Autopsy  4.4
Graphical digital forensics platform for The Sleuth Kit and other tools.
PstParser.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011-2014 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.thunderbirdparser;
20 
21 import com.pff.PSTAttachment;
22 import com.pff.PSTException;
23 import com.pff.PSTFile;
24 import com.pff.PSTFolder;
25 import com.pff.PSTMessage;
26 import java.io.File;
27 import java.io.FileOutputStream;
28 import java.io.IOException;
29 import java.io.InputStream;
30 import java.nio.ByteBuffer;
31 import java.util.ArrayList;
32 import java.util.List;
33 import java.util.logging.Level;
35 import org.openide.util.NbBundle;
39 import org.sleuthkit.datamodel.AbstractFile;
40 import org.sleuthkit.datamodel.EncodedFileOutputStream;
41 import org.sleuthkit.datamodel.TskCoreException;
42 import org.sleuthkit.datamodel.TskData;
43 
49 class PstParser {
50 
51  private static final Logger logger = Logger.getLogger(PstParser.class.getName());
55  private static int PST_HEADER = 0x2142444E;
56  private IngestServices services;
61  private List<EmailMessage> results;
62  private StringBuilder errors;
63 
64  PstParser(IngestServices services) {
65  results = new ArrayList<>();
66  this.services = services;
67  errors = new StringBuilder();
68  }
69 
70  enum ParseResult {
71 
72  OK, ERROR, ENCRYPT;
73  }
74 
83  ParseResult parse(File file, long fileID) {
84  PSTFile pstFile;
85  long failures;
86  try {
87  pstFile = new PSTFile(file);
88  failures = processFolder(pstFile.getRootFolder(), "\\", true, fileID);
89  if (failures > 0) {
90  addErrorMessage(
91  NbBundle.getMessage(this.getClass(), "PstParser.parse.errMsg.failedToParseNMsgs", failures));
92  }
93  return ParseResult.OK;
94  } catch (PSTException | IOException ex) {
95  String msg = file.getName() + ": Failed to create internal java-libpst PST file to parse:\n" + ex.getMessage(); //NON-NLS
96  logger.log(Level.WARNING, msg);
97  return ParseResult.ERROR;
98  } catch (IllegalArgumentException ex) {
99  logger.log(Level.INFO, "Found encrypted PST file."); //NON-NLS
100  return ParseResult.ENCRYPT;
101  }
102  }
103 
109  List<EmailMessage> getResults() {
110  return results;
111  }
112 
113  String getErrors() {
114  return errors.toString();
115  }
116 
129  private long processFolder(PSTFolder folder, String path, boolean root, long fileID) {
130  String newPath = (root ? path : path + "\\" + folder.getDisplayName());
131  long failCount = 0L; // Number of emails that failed
132  if (folder.hasSubfolders()) {
133  List<PSTFolder> subFolders;
134  try {
135  subFolders = folder.getSubFolders();
136  } catch (PSTException | IOException ex) {
137  subFolders = new ArrayList<>();
138  logger.log(Level.INFO, "java-libpst exception while getting subfolders: {0}", ex.getMessage()); //NON-NLS
139  }
140 
141  for (PSTFolder f : subFolders) {
142  failCount += processFolder(f, newPath, false, fileID);
143  }
144  }
145 
146  if (folder.getContentCount() != 0) {
147  PSTMessage email;
148  // A folder's children are always emails, never other folders.
