19 package org.sleuthkit.autopsy.thunderbirdparser;
22 import java.io.IOException;
23 import java.util.ArrayList;
24 import java.util.List;
25 import java.util.logging.Level;
26 import org.openide.util.NbBundle;
44 import org.
sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
78 if (abstractFile.getKnown().equals(TskData.FileKnown.KNOWN)) {
83 if (abstractFile.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS)) {
87 if ((abstractFile.isFile() ==
false)) {
92 boolean isMbox =
false;
94 byte[] t =
new byte[64];
95 if (abstractFile.getSize() > 64) {
96 int byteRead = abstractFile.read(t, 0, 64);
98 isMbox = MboxParser.isValidMimeTypeMbox(t);
101 }
catch (TskException ex) {
102 logger.log(Level.WARNING, null, ex);
109 if (PstParser.isPstFile(abstractFile)) {
124 String fileName =
getTempPath() + File.separator + abstractFile.getName()
125 +
"-" + String.valueOf(abstractFile.getId());
126 File file =
new File(fileName);
130 logger.log(Level.WARNING,
"Not enough disk space to write file to disk.");
132 NbBundle.getMessage(this.getClass(),
133 "ThunderbirdMboxFileIngestModule.processPst.errMsg.outOfDiskSpace",
134 abstractFile.getName()));
141 }
catch (IOException ex) {
142 logger.log(Level.WARNING,
"Failed writing pst file to disk.", ex);
146 PstParser parser =
new PstParser(services);
147 PstParser.ParseResult result = parser.parse(file, abstractFile.getId());
149 if (result == PstParser.ParseResult.OK) {
152 }
else if (result == PstParser.ParseResult.ENCRYPT) {
155 BlackboardArtifact artifact = abstractFile.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED);
156 artifact.addAttribute(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME,
EmailParserModuleFactory.getModuleName(), NbBundle.getMessage(this.getClass(),
"ThunderbirdMboxFileIngestModule.encryptionFileLevel")));
162 logger.log(Level.SEVERE, NbBundle.getMessage(
Blackboard.class,
"Blackboard.unableToIndexArtifact.error.msg", artifact.getDisplayName()), ex);
164 NbBundle.getMessage(
Blackboard.class,
"Blackboard.unableToIndexArtifact.exception.msg"), artifact.getDisplayName());
168 }
catch (TskCoreException ex) {
169 logger.log(Level.INFO,
"Failed to add encryption attribute to file: {0}", abstractFile.getName());
174 NbBundle.getMessage(
this.getClass(),
"ThunderbirdMboxFileIngestModule.processPst.errProcFile.msg",
175 abstractFile.getName()),
176 NbBundle.getMessage(
this.getClass(),
177 "ThunderbirdMboxFileIngestModule.processPst.errProcFile.details"));
178 logger.log(Level.INFO,
"PSTParser failed to parse {0}", abstractFile.getName());
182 if (file.delete() ==
false) {
183 logger.log(Level.INFO,
"Failed to delete temp file: {0}", file.getName());
186 String errors = parser.getErrors();
187 if (errors.isEmpty() ==
false) {
189 NbBundle.getMessage(
this.getClass(),
"ThunderbirdMboxFileIngestModule.processPst.errProcFile.msg2",
190 abstractFile.getName()), errors);
205 String mboxFileName = abstractFile.getName();
206 String mboxParentDir = abstractFile.getParentPath();
208 String emailFolder =
"";
210 if (mboxParentDir.contains(
"/Mail/")) {
211 emailFolder = mboxParentDir.substring(mboxParentDir.indexOf(
"/Mail/") + 5);
212 }
else if (mboxParentDir.contains(
"/ImapMail/")) {
213 emailFolder = mboxParentDir.substring(mboxParentDir.indexOf(
"/ImapMail/") + 9);
215 emailFolder = emailFolder + mboxFileName;
216 emailFolder = emailFolder.replaceAll(
".sbd",
"");
218 String fileName =
getTempPath() + File.separator + abstractFile.getName()
219 +
"-" + String.valueOf(abstractFile.getId());
220 File file =
new File(fileName);
224 logger.log(Level.WARNING,
"Not enough disk space to write file to disk.");
226 NbBundle.getMessage(
this.getClass(),
"ThunderbirdMboxFileIngestModule.processMBox.errProcFile.msg",
227 abstractFile.getName()),
228 NbBundle.getMessage(
this.getClass(),
229 "ThunderbirdMboxFileIngestModule.processMBox.errProfFile.details"));
235 }
catch (IOException ex) {
236 logger.log(Level.WARNING,
"Failed writing mbox file to disk.", ex);
240 MboxParser parser =
new MboxParser(services, emailFolder);
241 List<EmailMessage> emails = parser.parse(file, abstractFile.getId());
244 if (file.delete() ==
false) {
245 logger.log(Level.INFO,
"Failed to delete temp file: {0}", file.getName());
248 String errors = parser.getErrors();
249 if (errors.isEmpty() ==
false) {
251 NbBundle.getMessage(
this.getClass(),
"ThunderbirdMboxFileIngestModule.processMBox.errProcFile.msg2",
252 abstractFile.getName()), errors);
266 File dir =
new File(tmpDir);
267 if (dir.exists() ==
false) {
276 File dir =
new File(outDir);
277 if (dir.exists() ==
false) {
296 private void processEmails(List<EmailMessage> emails, AbstractFile abstractFile) {
297 List<AbstractFile> derivedFiles =
new ArrayList<>();
298 for (EmailMessage email : emails) {
299 if (email.hasAttachment()) {
305 if (derivedFiles.isEmpty() ==
false) {
306 for (AbstractFile derived : derivedFiles) {
323 private List<AbstractFile>
handleAttachments(List<EmailMessage.Attachment> attachments, AbstractFile abstractFile) {
324 List<AbstractFile> files =
new ArrayList<>();
325 for (EmailMessage.Attachment attach : attachments) {
326 String filename = attach.getName();
327 long crTime = attach.getCrTime();
328 long mTime = attach.getmTime();
329 long aTime = attach.getaTime();
