsNullOrEmpty(xa.Value)) * { * string strValue = xa.Value; * DateTime d; * if (DateTime.TryParse(strValue.Replace('T', ' ').Replace('Z', ' '), out d)) * { * //Si existe una fecha de modificación posterior, sobreescribir * if (!FoundDates.ModificationDateSpecified || FoundDates.ModificationDate < d) * { * FoundDates.ModificationDateSpecified = true; * FoundDates.ModificationDate = d; * } * } * } * xa = xn.Attributes["xap:CreatorTool"]; * if (xa != null && !string.IsNullOrEmpty(xa.Value)) * { * string strValue = Analysis.ApplicationAnalysis.GetApplicationsFromString(xa.Value); * if (strValue.Trim() != string.Empty) * { * if (!FoundMetaData.Applications.Items.Any(A => A.Name == strValue.Trim())) * FoundMetaData.Applications.Items.Add(new ApplicationsItem(strValue.Trim())); * } * //No se ha localizado ninguna aplicación conocida, aun así mostrar la aplicación encontrada * else * { * if (xa.Value.Trim() != string.Empty && !FoundMetaData.Applications.Items.Any(A => A.Name == xa.Value.Trim())) * { * FoundMetaData.Applications.Items.Add(new ApplicationsItem(xa.Value.Trim())); * } * } * } * //xap:MetadataDate, fecha en la que se añadieron los metadatos * xa = xn.Attributes["dc:title"]; * if (xa != null && !string.IsNullOrEmpty(xa.Value)) * { * string strValue = xa.Value; * //Si ya existe un título y es mas pequeño, sobreescribirle. * if (string.IsNullOrEmpty(FoundMetaData.Title) || FoundMetaData.Title.Length < strValue.Length) * FoundMetaData.Title = strValue; * } * xa = xn.Attributes["dc:creator"]; * if (xa != null && !string.IsNullOrEmpty(xa.Value)) * { * string strValue = xa.Value; * if (!string.IsNullOrEmpty(strValue)) * FoundUsers.AddUniqueItem(strValue, true); * } * }*/ #endregion #region Metadatos como nodos independientes xnl = xDoc.GetElementsByTagName("pdf:Creator"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes && !string.IsNullOrEmpty(xnl[0].FirstChild.Value)) { string strValue = Analysis.ApplicationAnalysis.GetApplicationsFromString(xnl[0].FirstChild.Value); if (strValue.Trim() != string.Empty) { if (!FoundMetaData.Applications.Items.Any(A => A.Name == strValue.Trim())) { FoundMetaData.Applications.Items.Add(new ApplicationsItem(strValue.Trim())); } } //No se ha localizado ninguna aplicación conocida, aun así mostrar la aplicación encontrada else { if (xnl[0].FirstChild.Value.Trim() != string.Empty && !FoundMetaData.Applications.Items.Any(A => A.Name == xnl[0].FirstChild.Value.Trim())) { FoundMetaData.Applications.Items.Add(new ApplicationsItem(xnl[0].FirstChild.Value.Trim())); } } } xnl = xDoc.GetElementsByTagName("pdf:CreationDate"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes && !string.IsNullOrEmpty(xnl[0].FirstChild.Value)) { string strValue = xnl[0].FirstChild.Value; DateTime d; if (DateTime.TryParse(strValue.Replace('T', ' ').Replace('Z', ' '), out d)) { //Si existe una fecha de creación anterior, sobreescribir if (!FoundDates.CreationDateSpecified || FoundDates.CreationDate > d) { //Si existe una fecha de modificación posterior, sobreescribir if (!FoundDates.ModificationDateSpecified || FoundDates.ModificationDate < d) { FoundDates.CreationDateSpecified = true; FoundDates.CreationDate = d; } } } } xnl = xDoc.GetElementsByTagName("xap:CreateDate"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes && !string.IsNullOrEmpty(xnl[0].FirstChild.Value)) { string strValue = xnl[0].FirstChild.Value; DateTime d; if (DateTime.TryParse(strValue.Replace('T', ' ').Replace('Z', ' '), out d)) { //Si existe una fecha de creación anterior, sobreescribir if (!FoundDates.CreationDateSpecified || FoundDates.CreationDate > d) { //Si existe una fecha de modificación posterior, sobreescribir if (!FoundDates.ModificationDateSpecified || FoundDates.ModificationDate < d) { FoundDates.CreationDateSpecified = true; FoundDates.CreationDate = d; } } } } xnl = xDoc.GetElementsByTagName("xap:MetadataDate"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes && !string.IsNullOrEmpty(xnl[0].FirstChild.Value)) { string strValue = xnl[0].FirstChild.Value; DateTime d; if (DateTime.TryParse(strValue.Replace('T', ' ').Replace('Z', ' '), out d)) { //Si existe una fecha de creación anterior, sobreescribir if (!FoundDates.CreationDateSpecified || FoundDates.CreationDate > d) { FoundDates.CreationDateSpecified = true; FoundDates.CreationDate = d; } } } xnl = xDoc.GetElementsByTagName("xap:Title"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes) { XmlNode xn = xnl[0].FirstChild; //Busca el primer subnodo con valor while (xn.Value == null && xn.HasChildNodes) { xn = xn.FirstChild; } if (!string.IsNullOrEmpty(xn.Value)) { string strValue = xn.Value; //Si ya existe un título y es mas pequeño, sobreescribirle. if ((string.IsNullOrEmpty(FoundMetaData.Title) || FoundMetaData.Title.Length < strValue.Length)) { FoundMetaData.Title = strValue; } } } xnl = xDoc.GetElementsByTagName("xap:Author"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes && !string.IsNullOrEmpty(xnl[0].FirstChild.Value)) { FoundUsers.AddUniqueItem(xnl[0].FirstChild.Value, true, "xap:Author"); } xnl = xDoc.GetElementsByTagName("pdf:ModDate"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes && !string.IsNullOrEmpty(xnl[0].FirstChild.Value)) { string strValue = xnl[0].FirstChild.Value; DateTime d; if (DateTime.TryParse(strValue.Replace('T', ' ').Replace('Z', ' '), out d)) { //Si existe una fecha de modificación posterior, sobreescribir if (!FoundDates.ModificationDateSpecified || FoundDates.ModificationDate < d) { FoundDates.ModificationDateSpecified = true; FoundDates.ModificationDate = d; } } } xnl = xDoc.GetElementsByTagName("xap:ModifyDate"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes && !string.IsNullOrEmpty(xnl[0].FirstChild.Value)) { string strValue = xnl[0].FirstChild.Value; DateTime d; if (DateTime.TryParse(strValue.Replace('T', ' ').Replace('Z', ' '), out d)) { //Si existe una fecha de modificación posterior, sobreescribir if (!FoundDates.ModificationDateSpecified || FoundDates.ModificationDate < d) { FoundDates.ModificationDateSpecified = true; FoundDates.ModificationDate = d; } } } xnl = xDoc.GetElementsByTagName("xap:CreatorTool"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes && !string.IsNullOrEmpty(xnl[0].FirstChild.Value)) { string strValue = Analysis.ApplicationAnalysis.GetApplicationsFromString(xnl[0].FirstChild.Value); if (strValue.Trim() != string.Empty) { if (!FoundMetaData.Applications.Items.Any(A => A.Name == strValue.Trim())) { FoundMetaData.Applications.Items.Add(new ApplicationsItem(strValue.Trim())); } } //No se ha localizado ninguna aplicación conocida, aun así mostrar la aplicación encontrada else { if (xnl[0].FirstChild.Value.Trim() != string.Empty && !FoundMetaData.Applications.Items.Any(A => A.Name == xnl[0].FirstChild.Value.Trim())) { FoundMetaData.Applications.Items.Add(new