19 package org.sleuthkit.autopsy.thunderbirdparser;
22 import java.io.IOException;
23 import java.util.ArrayList;
24 import java.util.List;
25 import java.util.logging.Level;
26 import org.openide.util.NbBundle;
27 import org.openide.util.NbBundle.Messages;
45 import org.
sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
79 if (abstractFile.getKnown().equals(TskData.FileKnown.KNOWN)) {
84 if ((abstractFile.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS)) ||
85 (abstractFile.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.SLACK))) {
89 if ((abstractFile.isFile() ==
false)) {
94 boolean isMbox =
false;
96 byte[] t =
new byte[64];
97 if (abstractFile.getSize() > 64) {
98 int byteRead = abstractFile.read(t, 0, 64);
100 isMbox = MboxParser.isValidMimeTypeMbox(t);
103 }
catch (TskException ex) {
104 logger.log(Level.WARNING, null, ex);
111 if (PstParser.isPstFile(abstractFile)) {
125 @Messages({
"ThunderbirdMboxFileIngestModule.processPst.indexError.message=Failed to index encryption detected artifact for keyword search."})
127 String fileName =
getTempPath() + File.separator + abstractFile.getName()
128 +
"-" + String.valueOf(abstractFile.getId());
129 File file =
new File(fileName);
133 logger.log(Level.WARNING,
"Not enough disk space to write file to disk.");
135 NbBundle.getMessage(this.getClass(),
136 "ThunderbirdMboxFileIngestModule.processPst.errMsg.outOfDiskSpace",
137 abstractFile.getName()));
144 }
catch (IOException ex) {
145 logger.log(Level.WARNING,
"Failed writing pst file to disk.", ex);
149 PstParser parser =
new PstParser(services);
150 PstParser.ParseResult result = parser.parse(file, abstractFile.getId());
152 if (result == PstParser.ParseResult.OK) {
155 }
else if (result == PstParser.ParseResult.ENCRYPT) {
158 BlackboardArtifact artifact = abstractFile.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED);
159 artifact.addAttribute(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME,
EmailParserModuleFactory.getModuleName(), NbBundle.getMessage(this.getClass(),
"ThunderbirdMboxFileIngestModule.encryptionFileLevel")));
166 logger.log(Level.SEVERE,
"Unable to index blackboard artifact " + artifact.getArtifactID(), ex);
170 }
catch (TskCoreException ex) {
171 logger.log(Level.INFO,
"Failed to add encryption attribute to file: {0}", abstractFile.getName());
176 NbBundle.getMessage(
this.getClass(),
"ThunderbirdMboxFileIngestModule.processPst.errProcFile.msg",
177 abstractFile.getName()),
178 NbBundle.getMessage(
this.getClass(),
179 "ThunderbirdMboxFileIngestModule.processPst.errProcFile.details"));
180 logger.log(Level.INFO,
"PSTParser failed to parse {0}", abstractFile.getName());
184 if (file.delete() ==
false) {
185 logger.log(Level.INFO,
"Failed to delete temp file: {0}", file.getName());
188 String errors = parser.getErrors();
189 if (errors.isEmpty() ==
false) {
191 NbBundle.getMessage(
this.getClass(),
"ThunderbirdMboxFileIngestModule.processPst.errProcFile.msg2",
192 abstractFile.getName()), errors);
206 String mboxFileName = abstractFile.getName();
207 String mboxParentDir = abstractFile.getParentPath();
209 String emailFolder =
"";
211 if (mboxParentDir.contains(
"/Mail/")) {
212 emailFolder = mboxParentDir.substring(mboxParentDir.indexOf(
"/Mail/") + 5);
213 }
else if (mboxParentDir.contains(
"/ImapMail/")) {
214 emailFolder = mboxParentDir.substring(mboxParentDir.indexOf(
"/ImapMail/") + 9);
216 emailFolder = emailFolder + mboxFileName;
217 emailFolder = emailFolder.replaceAll(
".sbd",
"");
219 String fileName =
getTempPath() + File.separator + abstractFile.getName()
220 +
"-" + String.valueOf(abstractFile.getId());
221 File file =
new File(fileName);
225 logger.log(Level.WARNING,
"Not enough disk space to write file to disk.");