330 long cTime = attach.getcTime();
331 String relPath = attach.getLocalPath();
332 long size = attach.getSize();
336 size, cTime, crTime, aTime, mTime,
true, abstractFile,
"",
339 }
catch (TskCoreException ex) {
341 NbBundle.getMessage(
this.getClass(),
"ThunderbirdMboxFileIngestModule.handleAttch.errMsg",
342 abstractFile.getName()),
343 NbBundle.getMessage(
this.getClass(),
344 "ThunderbirdMboxFileIngestModule.handleAttch.errMsg.details", filename));
345 logger.log(Level.INFO,
"", ex);
357 private void addArtifact(EmailMessage email, AbstractFile abstractFile) {
358 List<BlackboardAttribute> bbattributes =
new ArrayList<>();
359 String to = email.getRecipients();
360 String cc = email.getCc();
361 String bcc = email.getBcc();
362 String from = email.getSender();
363 long dateL = email.getSentDate();
364 String body = email.getTextBody();
365 String bodyHTML = email.getHtmlBody();
366 String rtf = email.getRtfBody();
367 String subject = email.getSubject();
368 long id = email.getId();
369 String localPath = email.getLocalPath();
371 if (to.isEmpty() ==
false) {
372 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_EMAIL_TO,
EmailParserModuleFactory.getModuleName(), to));
374 if (cc.isEmpty() ==
false) {
375 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_EMAIL_CC,
EmailParserModuleFactory.getModuleName(), cc));
377 if (bcc.isEmpty() ==
false) {
378 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_EMAIL_BCC,
EmailParserModuleFactory.getModuleName(), bcc));
380 if (from.isEmpty() ==
false) {
381 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_EMAIL_FROM,
EmailParserModuleFactory.getModuleName(), from));
384 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME_RCVD,
EmailParserModuleFactory.getModuleName(), dateL));
385 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME_SENT,
EmailParserModuleFactory.getModuleName(), dateL));
387 if (body.isEmpty() ==
false) {
388 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_EMAIL_CONTENT_PLAIN,
EmailParserModuleFactory.getModuleName(), body));
390 if (bodyHTML.isEmpty() ==
false) {
391 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_EMAIL_CONTENT_HTML,
EmailParserModuleFactory.getModuleName(), bodyHTML));
393 if (rtf.isEmpty() ==
false) {
394 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_EMAIL_CONTENT_RTF,
EmailParserModuleFactory.getModuleName(), rtf));
396 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_MSG_ID,
EmailParserModuleFactory.getModuleName(), ((
id < 0L) ? NbBundle
397 .getMessage(this.getClass(),
"ThunderbirdMboxFileIngestModule.notAvail") : String.valueOf(
id))));
398 if (subject.isEmpty() ==
false) {
399 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_SUBJECT,
EmailParserModuleFactory.getModuleName(), subject));
401 if (localPath.isEmpty() ==
false) {
402 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PATH,
EmailParserModuleFactory.getModuleName(), localPath));
404 bbattributes.add(
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PATH,
EmailParserModuleFactory.getModuleName(),
"/foo/bar"));
408 BlackboardArtifact bbart;
409 bbart = abstractFile.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG);
410 bbart.addAttributes(bbattributes);
416 logger.log(Level.SEVERE, NbBundle.getMessage(
Blackboard.class,
"Blackboard.unableToIndexArtifact.error.msg", bbart.getDisplayName()), ex);
418 NbBundle.getMessage(
Blackboard.class,
"Blackboard.unableToIndexArtifact.exception.msg"), bbart.getDisplayName());
420 }
catch (TskCoreException ex) {
421 logger.log(Level.WARNING, null, ex);
425 void postErrorMessage(String subj, String details) {
430 IngestServices getServices() {
String getModuleOutputDirectoryRelativePath()
static final Logger logger
FileManager getFileManager()
void indexArtifact(BlackboardArtifact artifact)
String getTempDirectory()
static IngestMessage createErrorMessage(String source, String subject, String detailsHtml)
static< T > long writeToFile(Content content, java.io.File outputFile, ProgressHandle progress, Future< T > worker, boolean source)
synchronized DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parentFile, String rederiveDetails, String toolName, String toolVersion, String otherDetails)
ProcessResult processMBox(AbstractFile abstractFile)
static final int DISK_FREE_SPACE_UNKNOWN
void processEmails(List< EmailMessage > emails, AbstractFile abstractFile)
void addFilesToJob(List< AbstractFile > files)
void addArtifact(EmailMessage email, AbstractFile abstractFile)
static String getModuleOutputPath()
void postMessage(final IngestMessage message)
void fireModuleDataEvent(ModuleDataEvent moduleDataEvent)
ProcessResult process(AbstractFile abstractFile)
String getModuleDirectory()
ProcessResult processPst(AbstractFile abstractFile)
void startUp(IngestJobContext context)
Blackboard getBlackboard()
void fireModuleContentEvent(ModuleContentEvent moduleContentEvent)
static void error(String title, String message)
static String getRelModuleOutputPath()
static Case getCurrentCase()
synchronized static Logger getLogger(String name)
static String getTempPath()
List< AbstractFile > handleAttachments(List< EmailMessage.Attachment > attachments, AbstractFile abstractFile)
static synchronized IngestServices getInstance()