19 package org.sleuthkit.autopsy.thunderbirdparser;
21 import ezvcard.Ezvcard;
23 import ezvcard.parameter.EmailType;
24 import ezvcard.parameter.TelephoneType;
25 import ezvcard.property.Email;
26 import ezvcard.property.Organization;
27 import ezvcard.property.Photo;
28 import ezvcard.property.Telephone;
29 import ezvcard.property.Url;
31 import java.io.FileOutputStream;
32 import java.io.IOException;
33 import java.nio.file.Paths;
34 import java.util.ArrayList;
35 import java.util.Arrays;
36 import java.util.Collection;
37 import java.util.HashMap;
38 import java.util.List;
40 import java.util.logging.Level;
41 import org.apache.commons.lang3.StringUtils;
42 import org.openide.util.NbBundle;
56 import org.
sleuthkit.datamodel.Blackboard.BlackboardException;
73 final class VcardParser {
74 private static final String VCARD_HEADER =
"BEGIN:VCARD";
75 private static final long MIN_FILE_SIZE = 22;
77 private static final String PHOTO_TYPE_BMP =
"bmp";
78 private static final String PHOTO_TYPE_GIF =
"gif";
79 private static final String PHOTO_TYPE_JPEG =
"jpeg";
80 private static final String PHOTO_TYPE_PNG =
"png";
81 private static final Map<String, String> photoTypeExtensions;
83 photoTypeExtensions =
new HashMap<>();
84 photoTypeExtensions.put(PHOTO_TYPE_BMP,
".bmp");
85 photoTypeExtensions.put(PHOTO_TYPE_GIF,
".gif");
86 photoTypeExtensions.put(PHOTO_TYPE_JPEG,
".jpg");
87 photoTypeExtensions.put(PHOTO_TYPE_PNG,
".png");
90 private static final Logger logger = Logger.getLogger(VcardParser.class.getName());
92 private final IngestServices services = IngestServices.getInstance();
93 private final FileManager fileManager;
94 private final IngestJobContext context;
95 private final Blackboard blackboard;
96 private final Case currentCase;
97 private final SleuthkitCase tskCase;
102 VcardParser(Case currentCase, IngestJobContext context) {
103 this.context = context;
104 this.currentCase = currentCase;
105 tskCase = currentCase.getSleuthkitCase();
106 blackboard = tskCase.getBlackboard();
107 fileManager = currentCase.getServices().getFileManager();
117 static boolean isVcardFile(Content content) {
119 if (content.getSize() > MIN_FILE_SIZE) {
120 byte[] buffer =
new byte[VCARD_HEADER.length()];
121 int byteRead = content.read(buffer, 0, VCARD_HEADER.length());
123 String header =
new String(buffer);
124 return header.equalsIgnoreCase(VCARD_HEADER);
127 }
catch (TskException ex) {
128 logger.log(Level.WARNING, String.format(
"Exception while detecting if the file '%s' (id=%d) is a vCard file.",
129 content.getName(), content.getId()));
146 void parse(AbstractFile abstractFile)
throws IOException, NoCurrentCaseException {
147 for (VCard vcard: Ezvcard.parse(
new ReadContentInputStream(abstractFile)).all()) {
148 addContactArtifact(vcard, abstractFile);
164 @NbBundle.Messages({
"VcardParser.addContactArtifact.indexError=Failed to index the contact artifact for keyword search."})
165 private BlackboardArtifact addContactArtifact(VCard vcard, AbstractFile abstractFile)
throws NoCurrentCaseException {
166 List<BlackboardAttribute> attributes =
new ArrayList<>();
167 List<AccountFileInstance> accountInstances =
new ArrayList<>();
170 if (vcard.getFormattedName() != null) {
171 name = vcard.getFormattedName().getValue();
173 if (vcard.getStructuredName() != null) {
175 for (String prefix:vcard.getStructuredName().getPrefixes()) {
176 name += prefix +
" ";
178 if (vcard.getStructuredName().getGiven() != null) {
179 name += vcard.getStructuredName().getGiven() +
" ";
181 if (vcard.getStructuredName().getFamily() != null) {
182 name += vcard.getStructuredName().getFamily() +
" ";
184 for (String suffix:vcard.getStructuredName().getSuffixes()) {
185 name += suffix +
" ";
187 if (! vcard.getStructuredName().getAdditionalNames().isEmpty()) {
189 for (String addName:vcard.getStructuredName().getAdditionalNames()) {
190 name += addName +
" ";
196 ThunderbirdMboxFileIngestModule.addArtifactAttribute(name, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME, attributes);
198 for (Telephone telephone : vcard.getTelephoneNumbers()) {
199 addPhoneAttributes(telephone, abstractFile, attributes);
200 addPhoneAccountInstances(telephone, abstractFile, accountInstances);
203 for (Email email : vcard.getEmails()) {
204 addEmailAttributes(email, abstractFile, attributes);
205 addEmailAccountInstances(email, abstractFile, accountInstances);
208 for (Url url : vcard.getUrls()) {
209 ThunderbirdMboxFileIngestModule.addArtifactAttribute(url.getValue(), BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL, attributes);
212 for (Organization organization : vcard.getOrganizations()) {
213 List<String> values = organization.getValues();
214 if (values.isEmpty() ==
false) {
215 ThunderbirdMboxFileIngestModule.addArtifactAttribute(values.get(0), BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ORGANIZATION, attributes);
219 AccountFileInstance deviceAccountInstance = addDeviceAccountInstance(abstractFile);
221 BlackboardArtifact artifact = null;
222 org.