ApplicationsItem(xnl[0].FirstChild.Value.Trim())); } } } xnl = xDoc.GetElementsByTagName("dc:creator"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes) { XmlNode xn = xnl[0].FirstChild; //Busca el primer subnodo con valor while (xn.Value == null && xn.HasChildNodes) { xn = xn.FirstChild; } if (!string.IsNullOrEmpty(xn.Value)) { string strValue = xn.Value; FoundUsers.AddUniqueItem(strValue, true); } } xnl = xDoc.GetElementsByTagName("dc:title"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes) { XmlNode xn = xnl[0].FirstChild; //Busca el primer subnodo con valor while (xn.Value == null && xn.HasChildNodes) { xn = xn.FirstChild; } if (!string.IsNullOrEmpty(xn.Value)) { string strValue = xn.Value; //Si ya existe un título y es mas pequeño, sobreescribirle. if ((string.IsNullOrEmpty(FoundMetaData.Title) || FoundMetaData.Title.Length < strValue.Length)) { FoundMetaData.Title = strValue; } } } xnl = xDoc.GetElementsByTagName("stRef:lastURL"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes && !string.IsNullOrEmpty(xnl[0].FirstChild.Value)) { FoundPaths.AddUniqueItem(PathAnalysis.CleanPath(xnl[0].FirstChild.Value), true); } #endregion } }
/// <summary> /// Extrae los metadatos del documento /// </summary> public override void analyzeFile() { try { using (ZipFile zip = ZipFile.Read(stm)) { string strFile = "meta.xml"; if (zip.EntryFileNames.Contains(strFile)) { using (Stream stmXML = new MemoryStream()) { zip.Extract(strFile, stmXML); stmXML.Seek(0, SeekOrigin.Begin); analizeFileMeta(stmXML); } } strFile = "settings.xml"; if (zip.EntryFileNames.Contains(strFile)) { using (Stream stmXML = new MemoryStream()) { zip.Extract(strFile, stmXML); stmXML.Seek(0, SeekOrigin.Begin); analizeFileSettings(stmXML); } } strFile = "content.xml"; if (zip.EntryFileNames.Contains(strFile)) { using (Stream stmXML = new MemoryStream()) { zip.Extract(strFile, stmXML); stmXML.Seek(0, SeekOrigin.Begin); analizeFileContent(stmXML); } } strFile = "VersionList.xml"; if (zip.EntryFileNames.Contains(strFile)) { using (Stream stmXML = new MemoryStream()) { zip.Extract(strFile, stmXML); stmXML.Seek(0, SeekOrigin.Begin); analizeFileVersionList(stmXML, zip); } } //Extrae inforamción EXIF de las imágenes embebidas en el documento foreach (string strFileName in zip.EntryFileNames) { string strFileNameLo = strFileName.ToLower(); //Filtro que obtiene las imagenes *.jpg, *.jpeg dentro de la carpeta "Pictures/" if (strFileNameLo.StartsWith("pictures/") && (strFileNameLo.EndsWith(".jpg") || strFileNameLo.EndsWith(".jpeg"))) { using (Stream stmXML = new MemoryStream()) { zip.Extract(strFileName, stmXML); stmXML.Seek(0, SeekOrigin.Begin); EXIFDocument eDoc = new EXIFDocument(stmXML, Path.GetExtension(strFileNameLo)); eDoc.analyzeFile(); //Añadimos al diccionario la imagen encontrada junto con la información EXIF de la misma dicPictureEXIF.Add(Path.GetFileName(strFileName), eDoc); //Los usuarios de la información EXIF se añaden a los usuarios del documento foreach (UserItem uiEXIF in eDoc.FoundUsers.Items) { FoundUsers.AddUniqueItem(uiEXIF.Name, false, "EXIF"); } //Añadir el software encontrado en la información EXIF al software usado para generar el documento foreach (ApplicationsItem Application in eDoc.FoundMetaData.Applications.Items) { string strApplication = Application.Name; if (!FoundMetaData.Applications.Items.Any(A => A.Name == strApplication.Trim())) { FoundMetaData.Applications.Items.Add(new ApplicationsItem(strApplication.Trim())); } } } } } } //Buscamos usuarios en las rutas del documento foreach (PathsItem ri in FoundPaths.Items) { string strUser = PathAnalysis.ExtractUserFromPath(ri.Path); if (!string.IsNullOrEmpty(strUser)) { FoundUsers.AddUniqueItem(strUser, ri.IsComputerFolder, "Path: " + ri.Path); } } } catch (Exception e) { System.Diagnostics.Debug.WriteLine(String.Format("Error analyzing OpenOffice document ({0})", e.ToString())); } }
private void GetHistory(OleDocument doc) { using (Stream WordDocument = doc.OpenStream("WordDocument")) { if (WordDocument == null) { return; } BinaryReader br = new BinaryReader(WordDocument); WordDocument.Seek(0xB, SeekOrigin.Begin); Byte tipo = br.ReadByte(); WordDocument.Seek(0x2D2, SeekOrigin.Begin); UInt32 dir = br.ReadUInt32(); UInt32 tam = br.ReadUInt32(); if (tam > 0) { using (var table = doc.OpenStream((tipo & 2) == 2 ? "1Table" : "0Table")) { table.Seek(dir, SeekOrigin.Begin); br = new BinaryReader(table); Boolean unicode = br.ReadUInt16() == 0xFFFF; UInt32 nroCadenas = br.ReadUInt16(); UInt32 extraDataTable = br.ReadUInt16(); for (int i = 0; i < nroCadenas; i += 2) { HistoryItem hi = new HistoryItem(); UInt16 strSize = br.ReadUInt16(); if (unicode) { Byte[] cadena = br.ReadBytes(strSize * 2); hi.Author = Encoding.Unicode.GetString(cadena).Replace('\0', ' '); } else { Byte[] cadena = br.ReadBytes(strSize); hi.Author = Encoding.Default.GetString(cadena).Replace('\0', ' '); } FoundUsers.AddUniqueItem(hi.Author, false, "History"); strSize = br.ReadUInt16(); if (unicode) { Byte[] cadena = br.ReadBytes(strSize * 2); hi.Path = Encoding.Unicode.GetString(cadena).Replace('\0', ' '); } else { Byte[] cadena = br.ReadBytes(strSize); hi.Path = Encoding.Default.GetString(cadena).Replace('\0', ' '); } FoundHistory.Items.Add(hi); bool IsComputerPath = false; foreach (UserItem ui in FoundUsers.Items) { if (hi.Author.Trim() == ui.Name.Trim()) { IsComputerPath = ui.IsComputerUser; } } FoundPaths.AddUniqueItem(PathAnalysis.CleanPath(hi.Path), IsComputerPath); } } } } }
public override void analyzeFile() { try { using (Package pZip = Package.Open(stm)) { Uri uriFile = new Uri("/docProps/core.xml", UriKind.Relative); if (pZip.PartExists(uriFile)) { PackagePart pDocument = pZip.GetPart(uriFile); using (Stream stmDoc = pDocument.GetStream(FileMode.Open, FileAccess.Read)) { analizeFileCore(stmDoc); } } uriFile = new Uri("/docProps/app.xml", UriKind.Relative); if (pZip.PartExists(uriFile)) { PackagePart pDocument = pZip.GetPart(uriFile); using (Stream stmDoc = pDocument.GetStream(FileMode.Open, FileAccess.Read)) { analizeFileApp(stmDoc); } } //Control de versiones if (strExtlo == ".docx") { uriFile = new Uri("/word/document.xml", UriKind.Relative); if (pZip.PartExists(uriFile)) { PackagePart pDocument = pZip.GetPart(uriFile); using (Stream stmDoc = pDocument.GetStream(FileMode.Open, FileAccess.Read)) { analizeFileDocument(stmDoc); } } //Consulta el fichero settings para recuperar el idioma del documento if (FoundMetaData.Language == string.Empty) { uriFile = new Uri("/word/settings.xml", UriKind.Relative); if (pZip.PartExists(uriFile)) { PackagePart pDocument = pZip.GetPart(uriFile); using (Stream stmDoc = pDocument.GetStream(FileMode.Open, FileAccess.Read)) { analizeFileSettings(stmDoc); } } } //Consulta el fichero document.xml.rels para obtener los links