diff --git a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/EmailMessage.java b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/EmailMessage.java index 6b2af09f21..b633963e9f 100644 --- a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/EmailMessage.java +++ b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/EmailMessage.java @@ -50,6 +50,7 @@ class EmailMessage { private List references = null; private String simplifiedSubject = ""; private boolean isReplySubject = false; + private String messageThreadID = ""; boolean hasAttachment() { return hasAttachment; @@ -266,6 +267,24 @@ class EmailMessage { void setReferences(List references) { this.references = references; } + + /** + * Sets the ThreadID of this message. + * + * @param threadID - the thread ID to set + */ + void setMessageThreadID(String threadID) { + this.messageThreadID = threadID; + } + + /** + * Returns the ThreadID for this message. + * + * @return - the message thread ID or "" is non is available + */ + String getMessageThreadID() { + return this.messageThreadID; + } /** * A Record to hold generic information about attachments. diff --git a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/EmailMessageThreader.java b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/EmailMessageThreader.java index a23c91ab25..bc21720126 100755 --- a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/EmailMessageThreader.java +++ b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/EmailMessageThreader.java @@ -39,7 +39,7 @@ final class EmailMessageThreader { private int bogus_id_count = 0; - public Set threadMessages(List emailMessages) { + public void threadMessages(List emailMessages, String threadIDPrefix) { HashMap id_table = createIDTable(emailMessages); Set rootSet = getRootSet(id_table); @@ -47,9 +47,7 @@ final class EmailMessageThreader { Set finalSet = groupBySubject(rootSet); - printContainerSet(finalSet, ""); - - return finalSet; + assignThreadIDs(finalSet, threadIDPrefix); } /** @@ -59,7 +57,7 @@ final class EmailMessageThreader { * * @param emailMessages * - * @return + * @return - HashMap of all message where the key is the message-ID of the message */ private HashMap createIDTable(List emailMessages) { HashMap id_table = new HashMap<>(); @@ -197,7 +195,6 @@ final class EmailMessageThreader { Set containersToRemove = new HashSet<>(); containerSet.forEach((container) -> { if (!container.hasMessage() && !container.hasChildren()) { -// containerSet.remove(container); containersToRemove.add(container); } else { pruneChildren(container); @@ -229,8 +226,6 @@ final class EmailMessageThreader { Set add = new HashSet<>(); for (Container child : parent.getChildren()) { if (pruneChildren(child)) { -// parent.addChildren(child.getChildren()); -// parent.removeChild(child); remove.add(child); add.addAll(child.getChildren()); child.setParent(null); @@ -243,9 +238,9 @@ final class EmailMessageThreader { parent.removeChildren(remove); if (!parent.hasMessage() && grandParent != null) { - for (Container child : children) { + children.forEach((child) -> { child.setParent(grandParent); - } + }); return true; } @@ -392,6 +387,32 @@ final class EmailMessageThreader { return subject_table; } + + private void assignThreadIDs(Set containerSet, String IDPrefix) { + int threadCounter = 0; + + for(Container container: containerSet) { + String threadID = String.format("%s-%d", IDPrefix, threadCounter++); + addThreadID(container, threadID); + } + } + + private void addThreadID(Container container, String threadID) { + if(container == null) { + return; + } + + EmailMessage message = container.getMessage(); + if(message != null) { + message.setMessageThreadID(threadID); + } + + if(container.hasChildren()) { + for(Container child: container.getChildren()) { + addThreadID(child, threadID); + } + } + } /** * Prints a set of containers and their children. diff --git a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/ThunderbirdMboxFileIngestModule.java b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/ThunderbirdMboxFileIngestModule.java index a6728507ea..c0771c996e 100644 --- a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/ThunderbirdMboxFileIngestModule.java +++ b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/ThunderbirdMboxFileIngestModule.java @@ -411,7 +411,7 @@ public final class ThunderbirdMboxFileIngestModule implements FileIngestModule { List derivedFiles = new ArrayList<>(); EmailMessageThreader threader = new EmailMessageThreader(); - threader.threadMessages(emails); + threader.threadMessages(emails, String.format("%d", abstractFile.getId())); for (EmailMessage email : emails) { BlackboardArtifact msgArtifact = addEmailArtifact(email, abstractFile); @@ -511,6 +511,7 @@ public final class ThunderbirdMboxFileIngestModule implements FileIngestModule { String subject = email.getSubject(); long id = email.getId(); String localPath = email.getLocalPath(); + String threadID = email.getMessageThreadID(); List senderAddressList = new ArrayList<>(); String senderAddress; @@ -568,6 +569,7 @@ public final class ThunderbirdMboxFileIngestModule implements FileIngestModule { addArtifactAttribute(cc, ATTRIBUTE_TYPE.TSK_EMAIL_CC, bbattributes); addArtifactAttribute(bodyHTML, ATTRIBUTE_TYPE.TSK_EMAIL_CONTENT_HTML, bbattributes); addArtifactAttribute(rtf, ATTRIBUTE_TYPE.TSK_EMAIL_CONTENT_RTF, bbattributes); + addArtifactAttribute(threadID, ATTRIBUTE_TYPE.TSK_THREAD_ID, bbattributes); try {