19 package org.sleuthkit.autopsy.thunderbirdparser;
22 import java.io.IOException;
23 import java.util.ArrayList;
24 import java.util.List;
25 import java.util.logging.Level;
26 import org.openide.util.NbBundle;
27 import org.openide.util.NbBundle.Messages;
45 import org.
sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
79 if (abstractFile.getKnown().equals(TskData.FileKnown.KNOWN)) {
84 if ((abstractFile.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS)) ||
85 (abstractFile.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.SLACK))) {
89 if ((abstractFile.isFile() ==
false)) {
94 boolean isMbox =
false;
96 byte[] t =
new byte[64];
97 if (abstractFile.getSize() > 64) {
98 int byteRead = abstractFile.read(t, 0, 64);
100 isMbox = MboxParser.isValidMimeTypeMbox(t);
103 }
catch (TskException ex) {
104 logger.log(Level.WARNING, null, ex);
111 if (PstParser.isPstFile(abstractFile)) {
125 @Messages({
"ThunderbirdMboxFileIngestModule.processPst.indexError.message=Failed to index encryption detected artifact for keyword search."})
127 String fileName =
getTempPath() + File.separator + abstractFile.getName()
128 +
"-" + String.valueOf(abstractFile.getId());
129 File file =
new File(fileName);
133 logger.log(Level.WARNING,
"Not enough disk space to write file to disk.");
135 NbBundle.getMessage(this.getClass(),
136 "ThunderbirdMboxFileIngestModule.processPst.errMsg.outOfDiskSpace",
137 abstractFile.getName()));
144 }
catch (IOException ex) {
145 logger.log(Level.WARNING,
"Failed writing pst file to disk.", ex);
149 PstParser parser =
new PstParser(services);
150 PstParser.ParseResult result = parser.parse(file, abstractFile.getId());
152 if (result == PstParser.ParseResult.OK) {
155 }
else if (result == PstParser.ParseResult.ENCRYPT) {
158 BlackboardArtifact artifact = abstractFile.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED);
159 artifact.addAttribute(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME,
EmailParserModuleFactory.getModuleName(), NbBundle.getMessage(this.getClass(),
"ThunderbirdMboxFileIngestModule.encryptionFileLevel")));
166 logger.log(Level.SEVERE,
"Unable to index blackboard artifact " + artifact.getArtifactID(), ex);
170 }
catch (TskCoreException ex) {
171 logger.log(Level.INFO,
"Failed to add encryption attribute to file: {0}", abstractFile.getName());
176 NbBundle.getMessage(
this.getClass(),
"ThunderbirdMboxFileIngestModule.processPst.errProcFile.msg",
177 abstractFile.getName()),
178 NbBundle.getMessage(
this.getClass(),
179 "ThunderbirdMboxFileIngestModule.processPst.errProcFile.details"));
180 logger.log(Level.INFO,
"PSTParser failed to parse {0}", abstractFile.getName());
184 if (file.delete() ==
false) {
185 logger.log(Level.INFO,
"Failed to delete temp file: {0}", file.getName());
188 String errors = parser.getErrors();
189 if (errors.isEmpty() ==
false) {
191 NbBundle.getMessage(
this.getClass(),
"ThunderbirdMboxFileIngestModule.processPst.errProcFile.msg2",
192 abstractFile.getName()), errors);
206 String mboxFileName = abstractFile.getName();
207 String mboxParentDir = abstractFile.getParentPath();
209 String emailFolder =
"";
211 if (mboxParentDir.contains(
"/Mail/")) {
212 emailFolder = mboxParentDir.substring(mboxParentDir.indexOf(
"/Mail/") + 5);
213 }
else if (mboxParentDir.contains(
"/ImapMail/")) {
214 emailFolder = mboxParentDir.substring(mboxParentDir.indexOf(
"/ImapMail/") + 9);
216 emailFolder = emailFolder + mboxFileName;
217 emailFolder = emailFolder.replaceAll(
".sbd",
"");
219 String fileName =
getTempPath() + File.separator + abstractFile.getName()
220 +
"-" + String.valueOf(abstractFile.getId());
221 File file =
new File(fileName);
225 logger.log(Level.WARNING,
"Not enough disk space to write file to disk.");
227 NbBundle.getMessage(
this.getClass(),
"ThunderbirdMboxFileIngestModule.processMBox.errProcFile.msg",
228 abstractFile.getName()),
229 NbBundle.getMessage(
this.getClass(),
230 "ThunderbirdMboxFileIngestModule.processMBox.errProfFile.details"));
236 }
catch (IOException ex) {
237 logger.log(Level.WARNING,
"Failed writing mbox file to disk.", ex);
241 MboxParser parser =
new MboxParser(services, emailFolder);
242 List<EmailMessage> emails = parser.parse(file, abstractFile.getId());
245 if (file.delete() ==
false) {
246 logger.log(Level.INFO,
"Failed to delete temp file: {0}", file.getName());
249 String errors = parser.getErrors();
250 if (errors.isEmpty() ==
false) {
252 NbBundle.getMessage(
this.getClass(),
"ThunderbirdMboxFileIngestModule.processMBox.errProcFile.msg2",
253 abstractFile.getName()), errors);
267 File dir =
new File(tmpDir);
268 if (dir.exists() ==
false) {
277 File dir =
new File(outDir);
278 if (dir.exists() ==
false) {
296 private void processEmails(List<EmailMessage> emails, AbstractFile abstractFile) {
297 List<AbstractFile> derivedFiles =
new ArrayList<>();
298 for (EmailMessage email : emails) {
299 if (email.hasAttachment()) {
305 if (derivedFiles.isEmpty() ==
false) {
306 for (AbstractFile derived : derivedFiles) {
323 private List<AbstractFile>
handleAttachments(List<EmailMessage.Attachment> attachments, AbstractFile abstractFile) {
324 List<AbstractFile> files =
new ArrayList<>();
325 for (EmailMessage.Attachment attach : attachments) {
326 String filename = attach.getName();
327 long crTime = attach.getCrTime();
328 long mTime = attach.getmTime();
329 long aTime = attach.getaTime();
330 long cTime = attach.getcTime();