del documento uriFile = new Uri("/word/_rels/document.xml.rels", UriKind.Relative); if (pZip.PartExists(uriFile)) { PackagePart pDocument = pZip.GetPart(uriFile); using (Stream stmDoc = pDocument.GetStream(FileMode.Open, FileAccess.Read)) { analizeLinks(stmDoc); } } } //Obtiene el nombre de las impresoras y los links de los documentos xlsx else if (strExtlo == ".xlsx") { List <Uri> lstFiles = new List <Uri>(); foreach (PackagePart pp in pZip.GetParts()) { if (pp.Uri.ToString().StartsWith("/xl/printerSettings/printerSettings")) { PackagePart pDocument = pZip.GetPart(pp.Uri); if (pDocument != null) { char[] name = new char[32]; using (StreamReader sr = new StreamReader(pDocument.GetStream(FileMode.Open, FileAccess.Read), Encoding.Unicode)) { sr.Read(name, 0, 32); } FoundPrinters.AddUniqueItem(Functions.FilterPrinter((new string(name).Replace("\0", "")))); } } if (pp.Uri.ToString().StartsWith("/xl/worksheets/_rels/")) { PackagePart pDocument = pZip.GetPart(pp.Uri); using (Stream stmDoc = pDocument.GetStream(FileMode.Open, FileAccess.Read)) { analizeLinks(stmDoc); } } } } else if (strExtlo == ".pptx") { List <Uri> lstFiles = new List <Uri>(); foreach (PackagePart pp in pZip.GetParts()) { if (pp.Uri.ToString().StartsWith("/ppt/slides/_rels/")) { PackagePart pDocument = pZip.GetPart(pp.Uri); using (Stream stmDoc = pDocument.GetStream(FileMode.Open, FileAccess.Read)) { analizeLinks(stmDoc); } } } } //Extraer información EXIF de cada imagen foreach (PackagePart pp in pZip.GetParts()) { string strFileName = pp.Uri.ToString(); string strFileNameLo = strFileName.ToLower(); //Filtro que se queda con todas las imagenes *.jpg y *.jpeg de las 3 posibles carpetas if ((strFileNameLo.StartsWith("/word/media/") || strFileNameLo.StartsWith("/ppt/media/") || strFileNameLo.StartsWith("/xl/media/")) && (strFileNameLo.EndsWith(".jpg") || strFileNameLo.EndsWith(".jpeg"))) { EXIFDocument eDoc = new EXIFDocument(pp.GetStream(FileMode.Open, FileAccess.Read), Path.GetExtension(strFileNameLo)); eDoc.analyzeFile(); dicPictureEXIF.Add(Path.GetFileName(strFileName), eDoc); //Copiamos los metadatos sobre usuarios y Applications de la imagen al documento foreach (UserItem uiEXIF in eDoc.FoundUsers.Items) { FoundUsers.AddUniqueItem(uiEXIF.Name, false, uiEXIF.Notes); } foreach (ApplicationsItem Application in eDoc.FoundMetaData.Applications.Items) { string strApplication = Application.Name; if (!FoundMetaData.Applications.Items.Any(A => A.Name == strApplication.Trim())) { FoundMetaData.Applications.Items.Add(new ApplicationsItem(strApplication.Trim())); } } } } } } catch (Exception e) { System.Diagnostics.Debug.WriteLine(e.ToString()); } }
/// <summary> /// Extrae los metadatos del documento /// </summary> public override void analyzeFile() { PdfDocument doc = null; try { doc = PdfReader.Open(stm, PdfDocumentOpenMode.InformationOnly); ReadXMPMetadata(doc); if (doc.Info.Title != string.Empty) { FoundMetaData.Title = Functions.ToPlainText(doc.Info.Title); if (Uri.IsWellFormedUriString(doc.Info.Title, UriKind.Absolute)) { FoundPaths.AddUniqueItem(PathAnalysis.CleanPath(doc.Info.Title), true); } } if (doc.Info.Subject != string.Empty) { FoundMetaData.Subject = Functions.ToPlainText(doc.Info.Subject); } if (doc.Info.Author != string.Empty) { FoundUsers.AddUniqueItem(Functions.ToPlainText(doc.Info.Author), true); } if (doc.Info.Keywords != string.Empty) { FoundMetaData.Keywords = Functions.ToPlainText(doc.Info.Keywords); } if (doc.Info.Creator != string.Empty) { string strSoftware = Analysis.ApplicationAnalysis.GetApplicationsFromString(Functions.ToPlainText(doc.Info.Creator)); if (strSoftware.Trim() != string.Empty) { if (!FoundMetaData.Applications.Items.Any(A => A.Name == strSoftware)) { FoundMetaData.Applications.Items.Add(new ApplicationsItem(strSoftware)); } } //No se ha localizado ninguna aplicación conocida, aun así mostrar la aplicación encontrada else { if (Functions.ToPlainText(doc.Info.Creator).Trim() != string.Empty && !FoundMetaData.Applications.Items.Any(A => A.Name == Functions.ToPlainText(doc.Info.Creator).Trim())) { FoundMetaData.Applications.Items.Add(new ApplicationsItem(Functions.ToPlainText(doc.Info.Creator).Trim())); } } } if (doc.Info.Producer != string.Empty) { string strSoftware = Analysis.ApplicationAnalysis.GetApplicationsFromString(Functions.ToPlainText(doc.Info.Producer)); if (strSoftware.Trim() != string.Empty) { if (!FoundMetaData.Applications.Items.Any(A => A.Name == strSoftware)) { FoundMetaData.Applications.Items.Add(new ApplicationsItem(strSoftware)); } } //No se ha localizado ninguna aplicación conocida, aun así mostrar la aplicación encontrada else { if (Functions.ToPlainText(doc.Info.Producer).Trim() != string.Empty && !FoundMetaData.Applications.Items.Any(A => A.Name == Functions.ToPlainText(doc.Info.Producer).Trim())) { FoundMetaData.Applications.Items.Add(new ApplicationsItem(Functions.ToPlainText(doc.Info.Producer).Trim())); } } } try { if (doc.Info.CreationDate != DateTime.MinValue) { FoundDates.CreationDateSpecified = true; FoundDates.CreationDate = doc.Info.CreationDate; } } catch (InvalidCastException) { } try { if (doc.Info.ModificationDate != DateTime.MinValue) { FoundDates.ModificationDateSpecified = true; FoundDates.ModificationDate = doc.Info.ModificationDate; } } catch (InvalidCastException) { } //Busca path y links binariamente BinarySearchPaths(stm); BinarySearchLinks(stm); foreach (PathsItem ri in FoundPaths.Items) { //Busca usuarios dentro de la ruta string strUser = PathAnalysis.ExtractUserFromPath(ri.Path); FoundUsers.AddUniqueItem(strUser, ri.IsComputerFolder); } //También busca el software en el título solo en los pdf, solo lo añade si es software conocido if (!String.IsNullOrEmpty(this.FoundMetaData.Title)) { string strSoftware = Analysis.ApplicationAnalysis.GetApplicationsFromString(this.FoundMetaData.Title); if (strSoftware != string.Empty && !FoundMetaData.Applications.Items.Any(A => A.Name == strSoftware)) { FoundMetaData.Applications.Items.Add(new ApplicationsItem(strSoftware)); } } } catch (Exception ex) { System.Diagnostics.Debug.WriteLine(ex.ToString()); } finally { if (doc != null) { doc.Dispose(); } } }