sleuthkit.datamodel.Blackboard tskBlackboard = tskCase.getBlackboard();
225 if (!tskBlackboard.artifactExists(abstractFile, BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT, attributes)) {
226 artifact = abstractFile.newDataArtifact(
new BlackboardArtifact.Type(BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT), attributes);
228 extractPhotos(vcard, abstractFile, artifact);
231 if (deviceAccountInstance != null) {
233 currentCase.getSleuthkitCase().getCommunicationsManager().addRelationships(
234 deviceAccountInstance, accountInstances, artifact, Relationship.Type.CONTACT, abstractFile.getCrtime());
235 }
catch (TskDataException ex) {
236 logger.log(Level.SEVERE, String.format(
"Failed to create phone and e-mail account relationships (fileName='%s'; fileId=%d; accountId=%d).",
237 abstractFile.getName(), abstractFile.getId(), deviceAccountInstance.getAccount().getAccountID()), ex);
243 blackboard.postArtifact(artifact, EmailParserModuleFactory.getModuleName());
244 }
catch (Blackboard.BlackboardException ex) {
245 logger.log(Level.SEVERE,
"Unable to index blackboard artifact " + artifact.getArtifactID(), ex);
246 MessageNotifyUtil.Notify.error(Bundle.VcardParser_addContactArtifact_indexError(), artifact.getDisplayName());
249 }
catch (TskCoreException ex) {
250 logger.log(Level.SEVERE, String.format(
"Failed to create contact artifact for vCard file '%s' (id=%d).",
251 abstractFile.getName(), abstractFile.getId()), ex);
265 private void extractPhotos(VCard vcard, AbstractFile abstractFile, BlackboardArtifact artifact)
throws NoCurrentCaseException {
266 String parentFileName = getUniqueName(abstractFile);
269 String outputPath = getOutputFolderPath(parentFileName);
270 if (
new File(outputPath).exists()) {
271 List<Photo> vcardPhotos = vcard.getPhotos();
272 List<AbstractFile> derivedFilesCreated =
new ArrayList<>();
273 for (
int i=0; i < vcardPhotos.size(); i++) {
274 Photo photo = vcardPhotos.get(i);
276 if (photo.getUrl() != null) {
281 String type = photo.getType();
288 type = type.toLowerCase();
289 if (type.startsWith(
"image/")) {
290 type = type.substring(6);
292 String extension = photoTypeExtensions.get(type);
295 byte[] data = photo.getData();
296 String extractedFileName = String.format(
"photo_%d%s", i, extension == null ?