227 NbBundle.getMessage(
this.getClass(),
"ThunderbirdMboxFileIngestModule.processMBox.errProcFile.msg",
228 abstractFile.getName()),
229 NbBundle.getMessage(
this.getClass(),
230 "ThunderbirdMboxFileIngestModule.processMBox.errProfFile.details"));
236 }
catch (IOException ex) {
237 logger.log(Level.WARNING,
"Failed writing mbox file to disk.", ex);
241 MboxParser parser =
new MboxParser(services, emailFolder);
242 List<EmailMessage> emails = parser.parse(file, abstractFile.getId());
245 if (file.delete() ==
false) {
246 logger.log(Level.INFO,
"Failed to delete temp file: {0}", file.getName());
249 String errors = parser.getErrors();
250 if (errors.isEmpty() ==
false) {
252 NbBundle.getMessage(
this.getClass(),
"ThunderbirdMboxFileIngestModule.processMBox.errProcFile.msg2",
253 abstractFile.getName()), errors);
267 File dir =
new File(tmpDir);
268 if (dir.exists() ==
false) {
277 File dir =
new File(outDir);
278 if (dir.exists() ==
false) {
296 private void processEmails(List<EmailMessage> emails, AbstractFile abstractFile) {
297 List<AbstractFile> derivedFiles =
new ArrayList<>();
301 for (EmailMessage email : emails) {
302 BlackboardArtifact msgArtifact =
addArtifact(email, abstractFile);
304 if ((msgArtifact != null) && (email.hasAttachment())) {
305 derivedFiles.addAll(
handleAttachments(email.getAttachments(), abstractFile, msgArtifact ));
309 if (derivedFiles.isEmpty() ==
false) {
310 for (AbstractFile derived : derivedFiles) {
327 private List<AbstractFile>
handleAttachments(List<EmailMessage.Attachment> attachments, AbstractFile abstractFile, BlackboardArtifact messageArtifact) {
328 List<AbstractFile> files =
new ArrayList<>();
329 for (EmailMessage.Attachment attach : attachments) {
330 String filename = attach.getName();
331 long crTime = attach.getCrTime();
332 long mTime = attach.getmTime();
333 long aTime = attach.getaTime();
334 long cTime = attach.getcTime();
335 String relPath = attach.getLocalPath();
336 long size = attach.getSize();
337 TskData.EncodingType encodingType = attach.getEncodingType();
341 size, cTime, crTime, aTime, mTime,
true, messageArtifact,
"",
344 }
catch (TskCoreException ex) {
346 NbBundle.getMessage(
this.getClass(),
"ThunderbirdMboxFileIngestModule.handleAttch.errMsg",
347 abstractFile.getName()),
348 NbBundle.getMessage(
this.getClass(),
349 "ThunderbirdMboxFileIngestModule.handleAttch.errMsg.details", filename));
350 logger.log(Level.INFO,
"", ex);
362 @Messages({
"ThunderbirdMboxFileIngestModule.addArtifact.indexError.message=Failed to index email message detected artifact for keyword search."})
363 private BlackboardArtifact
addArtifact(EmailMessage email, AbstractFile abstractFile) {
364 BlackboardArtifact bbart = null;
365 List<BlackboardAttribute> bbattributes =
new ArrayList<>();
366 String to = email.getRecipients();
367 String cc = email.getCc();
368 String bcc = email.getBcc();
369 String from = email.getSender();
370 long dateL = email.getSentDate();
371 String headers = email.getHeaders();
372 String body = email.getTextBody();
373 String bodyHTML = email.getHtmlBody();
374 String rtf = email.getRtfBody();
375 String subject = email.getSubject();
376 long id = email.getId();
377 String localPath = email.getLocalPath();
379 if (headers.isEmpty() ==
false) {
380 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_HEADERS,
EmailParserModuleFactory.getModuleName(), headers));
382 if (from.isEmpty() ==
false) {
383 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_EMAIL_FROM,
EmailParserModuleFactory.getModuleName(), from));
385 if (to.isEmpty() ==
false) {
386 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_EMAIL_TO,
EmailParserModuleFactory.getModuleName(), to));