/// <summary> /// Search the XMP metadata /// </summary> /// <param name="doc">A open PdfDocument</param> private void ReadXMPMetadata(PdfDocument doc) { if (doc.Internals.Catalog.Elements.ContainsKey("/Metadata")) { PdfItem pi = doc.Internals.Catalog.Elements["/Metadata"]; //doc.Internals.Catalog.Elements.Remove("/Metadata"); if (pi is PdfSharp.Pdf.Advanced.PdfReference) { int intXMPObjectNumber = (pi as PdfSharp.Pdf.Advanced.PdfReference).ObjectNumber; PdfDictionary pDic = (PdfDictionary)doc.Internals.GetObject(new PdfObjectID(intXMPObjectNumber)); string xmp = pDic.Stream.ToString(); if (xmp != string.Empty) { System.Xml.XmlDocument xDoc = new System.Xml.XmlDocument(); xDoc.XmlResolver = null; xDoc.LoadXml(xmp); #region Metadatos como atributos XmlNodeList xnl = xDoc.GetElementsByTagName("rdf:Description"); foreach (XmlNode xn in xnl) { XmlAttribute xa = xn.Attributes["pdf:Creator"]; if (xa != null && !string.IsNullOrEmpty(xa.Value)) { string strValue = Analysis.ApplicationAnalysis.GetApplicationsFromString(xa.Value); if (strValue.Trim() != string.Empty) { if (!FoundMetaData.Applications.Items.Any(A => A.Name == strValue.Trim())) { FoundMetaData.Applications.Items.Add(new ApplicationsItem(strValue.Trim())); } } //No se ha localizado ninguna aplicación conocida, aun así mostrar la aplicación encontrada else { if (xa.Value.Trim() != string.Empty && !FoundMetaData.Applications.Items.Any(A => A.Name == xa.Value.Trim())) { FoundMetaData.Applications.Items.Add(new ApplicationsItem(xa.Value.Trim())); } } } xa = xn.Attributes["pdf:CreationDate"]; if (xa != null && !string.IsNullOrEmpty(xa.Value)) { string strValue = xa.Value; DateTime d; if (DateTime.TryParse(strValue.Replace('T', ' ').Replace('Z', ' '), out d)) { //Si existe una fecha de creación anterior, sobreescribir if (!FoundDates.CreationDateSpecified || FoundDates.CreationDate > d) { FoundDates.CreationDateSpecified = true; FoundDates.CreationDate = d; } } } xa = xn.Attributes["pdf:Title"]; if (xa != null && !string.IsNullOrEmpty(xa.Value)) { string strValue = xa.Value; if (string.IsNullOrEmpty(FoundMetaData.Title) || FoundMetaData.Title.Length < strValue.Length) { FoundMetaData.Title = strValue; } } xa = xn.Attributes["pdf:Author"]; if (xa != null && !string.IsNullOrEmpty(xa.Value)) { FoundUsers.AddUniqueItem(xa.Value, true); } xa = xn.Attributes["pdf:Producer"]; if (xa != null && !string.IsNullOrEmpty(xa.Value)) { string strValue = Analysis.ApplicationAnalysis.GetApplicationsFromString(xa.Value); if (strValue.Trim() != string.Empty) { if (!FoundMetaData.Applications.Items.Any(A => A.Name == strValue.Trim())) { FoundMetaData.Applications.Items.Add(new ApplicationsItem(strValue.Trim())); } } //No se ha localizado ninguna aplicación conocida, aun así mostrar la aplicación encontrada else { if (xa.Value.Trim() != string.Empty && !FoundMetaData.Applications.Items.Any(A => A.Name == xa.Value.Trim())) { FoundMetaData.Applications.Items.Add(new ApplicationsItem(xa.Value.Trim())); } } } xa = xn.Attributes["pdf:ModDate"]; if (xa != null && !string.IsNullOrEmpty(xa.Value)) { string strValue = xa.Value; DateTime d; if (DateTime.TryParse(strValue.Replace('T', ' ').Replace('Z', ' '), out d)) { FoundDates.ModificationDateSpecified = true; FoundDates.ModificationDate = d; } } xa = xn.Attributes["xap:CreateDate"]; if (xa != null && !string.IsNullOrEmpty(xa.Value)) { string strValue = xa.Value; DateTime d; if (DateTime.TryParse(strValue.Replace('T', ' ').Replace('Z', ' '), out d)) { //Si existe una fecha de creación anterior, sobreescribir if (!FoundDates.CreationDateSpecified || FoundDates.CreationDate > d) { //Si existe una fecha de modificación posterior, sobreescribir if (!FoundDates.ModificationDateSpecified || FoundDates.ModificationDate < d) { FoundDates.CreationDateSpecified = true; FoundDates.CreationDate = d; } } } } xa = xn.Attributes["xap:Title"]; if (xa != null && !string.IsNullOrEmpty(xa.Value)) { string strValue = xa.Value; //Si ya existe un título y es mas pequeño, sobreescribirle. if ((string.IsNullOrEmpty(FoundMetaData.Title) || FoundMetaData.Title.Length < strValue.Length)) { FoundMetaData.Title = strValue; } } xa = xn.Attributes["xap:Author"]; if (xa != null && !string.IsNullOrEmpty(xa.Value)) { FoundUsers.AddUniqueItem(xa.Value, true); } xa = xn.Attributes["xap:ModifyDate"]; if (xa != null && !string.IsNullOrEmpty(xa.Value)) { string strValue = xa.Value; DateTime d; if (DateTime.TryParse(strValue.Replace('T', ' ').Replace('Z', ' '), out d)) { //Si existe una fecha de modificación posterior, sobreescribir if (!FoundDates.ModificationDateSpecified || FoundDates.ModificationDate < d) { FoundDates.ModificationDateSpecified = true; FoundDates.ModificationDate = d; } } } xa = xn.Attributes["xap:CreatorTool"]; if (xa != null && !string.IsNullOrEmpty(xa.Value)) { string strValue = Analysis.ApplicationAnalysis.GetApplicationsFromString(xa.Value); if (strValue.Trim() != string.Empty) { if (!FoundMetaData.Applications.Items.Any(A => A.Name == strValue.Trim())) { FoundMetaData.Applications.Items.Add(new ApplicationsItem(strValue.Trim())); } } //No se ha localizado ninguna aplicación conocida, aun así mostrar la aplicación encontrada else { if (xa.Value.Trim() != string.Empty && !FoundMetaData.Applications.Items.Any(A => A.Name == xa.Value.Trim())) { FoundMetaData.Applications.Items.Add(new ApplicationsItem(xa.Value.Trim())); } } } //xap:MetadataDate, fecha en la que se añadieron los metadatos xa = xn.Attributes["dc:title"]; if (xa != null && !string.IsNullOrEmpty(xa.Value)) { string strValue = xa.Value; //Si ya existe un título y es mas pequeño, sobreescribirle. if (string.IsNullOrEmpty(FoundMetaData.Title) || FoundMetaData.Title.Length < strValue.Length) { FoundMetaData.Title = strValue; } } xa = xn.Attributes["dc:creator"]; if (xa != null && !string.IsNullOrEmpty(xa.Value)) { string strValue = xa.Value; if (!string.IsNullOrEmpty(strValue)) { FoundUsers.AddUniqueItem(strValue, true); } } } #endregion #region Metadatos como nodos independientes xnl = xDoc.GetElementsByTagName("pdf:Creator"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes && !string.IsNullOrEmpty(xnl[0].FirstChild.Value)) { string strValue = Analysis.ApplicationAnalysis.GetApplicationsFromString(xnl[0].FirstChild.Value); if (strValue.Trim() != string.Empty) { if (!FoundMetaData.Applications.Items.Any(A => A.Name == strValue.Trim())) { FoundMetaData.Applications.Items.Add(new ApplicationsItem(strValue.Trim())); } } //No se ha localizado ninguna aplicación conocida, aun así mostrar la aplicación encontrada else { if (xnl[0].FirstChild.Value.Trim() != string.Empty && !FoundMetaData.Applications.Items.Any(A => A.Name == xnl[0].FirstChild.Value.Trim())) { FoundMetaData.Applications.Items.Add(new ApplicationsItem(xnl[0].FirstChild.Value.Trim())); } } } xnl = xDoc.GetElementsByTagName("pdf:CreationDate"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes && !string.IsNullOrEmpty(xnl[0].FirstChild.Value)) { string strValue = xnl[0].FirstChild.Value; DateTime d; if (DateTime.TryParse(strValue.Replace('T', ' ').Replace('Z', ' '), out d)) { //Si existe una fecha de creación anterior, sobreescribir if (!FoundDates.CreationDateSpecified || FoundDates.CreationDate > d) { FoundDates.CreationDateSpecified = true; FoundDates.CreationDate = d; } } } xnl = xDoc.GetElementsByTagName("pdf:Title"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes && !string.IsNullOrEmpty(xnl[0].FirstChild.Value)) { string strValue = xnl[0].FirstChild.Value; if ((string.IsNullOrEmpty(FoundMetaData.Title) || FoundMetaData.Title.Length < strValue.Length)) { FoundMetaData.Title = strValue; } } xnl = xDoc.GetElementsByTagName("pdf:Author"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes && !string.IsNullOrEmpty(xnl[0].FirstChild.Value)) { FoundUsers.AddUniqueItem(xnl[0].FirstChild.Value, true); } xnl = xDoc.GetElementsByTagName("pdf:Producer"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes && !string.IsNullOrEmpty(xnl[0].FirstChild.Value)) { string strValue = Analysis.ApplicationAnalysis.GetApplicationsFromString(xnl[0].FirstChild.Value); if (strValue.Trim() != string.Empty) { if (!FoundMetaData.Applications.Items.Any(A => A.Name == strValue.Trim())) { FoundMetaData.Applications.Items.Add(new ApplicationsItem(strValue.Trim())); } } //No se ha localizado ninguna aplicación conocida, aun así mostrar la aplicación encontrada else { if (xnl[0].FirstChild.Value.Trim() != string.Empty && !FoundMetaData.Applications.Items.Any(A => A.Name == xnl[0].FirstChild.Value.Trim())) { FoundMetaData.Applications.Items.Add(new ApplicationsItem(xnl[0].FirstChild.Value.Trim())); } } } xnl = xDoc.GetElementsByTagName("pdf:ModDate"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes && !string.IsNullOrEmpty(xnl[0].FirstChild.Value)) { string strValue = xnl[0].FirstChild.Value; DateTime d; if (DateTime.TryParse(strValue.Replace('T', ' ').Replace('Z', ' '), out d)) { FoundDates.ModificationDateSpecified = true; FoundDates.ModificationDate = d; } } xnl = xDoc.GetElementsByTagName("xap:CreateDate"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes && !string.IsNullOrEmpty(xnl[0].FirstChild.Value)) { string strValue = xnl[0].FirstChild.Value; DateTime d; if (DateTime.TryParse(strValue.Replace('T', ' ').Replace('Z', ' '), out d)) { //Si existe una fecha de creación anterior, sobreescribir if (!FoundDates.CreationDateSpecified || FoundDates.CreationDate > d) { //Si existe una fecha de modificación posterior, sobreescribir if (!FoundDates.ModificationDateSpecified || FoundDates.ModificationDate < d) { FoundDates.CreationDateSpecified = true; FoundDates.CreationDate = d; } } } } xnl = xDoc.GetElementsByTagName("xap:Title"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes) { XmlNode xn = xnl[0].FirstChild; //Busca el primer subnodo con valor while (xn.Value == null && xn.HasChildNodes) { xn = xn.FirstChild; } if (!string.IsNullOrEmpty(xn.Value)) { string strValue = xn.Value; //Si ya existe un título y es mas pequeño, sobreescribirle. if ((string.IsNullOrEmpty(FoundMetaData.Title) || FoundMetaData.Title.Length < strValue.Length)) { FoundMetaData.Title = strValue; } } } xnl = xDoc.GetElementsByTagName("xap:Author"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes && !string.IsNullOrEmpty(xnl[0].FirstChild.Value)) { FoundUsers.AddUniqueItem(xnl[0].FirstChild.Value, true); } xnl = xDoc.GetElementsByTagName("xap:ModifyDate"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes && !string.IsNullOrEmpty(xnl[0].FirstChild.Value)) { string strValue = xnl[0].FirstChild.Value; DateTime d; if (DateTime.TryParse(strValue.Replace('T', ' ').Replace('Z', ' '), out d)) { //Si existe una fecha de modificación posterior, sobreescribir if (!FoundDates.ModificationDateSpecified || FoundDates.ModificationDate < d) { FoundDates.ModificationDateSpecified = true; FoundDates.ModificationDate = d; } } } xnl = xDoc.GetElementsByTagName("xap:CreatorTool"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes && !string.IsNullOrEmpty(xnl[0].FirstChild.Value)) { string strValue = Analysis.ApplicationAnalysis.GetApplicationsFromString(xnl[0].FirstChild.Value); if (strValue.Trim() != string.Empty) { if (!FoundMetaData.Applications.Items.Any(A => A.Name == strValue.Trim())) { FoundMetaData.Applications.Items.Add(new ApplicationsItem(strValue.Trim())); } } //No se ha localizado ninguna aplicación conocida, aun así mostrar la aplicación encontrada else { if (xnl[0].FirstChild.Value.Trim() != string.Empty && !FoundMetaData.Applications.Items.Any(A => A.Name == xnl[0].FirstChild.Value.Trim())) { FoundMetaData.Applications.Items.Add(new ApplicationsItem(xnl[0].FirstChild.Value.Trim())); } } } //xap:MetadataDate, fecha en la que se añadieron los metadatos xnl = xDoc.GetElementsByTagName("dc:title"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes) { XmlNode xn = xnl[0].FirstChild; //Busca el primer subnodo con valor while (xn.Value == null && xn.HasChildNodes) { xn = xn.FirstChild; } if (!string.IsNullOrEmpty(xn.Value)) { string strValue = xn.Value; //Si ya existe un título y es mas pequeño, sobreescribirle. if ((string.IsNullOrEmpty(FoundMetaData.Title) || FoundMetaData.Title.Length < strValue.Length)) { FoundMetaData.Title = strValue; } } } //if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes && !string.IsNullOrEmpty(xnl[0].FirstChild.Value)) //FoundUsers.AddUniqueItem(xnl[0].FirstChild.Value, true); #endregion } } } }
private void GetImagesDoc(OleDocument doc) { using (Stream WordDocument = doc.OpenStream("WordDocument")) { using (Stream stmData = doc.OpenStream("Data")) { if (WordDocument == null || stmData == null) { return; } WordDocument.Seek(0x18, SeekOrigin.Begin); BinaryReader br = new BinaryReader(WordDocument); Int32 fcMin = br.ReadInt32(); Int32 fcMac = br.ReadInt32(); Int32 FKPStart = fcMac % 0x200 == 0 ? fcMac : (fcMac - fcMac % 0x200) + 0x200; WordDocument.Seek(FKPStart, SeekOrigin.Begin); int ImagesFound = 0; while (WordDocument.Position + 0x200 < WordDocument.Length) { byte[] FKP = br.ReadBytes(0x200); if (FKP[0x1FF] == 00) { break; } foreach (int offset in Functions.SearchBytesInBytes(FKP, new byte[] { 0x03, 0x6A })) { if (offset < 0x200 - 5) { int PICOffset = FKP[offset + 5] * 0x1000000 + FKP[offset + 4] * 0x10000 + FKP[offset + 3] * 0x100 + FKP[offset + 2]; if (PICOffset >= 0 && PICOffset < stmData.Length) { stmData.Seek(PICOffset, SeekOrigin.Begin); BinaryReader brData = new BinaryReader(stmData); UInt32 PICLength = brData.ReadUInt32(); long posOri = stmData.Position; int bufferLen = PICLength < stmData.Length - stmData.Position ? (int)PICLength - 4 : (int)(stmData.Length - stmData.Position); if (bufferLen == 0) { continue; } byte[] bufferPIC = brData.ReadBytes(bufferLen); string strImageName = "Image" + ImagesFound++; using (StreamReader sr = new StreamReader(new MemoryStream(bufferPIC), Encoding.Unicode)) { String sRead = sr.ReadToEnd(); foreach (Match m in Regex.Matches(sRead, @"([a-z]:|\\)\\[a-zá-ú0-9\\\s,;.\-_#\$%&()=ñ´'¨{}Ç`/n/r\[\]+^@]+\\[a-zá-ú0-9\\\s,;.\-_#\$%&()=ñ´'¨{}Ç`/n/r\[\]+^@]+", RegexOptions.IgnoreCase)) { String path = m.Value.Trim(); FoundPaths.AddUniqueItem(PathAnalysis.CleanPath(path), true); strImageName = Path.GetFileName(path); } } List <int> lstJPEG = Functions.SearchBytesInBytes(bufferPIC, new byte[] { 0xFF, 0xD8 }); if (lstJPEG.Count > 0) { using (MemoryStream msJPG = new MemoryStream(bufferPIC, lstJPEG[0], bufferPIC.Length - lstJPEG[0])) { EXIFDocument eDoc = new EXIFDocument(msJPG, ".jpg"); eDoc.analyzeFile(); dicPictureEXIF.Add(strImageName, eDoc); foreach (UserItem uiEXIF in eDoc.FoundUsers.Items) { FoundUsers.AddUniqueItem(uiEXIF.Name, false, uiEXIF.Notes); } foreach (ApplicationsItem Application in eDoc.FoundMetaData.Applications.Items) { string strApplication = Application.Name; if (!string.IsNullOrEmpty(strApplication.Trim()) && !FoundMetaData.Applications.Items.Any(A => A.Name == strApplication.Trim())) { FoundMetaData.Applications.Items.Add(new ApplicationsItem(strApplication.Trim())); } } eDoc.Close(); } } } } } } } } }