"" : extension);
297 String extractedFilePath = Paths.get(outputPath, extractedFileName).toString();
299 writeExtractedImage(extractedFilePath, data);
300 derivedFilesCreated.add(fileManager.addDerivedFile(extractedFileName, getFileRelativePath(parentFileName, extractedFileName), data.length,
301 abstractFile.getCtime(), abstractFile.getCrtime(), abstractFile.getAtime(), abstractFile.getAtime(),
302 true, artifact, null, EmailParserModuleFactory.getModuleName(), EmailParserModuleFactory.getModuleVersion(),
"", TskData.EncodingType.NONE));
303 }
catch (IOException | TskCoreException ex) {
304 logger.log(Level.WARNING, String.format(
"Could not write image to '%s' (id=%d).", extractedFilePath, abstractFile.getId()), ex);
307 if (!derivedFilesCreated.isEmpty()) {
308 services.fireModuleContentEvent(
new ModuleContentEvent(abstractFile));
309 context.addFilesToJob(derivedFilesCreated);
313 logger.log(Level.INFO, String.format(
"Skipping photo extraction for file '%s' (id=%d), because it has already been processed.",
314 abstractFile.getName(), abstractFile.getId()));
316 }
catch (SecurityException ex) {
317 logger.log(Level.WARNING, String.format(
"Could not create extraction folder for '%s' (id=%d).", parentFileName, abstractFile.getId()));
328 private void writeExtractedImage(String outputPath, byte[] data)
throws IOException {
329 File outputFile =
new File(outputPath);
330 FileOutputStream outputStream =
new FileOutputStream(outputFile);
331 outputStream.write(data);
342 private String getUniqueName(AbstractFile file) {
343 return file.getName() +
"_" + file.getId();
355 private String getFileRelativePath(String parentFileName, String fileName)
throws NoCurrentCaseException {
357 return Paths.get(getRelModuleOutputPath(), parentFileName, fileName).toString();
370 private String getOutputFolderPath(String parentFileName)
throws NoCurrentCaseException {
371 String outputFolderPath = ThunderbirdMboxFileIngestModule.getModuleOutputPath() + File.separator + parentFileName;
372 File outputFilePath =
new File(outputFolderPath);
373 if (!outputFilePath.exists()) {
374 outputFilePath.mkdirs();
376 return outputFolderPath;
387 private void addPhoneAttributes(Telephone telephone, AbstractFile abstractFile, Collection<BlackboardAttribute> attributes) {
388 String telephoneText = telephone.getText();
390 if (telephoneText == null || telephoneText.isEmpty()) {
391 if (telephone.getUri() == null) {
394 telephoneText = telephone.getUri().getNumber();
395 if (telephoneText == null || telephoneText.isEmpty()) {
401 List<TelephoneType> telephoneTypes = telephone.getTypes();
402 if (telephoneTypes.isEmpty()) {
403 ThunderbirdMboxFileIngestModule.addArtifactAttribute(telephone.getText(), BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER, attributes);
405 TelephoneType type = telephoneTypes.get(0);
412 List<String> splitTelephoneTypes = Arrays.asList(
413 type.getValue().toUpperCase().replaceAll(
"\\s+",
"").split(
","));
415 if (splitTelephoneTypes.size() > 0) {
416 String splitType = splitTelephoneTypes.get(0);
417 String attributeTypeName =
"TSK_PHONE_NUMBER";
418 if (splitType != null && !splitType.isEmpty()) {
419 attributeTypeName =
"TSK_PHONE_NUMBER_" + splitType;
423 BlackboardAttribute.Type attributeType = tskCase.getAttributeType(attributeTypeName);
424 if (attributeType == null) {
427 attributeType = tskCase.getBlackboard().getOrAddAttributeType(attributeTypeName,
428 BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING,
429 String.format(
"Phone Number (%s)", StringUtils.capitalize(splitType.toLowerCase())));
431 ThunderbirdMboxFileIngestModule.addArtifactAttribute(telephoneText, attributeType, attributes);
432 }
catch (BlackboardException ex) {
433 logger.log(Level.WARNING, String.format(
"Unable to retrieve attribute type '%s' for file '%s' (id=%d).", attributeTypeName, abstractFile.getName(), abstractFile.getId()), ex);
437 }
catch (TskCoreException ex) {
438 logger.log(Level.WARNING, String.format(
"Unable to retrieve attribute type '%s' for file '%s' (id=%d).", attributeTypeName, abstractFile.getName(), abstractFile.getId()), ex);
452 private void addEmailAttributes(Email email, AbstractFile abstractFile, Collection<BlackboardAttribute> attributes) {