388 if (subject.isEmpty() ==
false) {
389 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_SUBJECT,
EmailParserModuleFactory.getModuleName(), subject));
393 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME_RCVD,
EmailParserModuleFactory.getModuleName(), dateL));
394 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME_SENT,
EmailParserModuleFactory.getModuleName(), dateL));
396 if (body.isEmpty() ==
false) {
397 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_EMAIL_CONTENT_PLAIN,
EmailParserModuleFactory.getModuleName(), body));
400 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_MSG_ID,
EmailParserModuleFactory.getModuleName(), ((
id < 0L) ? NbBundle
401 .getMessage(this.getClass(),
"ThunderbirdMboxFileIngestModule.notAvail") : String.valueOf(
id))));
403 if (localPath.isEmpty() ==
false) {
404 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PATH,
EmailParserModuleFactory.getModuleName(), localPath));
406 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PATH,
EmailParserModuleFactory.getModuleName(),
"/foo/bar"));
409 if (cc.isEmpty() ==
false) {
410 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_EMAIL_CC,
EmailParserModuleFactory.getModuleName(), cc));
412 if (bcc.isEmpty() ==
false) {
413 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_EMAIL_BCC,
EmailParserModuleFactory.getModuleName(), bcc));
416 if (bodyHTML.isEmpty() ==
false) {
417 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_EMAIL_CONTENT_HTML,
EmailParserModuleFactory.getModuleName(), bodyHTML));
419 if (rtf.isEmpty() ==
false) {
420 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_EMAIL_CONTENT_RTF,
EmailParserModuleFactory.getModuleName(), rtf));
425 bbart = abstractFile.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG);
426 bbart.addAttributes(bbattributes);
432 logger.log(Level.SEVERE,
"Unable to index blackboard artifact " + bbart.getArtifactID(), ex);
435 }
catch (TskCoreException ex) {
436 logger.log(Level.WARNING, null, ex);
442 void postErrorMessage(String subj, String details) {
447 IngestServices getServices() {
String getModuleOutputDirectoryRelativePath()
static final Logger logger
FileManager getFileManager()
String getTempDirectory()
static IngestMessage createErrorMessage(String source, String subject, String detailsHtml)
BlackboardArtifact addArtifact(EmailMessage email, AbstractFile abstractFile)
static< T > long writeToFile(Content content, java.io.File outputFile, ProgressHandle progress, Future< T > worker, boolean source)
synchronized DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, Content parentObj, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType)
ProcessResult processMBox(AbstractFile abstractFile)
static final int DISK_FREE_SPACE_UNKNOWN
void processEmails(List< EmailMessage > emails, AbstractFile abstractFile)
void addFilesToJob(List< AbstractFile > files)
static String getModuleOutputPath()
void postMessage(final IngestMessage message)
void fireModuleDataEvent(ModuleDataEvent moduleDataEvent)
ProcessResult process(AbstractFile abstractFile)
String getModuleDirectory()
ProcessResult processPst(AbstractFile abstractFile)
void startUp(IngestJobContext context)
Blackboard getBlackboard()
void fireModuleContentEvent(ModuleContentEvent moduleContentEvent)
static void error(String title, String message)
static String getRelModuleOutputPath()
synchronized void indexArtifact(BlackboardArtifact artifact)
static Case getCurrentCase()
synchronized static Logger getLogger(String name)
List< AbstractFile > handleAttachments(List< EmailMessage.Attachment > attachments, AbstractFile abstractFile, BlackboardArtifact messageArtifact)
static String getTempPath()
static synchronized IngestServices getInstance()