private void analizeFileCore(Stream stm) { try { XmlDocument doc = new XmlDocument(); doc.XmlResolver = null; doc.Load(stm); XmlNodeList xnl; xnl = doc.GetElementsByTagName("dc:title"); if (xnl.Count != 0) { if (xnl[0].HasChildNodes) { FoundMetaData.Title = xnl[0].FirstChild.Value; //Si el título es una ruta válida, agregar como una ruta del equipo FoundPaths.AddUniqueItem(PathAnalysis.CleanPath(FoundMetaData.Title), true); } } xnl = doc.GetElementsByTagName("dc:subject"); if (xnl.Count != 0) { if (xnl[0].HasChildNodes) { FoundMetaData.Subject = xnl[0].FirstChild.Value; } } xnl = doc.GetElementsByTagName("dc:description"); if (xnl.Count != 0) { if (xnl[0].HasChildNodes) { FoundMetaData.Description = xnl[0].FirstChild.Value; } } xnl = doc.GetElementsByTagName("cp:lastModifiedBy"); if (xnl.Count != 0) { if (xnl[0].HasChildNodes) { FoundUsers.AddUniqueItem(xnl[0].FirstChild.Value, true, "cp:lastModifiedBy"); } } xnl = doc.GetElementsByTagName("dc:creator"); if (xnl.Count != 0) { if (xnl[0].HasChildNodes) { FoundUsers.AddUniqueItem(xnl[0].FirstChild.Value, FoundUsers.Items.Count == 0, "dc:creator"); } } xnl = doc.GetElementsByTagName("cp:revision"); if (xnl.Count != 0) { if (xnl[0].HasChildNodes) { Decimal d; if (Decimal.TryParse(xnl[0].FirstChild.Value, out d)) { FoundMetaData.VersionNumber = d; } } } xnl = doc.GetElementsByTagName("dcterms:created"); if (xnl.Count != 0) { if (xnl[0].HasChildNodes) { if (xnl[0].FirstChild.Value != "1601-01-01T00:00:00Z") { DateTime d; if (DateTime.TryParse(xnl[0].FirstChild.Value.Replace("T", " ").Replace("Z", ""), out d)) { FoundDates.CreationDateSpecified = true; FoundDates.CreationDate = d.ToLocalTime(); } } } } xnl = doc.GetElementsByTagName("dcterms:modified"); if (xnl.Count != 0) { if (xnl[0].HasChildNodes) { if (xnl[0].FirstChild.Value != "1601-01-01T00:00:00Z") { DateTime d; if (DateTime.TryParse(xnl[0].FirstChild.Value.Replace("T", " ").Replace("Z", ""), out d)) { FoundDates.ModificationDateSpecified = true; FoundDates.ModificationDate = d.ToLocalTime(); } } } } xnl = doc.GetElementsByTagName("cp:keywords"); if (xnl.Count != 0) { if (xnl[0].HasChildNodes) { FoundMetaData.Keywords = xnl[0].FirstChild.Value; } } xnl = doc.GetElementsByTagName("cp:category"); if (xnl.Count != 0) { if (xnl[0].HasChildNodes) { FoundMetaData.Category = xnl[0].FirstChild.Value; } } xnl = doc.GetElementsByTagName("dc:language"); if (xnl.Count != 0) { if (xnl[0].HasChildNodes) { FoundMetaData.Language = xnl[0].FirstChild.Value; } } xnl = doc.GetElementsByTagName("cp:lastPrinted"); if (xnl.Count != 0) { if (xnl[0].HasChildNodes) { if (xnl[0].FirstChild.Value != "1601-01-01T00:00:00Z") { if (xnl[0].FirstChild.Value != "1601-01-01T00:00:00Z") { DateTime d; if (DateTime.TryParse(xnl[0].FirstChild.Value.Replace("T", " ").Replace("Z", ""), out d)) { FoundDates.DatePrintingSpecified = true; FoundDates.DatePrinting = d.ToLocalTime(); } } } } } } catch (Exception e) { System.Diagnostics.Debug.WriteLine(String.Format("Error reading file core.xml ({0}).", e.ToString())); } }
public override void analyzeFile() { try { StreamReader sr = new StreamReader(this.stm); string line = string.Empty; while ((line = sr.ReadLine()) != null) { string parametro = string.Empty; string valor = string.Empty; try { parametro = line.Split(new char[] { '=' })[0]; int entryPoint = parametro.Length + 1; valor = line.Substring(entryPoint, line.Length - entryPoint); } catch { continue; } if (string.IsNullOrEmpty(valor)) { continue; } if (parametro.ToString().ToLower().StartsWith("Address".ToLower())) { string ipOrHost = valor.Split(new char[] { ':' })[0]; FoundServers.AddUniqueItem(new ServersItem(ipOrHost, "ICA file Analysis")); } else if (parametro.ToString().ToLower().StartsWith("HttpBrowserAddress".ToLower())) { string ipOrHost = valor.Split(new char[] { ':' })[0]; FoundServers.AddUniqueItem(new ServersItem(ipOrHost, "ICA file Analysis")); } else if (parametro.ToString().ToLower().StartsWith("TcpBrowserAddress".ToLower())) { string ipOrHost = valor.Split(new char[] { ':' })[0]; FoundServers.AddUniqueItem(new ServersItem(ipOrHost, "ICA file Analysis")); } else if (parametro.ToString().ToLower().StartsWith("Username".ToLower())) { FoundUsers.AddUniqueItem(valor, true); } else if (parametro.ToString().ToLower().StartsWith("ClearPassword".ToLower())) { FoundPasswords.AddUniqueItem(new PasswordsItem(valor, "ICA Clear password")); } else if (parametro.ToString().ToLower().StartsWith("Password".ToLower())) { FoundPasswords.AddUniqueItem(new PasswordsItem(valor, "ICA password")); } else if ((parametro.ToString().ToLower().StartsWith("PersistentCachePath".ToLower())) || (parametro.ToString().ToLower().StartsWith("WorkDirectory".ToLower())) || (parametro.ToString().ToLower().StartsWith("InitialProgram".ToLower())) ) { FoundPaths.AddUniqueItem(valor, true); string user = PathAnalysis.ExtractUserFromPath(valor); if (user != string.Empty) { FoundUsers.AddUniqueItem(user, true); } string softName = Analysis.ApplicationAnalysis.GetApplicationsFromString(valor); if (!string.IsNullOrEmpty(valor)) { FoundMetaData.Applications.AddUniqueItem(new ApplicationsItem(softName)); } else { FoundMetaData.Applications.AddUniqueItem(new ApplicationsItem(valor)); } } else if (parametro.ToString().ToLower().StartsWith("IconPath".ToLower())) { FoundPaths.AddUniqueItem(valor, true); string user = PathAnalysis.ExtractUserFromPath(valor); if (user != string.Empty) { FoundUsers.AddUniqueItem(user, true); } string softName = Analysis.ApplicationAnalysis.GetApplicationsFromString(valor); if (!string.IsNullOrEmpty(valor)) { FoundMetaData.Applications.AddUniqueItem(new ApplicationsItem(softName)); } else { FoundMetaData.Applications.AddUniqueItem(new ApplicationsItem(valor)); } } else if (parametro.ToString().ToLower().StartsWith("SSLProxyHost".ToLower())) { string ipOrHost = valor.Split(new char[] { ':' })[0]; if (ipOrHost != "*") { FoundServers.AddUniqueItem(new ServersItem(ipOrHost, "ICA file Analysis")); } } } } catch (Exception e) { System.Diagnostics.Debug.WriteLine(e.ToString()); } }