331 String relPath = attach.getLocalPath();
332 long size = attach.getSize();
333 TskData.EncodingType encodingType = attach.getEncodingType();
337 size, cTime, crTime, aTime, mTime,
true, abstractFile,
"",
340 }
catch (TskCoreException ex) {
342 NbBundle.getMessage(
this.getClass(),
"ThunderbirdMboxFileIngestModule.handleAttch.errMsg",
343 abstractFile.getName()),
344 NbBundle.getMessage(
this.getClass(),
345 "ThunderbirdMboxFileIngestModule.handleAttch.errMsg.details", filename));
346 logger.log(Level.INFO,
"", ex);
358 @Messages({
"ThunderbirdMboxFileIngestModule.addArtifact.indexError.message=Failed to index email message detected artifact for keyword search."})
359 private void addArtifact(EmailMessage email, AbstractFile abstractFile) {
360 List<BlackboardAttribute> bbattributes =
new ArrayList<>();
361 String to = email.getRecipients();
362 String cc = email.getCc();
363 String bcc = email.getBcc();
364 String from = email.getSender();
365 long dateL = email.getSentDate();
366 String headers = email.getHeaders();
367 String body = email.getTextBody();
368 String bodyHTML = email.getHtmlBody();
369 String rtf = email.getRtfBody();
370 String subject = email.getSubject();
371 long id = email.getId();
372 String localPath = email.getLocalPath();
374 if (headers.isEmpty() ==
false) {
375 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_HEADERS,
EmailParserModuleFactory.getModuleName(), headers));
377 if (from.isEmpty() ==
false) {
378 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_EMAIL_FROM,
EmailParserModuleFactory.getModuleName(), from));
380 if (to.isEmpty() ==
false) {
381 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_EMAIL_TO,
EmailParserModuleFactory.getModuleName(), to));
383 if (subject.isEmpty() ==
false) {
384 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_SUBJECT,
EmailParserModuleFactory.getModuleName(), subject));
388 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME_RCVD,
EmailParserModuleFactory.getModuleName(), dateL));
389 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME_SENT,
EmailParserModuleFactory.getModuleName(), dateL));
391 if (body.isEmpty() ==
false) {
392 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_EMAIL_CONTENT_PLAIN,
EmailParserModuleFactory.getModuleName(), body));
395 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_MSG_ID,
EmailParserModuleFactory.getModuleName(), ((
id < 0L) ? NbBundle
396 .getMessage(this.getClass(),
"ThunderbirdMboxFileIngestModule.notAvail") : String.valueOf(
id))));
398 if (localPath.isEmpty() ==
false) {
399 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PATH,
EmailParserModuleFactory.getModuleName(), localPath));
401 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PATH,
EmailParserModuleFactory.getModuleName(),
"/foo/bar"));
404 if (cc.isEmpty() ==
false) {
405 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_EMAIL_CC,
EmailParserModuleFactory.getModuleName(), cc));
407 if (bcc.isEmpty() ==
false) {
408 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_EMAIL_BCC,
EmailParserModuleFactory.getModuleName(), bcc));
411 if (bodyHTML.isEmpty() ==
false) {
412 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_EMAIL_CONTENT_HTML,
EmailParserModuleFactory.getModuleName(), bodyHTML));
414 if (rtf.isEmpty() ==
false) {
415 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_EMAIL_CONTENT_RTF,
EmailParserModuleFactory.getModuleName(), rtf));
422 BlackboardArtifact bbart;
423 bbart = abstractFile.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG);
424 bbart.addAttributes(bbattributes);
430 logger.log(Level.SEVERE,
"Unable to index blackboard artifact " + bbart.getArtifactID(), ex);
433 }
catch (TskCoreException ex) {
434 logger.log(Level.WARNING, null, ex);
438 void postErrorMessage(String subj, String details) {
443 IngestServices getServices() {
String getModuleOutputDirectoryRelativePath()
static final Logger logger
FileManager getFileManager()
String getTempDirectory()
static IngestMessage createErrorMessage(String source, String subject, String detailsHtml)
static< T > long writeToFile(Content content, java.io.File outputFile, ProgressHandle progress, Future< T > worker, boolean source)
ProcessResult processMBox(AbstractFile abstractFile)
static final int DISK_FREE_SPACE_UNKNOWN
void processEmails(List< EmailMessage > emails, AbstractFile abstractFile)
void addFilesToJob(List< AbstractFile > files)
void addArtifact(EmailMessage email, AbstractFile abstractFile)
static String getModuleOutputPath()
void postMessage(final IngestMessage message)
void fireModuleDataEvent(ModuleDataEvent moduleDataEvent)
ProcessResult process(AbstractFile abstractFile)
String getModuleDirectory()
ProcessResult processPst(AbstractFile abstractFile)
void startUp(IngestJobContext context)
Blackboard getBlackboard()
void fireModuleContentEvent(ModuleContentEvent moduleContentEvent)
synchronized DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parentFile, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType)
static void error(String title, String message)
static String getRelModuleOutputPath()
synchronized void indexArtifact(BlackboardArtifact artifact)
static Case getCurrentCase()
synchronized static Logger getLogger(String name)
static String getTempPath()
List< AbstractFile > handleAttachments(List< EmailMessage.Attachment > attachments, AbstractFile abstractFile)
static synchronized IngestServices getInstance()