Autopsy  4.10.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
PstParser.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011-2014 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.thunderbirdparser;
20 
21 import com.pff.PSTAttachment;
22 import com.pff.PSTException;
23 import com.pff.PSTFile;
24 import com.pff.PSTFolder;
25 import com.pff.PSTMessage;
26 import java.io.File;
27 import java.io.FileOutputStream;
28 import java.io.IOException;
29 import java.io.InputStream;
30 import java.nio.ByteBuffer;
31 import java.util.ArrayList;
32 import java.util.List;
33 import java.util.logging.Level;
35 import org.openide.util.NbBundle;
40 import static org.sleuthkit.autopsy.thunderbirdparser.ThunderbirdMboxFileIngestModule.getRelModuleOutputPath;
41 import org.sleuthkit.datamodel.AbstractFile;
42 import org.sleuthkit.datamodel.EncodedFileOutputStream;
43 import org.sleuthkit.datamodel.TskCoreException;
44 import org.sleuthkit.datamodel.TskData;
45 
51 class PstParser {
52 
53  private static final Logger logger = Logger.getLogger(PstParser.class.getName());
57  private static int PST_HEADER = 0x2142444E;
58  private IngestServices services;
63  private List<EmailMessage> results;
64  private StringBuilder errors;
65 
66  PstParser(IngestServices services) {
67  results = new ArrayList<>();
68  this.services = services;
69  errors = new StringBuilder();
70  }
71 
72  enum ParseResult {
73 
74  OK, ERROR, ENCRYPT;
75  }
76 
85  ParseResult parse(File file, long fileID) {
86  PSTFile pstFile;
87  long failures;
88  try {
89  pstFile = new PSTFile(file);
90  failures = processFolder(pstFile.getRootFolder(), "\\", true, fileID);
91  if (failures > 0) {
92  addErrorMessage(
93  NbBundle.getMessage(this.getClass(), "PstParser.parse.errMsg.failedToParseNMsgs", failures));
94  }
95  return ParseResult.OK;
96  } catch (PSTException | IOException ex) {
97  String msg = file.getName() + ": Failed to create internal java-libpst PST file to parse:\n" + ex.getMessage(); //NON-NLS
98  logger.log(Level.WARNING, msg);
99  return ParseResult.ERROR;
100  } catch (IllegalArgumentException ex) {
101  logger.log(Level.INFO, "Found encrypted PST file."); //NON-NLS
102  return ParseResult.ENCRYPT;
103  }
104  }
105 
111  List<EmailMessage> getResults() {
112  return results;
113  }
114 
115  String getErrors() {
116  return errors.toString();
117  }
118 
131  private long processFolder(PSTFolder folder, String path, boolean root, long fileID) {
132  String newPath = (root ? path : path + "\\" + folder.getDisplayName());
133  long failCount = 0L; // Number of emails that failed
134  if (folder.hasSubfolders()) {
135  List<PSTFolder> subFolders;
136  try {
137  subFolders = folder.getSubFolders();
138  } catch (PSTException | IOException ex) {
139  subFolders = new ArrayList<>();
140  logger.log(Level.INFO, "java-libpst exception while getting subfolders: {0}", ex.getMessage()); //NON-NLS
141  }
142 
143  for (PSTFolder f : subFolders) {
144  failCount += processFolder(f, newPath, false, fileID);
145  }
146  }
147 
148  if (folder.getContentCount() != 0) {
149  PSTMessage email;
150  // A folder's children are always emails, never other folders.
151  try {
152  while ((email = (PSTMessage) folder.getNextChild()) != null) {
153  results.add(extractEmailMessage(email, newPath, fileID));
154  }
155  } catch (PSTException | IOException ex) {
156  failCount++;
157  logger.log(Level.INFO, "java-libpst exception while getting emails from a folder: {0}", ex.getMessage()); //NON-NLS
158  }
159  }
160 
161  return failCount;
162  }
163 
172  private EmailMessage extractEmailMessage(PSTMessage msg, String localPath, long fileID) {
173  EmailMessage email = new EmailMessage();
174  email.setRecipients(msg.getDisplayTo());
175  email.setCc(msg.getDisplayCC());
176  email.setBcc(msg.getDisplayBCC());
177  email.setSender(getSender(msg.getSenderName(), msg.getSenderEmailAddress()));
178  email.setSentDate(msg.getMessageDeliveryTime());
179  email.setTextBody(msg.getBody());
180  if(false == msg.getTransportMessageHeaders().isEmpty()) {
181  email.setHeaders("\n-----HEADERS-----\n\n" + msg.getTransportMessageHeaders() + "\n\n---END HEADERS--\n\n");
182  }
183 
184  email.setHtmlBody(msg.getBodyHTML());
185  String rtf = "";
186  try {
187  rtf = msg.getRTFBody();
188  } catch (PSTException | IOException ex) {
189  logger.log(Level.INFO, "Failed to get RTF content from pst email."); //NON-NLS
190  }
191  email.setRtfBody(rtf);
192  email.setLocalPath(localPath);
193  email.setSubject(msg.getSubject());