private void analizeFileApp(Stream stm) { try { XmlDocument doc = new XmlDocument(); doc.XmlResolver = null; doc.Load(stm); XmlNodeList xnl = doc.GetElementsByTagName("Application"); if (xnl.Count != 0) { if (xnl[0].HasChildNodes) { string app = xnl[0].FirstChild.Value; xnl = doc.GetElementsByTagName("AppVersion"); if (xnl.Count != 0) { if (xnl[0].HasChildNodes) { string strSoftware = Analysis.ApplicationAnalysis.GetApplicationsFromString(app + " - " + xnl[0].FirstChild.Value); FoundMetaData.Applications.Items.Add(new ApplicationsItem(strSoftware)); } } } } xnl = doc.GetElementsByTagName("Company"); if (xnl.Count != 0) { if (xnl[0].HasChildNodes) { FoundMetaData.Company = xnl[0].FirstChild.Value; } } xnl = doc.GetElementsByTagName("Manager"); if (xnl.Count != 0) { if (xnl[0].HasChildNodes) { FoundUsers.AddUniqueItem(xnl[0].FirstChild.Value, false, "Manager"); } } xnl = doc.GetElementsByTagName("TotalTime"); if (xnl.Count != 0) { if (xnl[0].HasChildNodes) { Double d; if (Double.TryParse(xnl[0].FirstChild.Value, out d)) { FoundMetaData.EditTime = (decimal)d; } } } String estadisticas = string.Empty; xnl = doc.GetElementsByTagName("Pages"); if (xnl.Count != 0) { if (xnl[0].HasChildNodes) { estadisticas += "Pages: " + xnl[0].FirstChild.Value; } } xnl = doc.GetElementsByTagName("Words"); if (xnl.Count != 0) { if (xnl[0].HasChildNodes) { estadisticas += "\tWords: " + xnl[0].FirstChild.Value; } } xnl = doc.GetElementsByTagName("Characters"); if (xnl.Count != 0) { if (xnl[0].HasChildNodes) { estadisticas += "\tCharacters: " + xnl[0].FirstChild.Value; } } xnl = doc.GetElementsByTagName("Lines"); if (xnl.Count != 0) { if (xnl[0].HasChildNodes) { estadisticas += "\tLines: " + xnl[0].FirstChild.Value; } } xnl = doc.GetElementsByTagName("Paragraphs"); if (xnl.Count != 0) { if (xnl[0].HasChildNodes) { estadisticas += "\tParagraphs: " + xnl[0].FirstChild.Value; } } } catch (Exception e) { System.Diagnostics.Debug.WriteLine(String.Format("Error reading file app.xml ({0}).", e.ToString())); } }
private void analizeFileMeta(Stream stm) { try { XmlDocument doc = new XmlDocument(); doc.XmlResolver = null; doc.Load(stm); XmlNodeList xnl = doc.GetElementsByTagName("meta:generator"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes) { if (strExtlo == ".odt" || strExtlo == ".ods" || strExtlo == ".odg" || strExtlo == ".odp") { if (xnl[0].FirstChild.Value.IndexOf('$') != -1 && xnl[0].FirstChild.Value.IndexOf(' ') != -1 && xnl[0].FirstChild.Value.IndexOf(' ') > xnl[0].FirstChild.Value.IndexOf('$')) { string strSoftware = xnl[0].FirstChild.Value.Remove(xnl[0].FirstChild.Value.IndexOf('$')) + " - " + xnl[0].FirstChild.Value.Substring(xnl[0].FirstChild.Value.IndexOf(' ') + 1, xnl[0].FirstChild.Value.Length - xnl[0].FirstChild.Value.IndexOf(' ') - 1); this.FoundMetaData.Applications.Items.Add(new ApplicationsItem(Analysis.ApplicationAnalysis.GetApplicationsFromString(strSoftware))); this.FoundMetaData.OperativeSystem = xnl[0].FirstChild.Value.Substring(xnl[0].FirstChild.Value.IndexOf('$') + 1, xnl[0].FirstChild.Value.IndexOf(' ') - xnl[0].FirstChild.Value.IndexOf('$')); } else { this.FoundMetaData.Applications.Items.Add(new ApplicationsItem(Analysis.ApplicationAnalysis.GetApplicationsFromString(xnl[0].FirstChild.Value))); } } else if (strExtlo == ".sxw") { if (xnl[0].FirstChild.Value.IndexOf(')') != -1 && xnl[0].FirstChild.Value.IndexOf('(') != -1 && xnl[0].FirstChild.Value.IndexOf(')') > xnl[0].FirstChild.Value.IndexOf('(')) { string strSoftware = xnl[0].FirstChild.Value.Remove(xnl[0].FirstChild.Value.IndexOf('(')); this.FoundMetaData.Applications.Items.Add(new ApplicationsItem(Analysis.ApplicationAnalysis.GetApplicationsFromString(strSoftware))); this.FoundMetaData.OperativeSystem = xnl[0].FirstChild.Value.Substring(xnl[0].FirstChild.Value.IndexOf('(') + 1, xnl[0].FirstChild.Value.IndexOf(')') - xnl[0].FirstChild.Value.IndexOf('(') - 1); } else { this.FoundMetaData.Applications.Items.Add(new ApplicationsItem(Analysis.ApplicationAnalysis.GetApplicationsFromString(xnl[0].FirstChild.Value))); } } } xnl = doc.GetElementsByTagName("dc:creator"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes) { FoundUsers.AddUniqueItem(xnl[0].FirstChild.Value, true, "dc:creator"); } xnl = doc.GetElementsByTagName("meta:printed-by"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes) { FoundUsers.AddUniqueItem(xnl[0].FirstChild.Value, FoundUsers.Items.Count == 0, "meta:printed-by"); } xnl = doc.GetElementsByTagName("dc:initial-creator"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes) { FoundUsers.AddUniqueItem(xnl[0].FirstChild.Value, FoundUsers.Items.Count == 0, "dc:initial-creator"); } xnl = doc.GetElementsByTagName("meta:initial-creator"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes) { FoundUsers.AddUniqueItem(xnl[0].FirstChild.Value, FoundUsers.Items.Count == 0, "meta:initial-creator"); } xnl = doc.GetElementsByTagName("meta:creation-date"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes) { DateTime d; if (DateTime.TryParse(xnl[0].FirstChild.Value.Replace('T', ' '), out d)) { FoundDates.CreationDateSpecified = true; FoundDates.CreationDate = d; } } xnl = doc.GetElementsByTagName("meta:date"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes) { DateTime d; if (DateTime.TryParse(xnl[0].FirstChild.Value.Replace('T', ' '), out d)) { FoundDates.ModificationDateSpecified = true; FoundDates.ModificationDate = d; } } xnl = doc.GetElementsByTagName("dc:date"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes) { DateTime d; if (DateTime.TryParse(xnl[0].FirstChild.Value.Replace('T', ' '), out d)) { FoundDates.ModificationDateSpecified = true; FoundDates.ModificationDate = d; } } xnl = doc.GetElementsByTagName("meta:print-date"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes) { DateTime d; if (DateTime.TryParse(xnl[0].FirstChild.Value.Replace('T', ' '), out d)) { FoundDates.DatePrintingSpecified = true; FoundDates.DatePrinting = d; } } xnl = doc.GetElementsByTagName("dc:language"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes) { FoundMetaData.Language = xnl[0].FirstChild.Value; } xnl = doc.GetElementsByTagName("dc:title"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes) { FoundMetaData.Title = xnl[0].FirstChild.Value; //Si el título es una ruta válida, agregar como una ruta del equipo FoundPaths.AddUniqueItem(PathAnalysis.CleanPath(FoundMetaData.Title), true); } xnl = doc.GetElementsByTagName("dc:subject"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes) { FoundMetaData.Subject = xnl[0].FirstChild.Value; } xnl = doc.GetElementsByTagName("dc:description"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes) { FoundMetaData.Description = xnl[0].FirstChild.Value; } xnl = doc.GetElementsByTagName("meta:keyword"); if (xnl != null && xnl.Count != 0) { String keyWords = string.Empty; foreach (XmlNode xn in xnl) { if (xn.HasChildNodes) { keyWords += xn.FirstChild.Value + " "; } } FoundMetaData.Keywords = keyWords; } xnl = doc.GetElementsByTagName("meta:editing-cycles"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes) { Decimal ediciones; if (Decimal.TryParse(xnl[0].FirstChild.Value, out ediciones)) { FoundMetaData.VersionNumber = ediciones; } } xnl = doc.GetElementsByTagName("meta:editing-duration"); if (xnl != null && xnl.Count != 0 && xnl[0].HasChildNodes) { DateTime d; if (DateTime.TryParse(xnl[0].FirstChild.Value.Replace('T', ' ').Replace('P', ' '), out d)) { FoundMetaData.EditTime = d.Ticks; } } xnl = doc.GetElementsByTagName("meta:user-defined"); if (xnl != null && xnl.Count != 0) { String Info = string.Empty; foreach (XmlNode xn in xnl) { if (xn.HasChildNodes) { Info += xn.Attributes.GetNamedItem("meta:name").Value + ": " + xn.FirstChild.Value + "|"; } } if (Info != string.Empty) { FoundMetaData.UserInfo = Info; } } xnl = doc.GetElementsByTagName("meta:template"); if (xnl != null && xnl.Count != 0) { foreach (XmlNode xn in xnl) { FoundPaths.AddUniqueItem(PathAnalysis.CleanPath(xn.Attributes.GetNamedItem("xlink:href").Value), true); } } xnl = doc.GetElementsByTagName("meta:document-statistic"); if (xnl != null && xnl.Count > 0) { String estadisticas = string.Empty; if (xnl[0].Attributes.GetNamedItem("meta:table-count") != null) { estadisticas += " Tables: " + xnl[0].Attributes.GetNamedItem("meta:table-count").Value; } if (xnl[0].Attributes.GetNamedItem("meta:cell-count") != null) { estadisticas += " Cell: " + xnl[0].Attributes.GetNamedItem("meta:cell-count").Value; } if (xnl[0].Attributes.GetNamedItem("meta:image-count") != null) { estadisticas += " Images: " + xnl[0].Attributes.GetNamedItem("meta:image-count").Value; } if (xnl[0].Attributes.GetNamedItem("meta:object-count") != null) { estadisticas += " Objects: " + xnl[0].Attributes.GetNamedItem("meta:object-count").Value; } if (xnl[0].Attributes.GetNamedItem("meta:page-count") != null) { estadisticas += " Pages: " + xnl[0].Attributes.GetNamedItem("meta:page-count").Value; } if (xnl[0].Attributes.GetNamedItem("meta:paragraph-count") != null) { estadisticas += " Paragraph: " + xnl[0].Attributes.GetNamedItem("meta:paragraph-count").Value; } if (xnl[0].Attributes.GetNamedItem("meta:word-count") != null) { estadisticas += " Words: " + xnl[0].Attributes.GetNamedItem("meta:word-count").Value; } if (xnl[0].Attributes.GetNamedItem("meta:character-count") != null) { estadisticas += " Characters: " + xnl[0].Attributes.GetNamedItem("meta:character-count").Value; } if (estadisticas != string.Empty) { FoundMetaData.Statistic = estadisticas; } } } catch (Exception e) { System.Diagnostics.Debug.WriteLine(String.Format("Error reading file meta.xml ({0}).", e.ToString())); } }
private void analizeFileDocument(Stream stm) { try { XmlDocument doc = new XmlDocument(); doc.XmlResolver = null; doc.Load(stm); XmlNodeList xnlIns = doc.GetElementsByTagName("w:ins"); XmlNodeList xnlDel = doc.GetElementsByTagName("w:del"); if (xnlIns.Count > 0 || xnlDel.Count > 0) { SerializableDictionary <string, PairValue <int, int> > dicHistoryControl = new SerializableDictionary <string, PairValue <int, int> >(); //Recorre la inserciones foreach (XmlNode xn in xnlIns) { if (xn.Attributes["w:author"] != null && xn.Attributes["w:author"].Value != string.Empty) { if (dicHistoryControl.ContainsKey(xn.Attributes["w:author"].Value)) { dicHistoryControl[xn.Attributes["w:author"].Value].x++; } else { dicHistoryControl.Add(xn.Attributes["w:author"].Value, new PairValue <int, int>(1, 0)); } } } foreach (XmlNode xn in xnlDel) { if (xn.Attributes["w:author"] != null && xn.Attributes["w:author"].Value != string.Empty) { if (dicHistoryControl.ContainsKey(xn.Attributes["w:author"].Value)) { dicHistoryControl[xn.Attributes["w:author"].Value].y++; } else { dicHistoryControl.Add(xn.Attributes["w:author"].Value, new PairValue <int, int>(0, 1)); } } } foreach (string strKey in dicHistoryControl.Keys) { HistoryItem hi = new HistoryItem(); hi.Author = strKey; if (dicHistoryControl[strKey].x > 0) { hi.Comments = dicHistoryControl[strKey].x + " insertions"; } if (dicHistoryControl[strKey].y > 0) { hi.Comments += hi.Comments.Length == 0 ? dicHistoryControl[strKey].y + " deletes" : ", " + dicHistoryControl[strKey].y + " deletes"; } FoundHistory.Items.Add(hi); //Añadimos a la lista de usuarios del documento FoundUsers.AddUniqueItem(strKey, false, "history"); } } } catch (Exception e) { System.Diagnostics.Debug.WriteLine(String.Format("Error reading file document.xml ({0}).", e.ToString())); } }
public override void analyzeFile() { com.drew.metadata.Metadata m; try { if (strExt.ToLower() == ".raw" || strExt.ToLower() == ".cr2" || strExt.ToLower() == ".crw") { m = TiffMetadataReader.ReadMetadata(stm); } else { m = JpegMetadataReader.ReadMetadata(stm); } IEnumerator <AbstractDirectory> lcDirectoryEnum = m.GetDirectoryIterator(); while (lcDirectoryEnum.MoveNext()) { if (lcDirectoryEnum.Current.GetName() != "Jpeg Makernote") { SerializableDictionary <string, string> dicTags = new SerializableDictionary <string, string>(); AbstractDirectory lcDirectory = lcDirectoryEnum.Current; IEnumerator <Tag> lcTagsEnum = lcDirectory.GetTagIterator(); while (lcTagsEnum.MoveNext()) { Tag tag = lcTagsEnum.Current; if (tag.GetTagName() == "Thumbnail Data") { Thumbnail = (byte[])tag.GetTagValue(); } string lcDescription = ""; try { lcDescription = tag.GetDescription(); } catch { }; string lcName = tag.GetTagName(); if (lcName.ToLower().StartsWith("unknown") || lcDescription.ToLower().StartsWith("unknown")) { continue; } lcName = Functions.RemoveAccentsWithNormalization(lcName); lcDescription = Functions.RemoveAccentsWithNormalization(lcDescription); if (lcName.ToLower() == "owner name" || lcName.ToLower() == "copyright") { if (!string.IsNullOrEmpty(lcDescription) && lcDescription.Trim() != string.Empty && !lcDescription.ToLower().Contains("digital") && !lcDescription.ToLower().Contains("camera") && !lcDescription.ToLower().Contains("(c)") && !lcDescription.ToLower().Contains("copyright")) { FoundUsers.AddUniqueItem(lcDescription, false, "Copyright/Owner name"); } } if (lcName.ToLower() == "software") { string strSoftware = Analysis.ApplicationAnalysis.GetApplicationsFromString(lcDescription.Trim()); if (!FoundMetaData.Applications.Items.Any(A => A.Name == strSoftware)) { FoundMetaData.Applications.Items.Add(new ApplicationsItem(strSoftware)); } } if (lcName.ToLower() == "model") { FoundMetaData.Model = lcDescription.Trim(); } dicTags.Add(lcName, lcDescription); } dicAnotherMetadata.Add(lcDirectory.GetName(), dicTags); } } } catch (Exception e) { System.Diagnostics.Debug.WriteLine($"Error analizing EXIF metadata ({e.ToString()})"); } finally { this.stm.Close(); } }