453 String emailValue = email.getValue();
454 if (emailValue == null || emailValue.isEmpty()) {
459 List<EmailType> emailTypes = email.getTypes();
460 if (emailTypes.isEmpty()) {
461 ThunderbirdMboxFileIngestModule.addArtifactAttribute(email.getValue(), BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL, attributes);
463 EmailType type = emailTypes.get(0);
469 List<String> splitEmailTypes = Arrays.asList(
470 type.getValue().toUpperCase().replaceAll(
"\\s+",
"").split(
","));
472 if (splitEmailTypes.size() > 0) {
473 String splitType = splitEmailTypes.get(0);
474 String attributeTypeName =
"TSK_EMAIL_" + splitType;
475 if(splitType.isEmpty()) {
476 attributeTypeName =
"TSK_EMAIL";
479 BlackboardAttribute.Type attributeType = tskCase.getAttributeType(attributeTypeName);
480 if (attributeType == null) {
482 attributeType = tskCase.getBlackboard().getOrAddAttributeType(attributeTypeName,
483 BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING,
484 String.format(
"Email (%s)", StringUtils.capitalize(splitType.toLowerCase())));
486 ThunderbirdMboxFileIngestModule.addArtifactAttribute(email.getValue(), attributeType, attributes);
487 }
catch (TskCoreException ex) {
488 logger.log(Level.SEVERE, String.format(
"Unable to retrieve attribute type '%s' for file '%s' (id=%d).", attributeTypeName, abstractFile.getName(), abstractFile.getId()), ex);
489 }
catch (BlackboardException ex) {
490 logger.log(Level.SEVERE, String.format(
"Unable to add custom attribute type '%s' for file '%s' (id=%d).", attributeTypeName, abstractFile.getName(), abstractFile.getId()), ex);
505 private void addPhoneAccountInstances(Telephone telephone, AbstractFile abstractFile, Collection<AccountFileInstance> accountInstances) {
506 String telephoneText = telephone.getText();
507 if (telephoneText == null || telephoneText.isEmpty()) {
508 if (telephone.getUri() == null) {
511 telephoneText = telephone.getUri().getNumber();
512 if (telephoneText == null || telephoneText.isEmpty()) {
520 AccountFileInstance phoneAccountInstance = tskCase.getCommunicationsManager().createAccountFileInstance(Account.Type.PHONE,
521 telephoneText, EmailParserModuleFactory.getModuleName(), abstractFile);
522 accountInstances.add(phoneAccountInstance);
524 catch(TskCoreException ex) {
525 logger.log(Level.WARNING, String.format(
526 "Failed to create account for phone number '%s' (content='%s'; id=%d).",
527 telephoneText, abstractFile.getName(), abstractFile.getId()), ex);
540 private void addEmailAccountInstances(Email email, AbstractFile abstractFile, Collection<AccountFileInstance> accountInstances) {
541 String emailValue = email.getValue();
542 if (emailValue == null || emailValue.isEmpty()) {
548 AccountFileInstance emailAccountInstance = tskCase.getCommunicationsManager().createAccountFileInstance(Account.Type.EMAIL,
549 emailValue, EmailParserModuleFactory.getModuleName(), abstractFile);
550 accountInstances.add(emailAccountInstance);
552 catch(TskCoreException ex) {
553 logger.log(Level.WARNING, String.format(
554 "Failed to create account for e-mail address '%s' (content='%s'; id=%d).",
555 emailValue, abstractFile.getName(), abstractFile.getId()), ex);
566 private AccountFileInstance addDeviceAccountInstance(AbstractFile abstractFile) {
568 AccountFileInstance deviceAccountInstance = null;
569 String deviceId = null;
571 long dataSourceObjId = abstractFile.getDataSourceObjectId();
572 DataSource dataSource = tskCase.getDataSource(dataSourceObjId);
573 deviceId = dataSource.getDeviceId();
574 deviceAccountInstance = tskCase.getCommunicationsManager().createAccountFileInstance(Account.Type.DEVICE,
575 deviceId, EmailParserModuleFactory.getModuleName(), abstractFile);
577 catch (TskCoreException ex) {
578 logger.log(Level.WARNING, String.format(
579 "Failed to create device account for '%s' (content='%s'; id=%d).",
580 deviceId, abstractFile.getName(), abstractFile.getId()), ex);
582 catch (TskDataException ex) {
583 logger.log(Level.WARNING, String.format(
584 "Failed to get the data source from the case database (id=%d).",
585 abstractFile.getId()), ex);
588 return deviceAccountInstance;