diff --git a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/PstParser.java b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/PstParser.java index 358c67a8a5..203bbeb930 100644 --- a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/PstParser.java +++ b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/PstParser.java @@ -300,7 +300,7 @@ class PstParser implements AutoCloseable{ email.setRecipients(toAddress); email.setCc(ccAddress); email.setBcc(bccAddress); - email.setSender(getSender(msg.getSenderName(), msg.getSentRepresentingSMTPAddress())); + email.setSender(getSender(msg.getSenderName(), (msg.getSentRepresentingSMTPAddress().isEmpty()) ? msg.getSenderEmailAddress() : msg.getSentRepresentingSMTPAddress())); email.setSentDate(msg.getMessageDeliveryTime()); email.setTextBody(msg.getBody()); if (false == msg.getTransportMessageHeaders().isEmpty()) { @@ -318,7 +318,7 @@ class PstParser implements AutoCloseable{ email.setSubject(msg.getSubject()); email.setId(msg.getDescriptorNodeId()); email.setMessageID(msg.getInternetMessageId()); - + String inReplyToID = msg.getInReplyToId(); email.setInReplyToID(inReplyToID); @@ -479,7 +479,7 @@ class PstParser implements AutoCloseable{ } else if (addr.isEmpty()) { return name; } else { - return name + ": " + addr; + return name + " <" + addr + ">"; } } diff --git a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/ThunderbirdMboxFileIngestModule.java b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/ThunderbirdMboxFileIngestModule.java index 13ca786c3b..80b35b4544 100644 --- a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/ThunderbirdMboxFileIngestModule.java +++ b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/ThunderbirdMboxFileIngestModule.java @@ -769,6 +769,14 @@ public final class ThunderbirdMboxFileIngestModule implements FileIngestModule { addArtifactAttribute(((id < 0L) ? NbBundle.getMessage(this.getClass(), "ThunderbirdMboxFileIngestModule.notAvail") : String.valueOf(id)), ATTRIBUTE_TYPE.TSK_MSG_ID, bbattributes); + try { + addArtifactAttribute((email.hasAttachment() ? "Yes" : ""), + blackboard.getOrAddAttributeType("EMAIL_HAS_ATTACHMENT", BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING, "Has Attachments"), + bbattributes); + } catch (Blackboard.BlackboardException ex) { + logger.log(Level.SEVERE, "Unable to create EMAIL_HAS_ATTACHMENT attribute" , ex); //NON-NLS + } + addArtifactAttribute(((localPath.isEmpty() == false) ? localPath : ""), ATTRIBUTE_TYPE.TSK_PATH, bbattributes);