149  try {
150  while ((email = (PSTMessage) folder.getNextChild()) != null) {
151  results.add(extractEmailMessage(email, newPath, fileID));
152  }
153  } catch (PSTException | IOException ex) {
154  failCount++;
155  logger.log(Level.INFO, "java-libpst exception while getting emails from a folder: {0}", ex.getMessage()); //NON-NLS
156  }
157  }
158 
159  return failCount;
160  }
161 
170  private EmailMessage extractEmailMessage(PSTMessage msg, String localPath, long fileID) {
171  EmailMessage email = new EmailMessage();
172  email.setRecipients(msg.getDisplayTo());
173  email.setCc(msg.getDisplayCC());
174  email.setBcc(msg.getDisplayBCC());
175  email.setSender(getSender(msg.getSenderName(), msg.getSenderEmailAddress()));
176  email.setSentDate(msg.getMessageDeliveryTime());
177  email.setTextBody(msg.getBody());
178  if(false == msg.getTransportMessageHeaders().isEmpty()) {
179  email.setHeaders("\n-----HEADERS-----\n\n" + msg.getTransportMessageHeaders() + "\n\n---END HEADERS--\n\n");
180  }
181 
182  email.setHtmlBody(msg.getBodyHTML());
183  String rtf = "";
184  try {
185  rtf = msg.getRTFBody();
186  } catch (PSTException | IOException ex) {
187  logger.log(Level.INFO, "Failed to get RTF content from pst email."); //NON-NLS
188  }
189  email.setRtfBody(rtf);
190  email.setLocalPath(localPath);
191  email.setSubject(msg.getSubject());
192  email.setId(msg.getDescriptorNodeId());
193 
194  if (msg.hasAttachments()) {
195  extractAttachments(email, msg, fileID);
196  }
197 
198  return email;
199  }
200 
207  private void extractAttachments(EmailMessage email, PSTMessage msg, long fileID) {
208  int numberOfAttachments = msg.getNumberOfAttachments();
209  String outputDirPath = ThunderbirdMboxFileIngestModule.getModuleOutputPath() + File.separator;
210  for (int x = 0; x < numberOfAttachments; x++) {
211  String filename = "";
212  try {
213  PSTAttachment attach = msg.getAttachment(x);
214  long size = attach.getAttachSize();
215  long freeSpace = services.getFreeDiskSpace();
216  if ((freeSpace != IngestMonitor.DISK_FREE_SPACE_UNKNOWN) && (size >= freeSpace)) {
217  continue;
218  }
219  // both long and short filenames can be used for attachments
220  filename = attach.getLongFilename();
221  if (filename.isEmpty()) {
222  filename = attach.getFilename();
223  }
224  String uniqueFilename = fileID + "-" + msg.getDescriptorNodeId() + "-" + attach.getContentId() + "-" + filename;
225  String outPath = outputDirPath + uniqueFilename;
226  saveAttachmentToDisk(attach, outPath);
227 
228  EmailMessage.Attachment attachment = new EmailMessage.Attachment();
229 
230  long crTime = attach.getCreationTime() != null ? attach.getCreationTime().getTime() / 1000 : 0;
231  long mTime = attach.getModificationTime() != null ? attach.getModificationTime().getTime() / 1000 : 0;
232  String relPath = getRelModuleOutputPath() + File.separator + uniqueFilename;
233  attachment.setName(filename);
234  attachment.setCrTime(crTime);
235  attachment.setmTime(mTime);
236  attachment.setLocalPath(relPath);
237  attachment.setSize(attach.getFilesize());
238  attachment.setEncodingType(TskData.EncodingType.XOR1);
239  email.addAttachment(attachment);
240  } catch (PSTException | IOException | NullPointerException ex) {
245  addErrorMessage(
246  NbBundle.getMessage(this.getClass(), "PstParser.extractAttch.errMsg.failedToExtractToDisk",
247  filename));
248  logger.log(Level.WARNING, "Failed to extract attachment from pst file.", ex); //NON-NLS
249  }
250  }
251  }
252 
264  private void saveAttachmentToDisk(PSTAttachment attach, String outPath) throws IOException, PSTException {
265  try (InputStream attachmentStream = attach.getFileInputStream();
266  EncodedFileOutputStream out = new EncodedFileOutputStream(new FileOutputStream(outPath), TskData.EncodingType.XOR1)) {
267  // 8176 is the block size used internally and should give the best performance
268  int bufferSize = 8176;
269  byte[] buffer = new byte[bufferSize];
270  int count = attachmentStream.read(buffer);
271 
272  if (count == -1) {
273  throw new IOException("attachmentStream invalid (read() fails). File " + attach.getLongFilename() + " skipped");
274  }
275 
276  while (count == bufferSize) {
277  out.write(buffer);
278  count = attachmentStream.read(buffer);
279  }
280  if (count != -1) {
281  byte[] endBuffer = new byte[count];
282  System.arraycopy(buffer, 0, endBuffer, 0, count);
283  out.write(endBuffer);
284  }
285  }
286  }
287 
296  private String getSender(String name, String addr) {
297  if (name.isEmpty() && addr.isEmpty()) {
298  return "";
299  } else if (name.isEmpty()) {
300  return addr;
301  } else if (addr.isEmpty()) {
302  return name;
303  } else {
304  return name + ": " + addr;
305  }
306  }
307 
315  public static boolean isPstFile(AbstractFile file) {
316  byte[] buffer = new byte[4];
317  try {
318  int read = file.read(buffer, 0, 4);
319  if (read != 4) {
320  return false;
321  }
322  ByteBuffer bb = ByteBuffer.wrap(buffer);
323  return bb.getInt() == PST_HEADER;
324  } catch (TskCoreException ex) {
325  logger.log(Level.WARNING, "Exception while detecting if a file is a pst file."); //NON-NLS
326  return false;
327  }
328  }
329 
330  private void addErrorMessage(String msg) {
331  errors.append("<li>").append(msg).append("</li>"); //NON-NLS
332  }
333 }

Copyright © 2012-2016 Basis Technology. Generated on: Tue Jun 13 2017
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.