194  email.setId(msg.getDescriptorNodeId());
195 
196  if (msg.hasAttachments()) {
197  extractAttachments(email, msg, fileID);
198  }
199 
200  return email;
201  }
202 
209  @NbBundle.Messages({"PstParser.noOpenCase.errMsg=Exception while getting open case."})
210  private void extractAttachments(EmailMessage email, PSTMessage msg, long fileID) {
211  int numberOfAttachments = msg.getNumberOfAttachments();
212  String outputDirPath;
213  try {
214  outputDirPath = ThunderbirdMboxFileIngestModule.getModuleOutputPath() + File.separator;
215  } catch (NoCurrentCaseException ex) {
216  logger.log(Level.SEVERE, "Exception while getting open case.", ex); //NON-NLS
217  return;
218  }
219  for (int x = 0; x < numberOfAttachments; x++) {
220  String filename = "";
221  try {
222  PSTAttachment attach = msg.getAttachment(x);
223  long size = attach.getAttachSize();
224  long freeSpace = services.getFreeDiskSpace();
225  if ((freeSpace != IngestMonitor.DISK_FREE_SPACE_UNKNOWN) && (size >= freeSpace)) {
226  continue;
227  }
228  // both long and short filenames can be used for attachments
229  filename = attach.getLongFilename();
230  if (filename.isEmpty()) {
231  filename = attach.getFilename();
232  }
233  String uniqueFilename = fileID + "-" + msg.getDescriptorNodeId() + "-" + attach.getContentId() + "-" + filename;
234  String outPath = outputDirPath + uniqueFilename;
235  saveAttachmentToDisk(attach, outPath);
236 
237  EmailMessage.Attachment attachment = new EmailMessage.Attachment();
238 
239  long crTime = attach.getCreationTime() != null ? attach.getCreationTime().getTime() / 1000 : 0;
240  long mTime = attach.getModificationTime() != null ? attach.getModificationTime().getTime() / 1000 : 0;
241  String relPath = getRelModuleOutputPath() + File.separator + uniqueFilename;
242  attachment.setName(filename);
243  attachment.setCrTime(crTime);
244  attachment.setmTime(mTime);
245  attachment.setLocalPath(relPath);
246  attachment.setSize(attach.getFilesize());
247  attachment.setEncodingType(TskData.EncodingType.XOR1);
248  email.addAttachment(attachment);
249  } catch (PSTException | IOException | NullPointerException ex) {
254  addErrorMessage(
255  NbBundle.getMessage(this.getClass(), "PstParser.extractAttch.errMsg.failedToExtractToDisk",
256  filename));
257  logger.log(Level.WARNING, "Failed to extract attachment from pst file.", ex); //NON-NLS
258  } catch (NoCurrentCaseException ex) {
259  addErrorMessage(Bundle.PstParser_noOpenCase_errMsg());
260  logger.log(Level.SEVERE, Bundle.PstParser_noOpenCase_errMsg(), ex); //NON-NLS
261  }
262  }
263  }
264 
276  private void saveAttachmentToDisk(PSTAttachment attach, String outPath) throws IOException, PSTException {
277  try (InputStream attachmentStream = attach.getFileInputStream();
278  EncodedFileOutputStream out = new EncodedFileOutputStream(new FileOutputStream(outPath), TskData.EncodingType.XOR1)) {
279  // 8176 is the block size used internally and should give the best performance
280  int bufferSize = 8176;
281  byte[] buffer = new byte[bufferSize];
282  int count = attachmentStream.read(buffer);
283 
284  if (count == -1) {
285  throw new IOException("attachmentStream invalid (read() fails). File " + attach.getLongFilename() + " skipped");
286  }
287 
288  while (count == bufferSize) {
289  out.write(buffer);
290  count = attachmentStream.read(buffer);
291  }
292  if (count != -1) {
293  byte[] endBuffer = new byte[count];
294  System.arraycopy(buffer, 0, endBuffer, 0, count);
295  out.write(endBuffer);
296  }
297  }
298  }
299 
308  private String getSender(String name, String addr) {
309  if (name.isEmpty() && addr.isEmpty()) {
310  return "";
311  } else if (name.isEmpty()) {
312  return addr;
313  } else if (addr.isEmpty()) {
314  return name;
315  } else {
316  return name + ": " + addr;
317  }
318  }
319 
327  public static boolean isPstFile(AbstractFile file) {
328  byte[] buffer = new byte[4];
329  try {
330  int read = file.read(buffer, 0, 4);
331  if (read != 4) {
332  return false;
333  }
334  ByteBuffer bb = ByteBuffer.wrap(buffer);
335  return bb.getInt() == PST_HEADER;
336  } catch (TskCoreException ex) {
337  logger.log(Level.WARNING, "Exception while detecting if a file is a pst file."); //NON-NLS
338  return false;
339  }
340  }
341 
342  private void addErrorMessage(String msg) {
343  errors.append("<li>").append(msg).append("</li>"); //NON-NLS
344  }
345 }

Copyright © 2012-2018 Basis Technology. Generated on: Fri Mar 22 2019
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.