From 8f2177a4744c71f3168e3e02b5528ddc2b35ce1e Mon Sep 17 00:00:00 2001 From: Mark McKinnon Date: Mon, 31 Oct 2022 17:03:03 -0400 Subject: [PATCH 1/2] Add has_attachments attribute based on email hasAttachment add has_attachment attribute based on email hasAttachment --- .../ThunderbirdMboxFileIngestModule.java | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/ThunderbirdMboxFileIngestModule.java b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/ThunderbirdMboxFileIngestModule.java index 13ca786c3b..80b35b4544 100644 --- a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/ThunderbirdMboxFileIngestModule.java +++ b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/ThunderbirdMboxFileIngestModule.java @@ -769,6 +769,14 @@ public final class ThunderbirdMboxFileIngestModule implements FileIngestModule { addArtifactAttribute(((id < 0L) ? NbBundle.getMessage(this.getClass(), "ThunderbirdMboxFileIngestModule.notAvail") : String.valueOf(id)), ATTRIBUTE_TYPE.TSK_MSG_ID, bbattributes); + try { + addArtifactAttribute((email.hasAttachment() ? "Yes" : ""), + blackboard.getOrAddAttributeType("EMAIL_HAS_ATTACHMENT", BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING, "Has Attachments"), + bbattributes); + } catch (Blackboard.BlackboardException ex) { + logger.log(Level.SEVERE, "Unable to create EMAIL_HAS_ATTACHMENT attribute" , ex); //NON-NLS + } + addArtifactAttribute(((localPath.isEmpty() == false) ? localPath : ""), ATTRIBUTE_TYPE.TSK_PATH, bbattributes); From 47959d14e8b85bc640dc44f4f394393196e229d8 Mon Sep 17 00:00:00 2001 From: Mark McKinnon Date: Tue, 1 Nov 2022 10:22:25 -0400 Subject: [PATCH 2/2] Update PstParser.java Add sender SMTP or Email address to sender string. --- .../org/sleuthkit/autopsy/thunderbirdparser/PstParser.java | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/PstParser.java b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/PstParser.java index 358c67a8a5..203bbeb930 100644 --- a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/PstParser.java +++ b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/PstParser.java @@ -300,7 +300,7 @@ class PstParser implements AutoCloseable{ email.setRecipients(toAddress); email.setCc(ccAddress); email.setBcc(bccAddress); - email.setSender(getSender(msg.getSenderName(), msg.getSentRepresentingSMTPAddress())); + email.setSender(getSender(msg.getSenderName(), (msg.getSentRepresentingSMTPAddress().isEmpty()) ? msg.getSenderEmailAddress() : msg.getSentRepresentingSMTPAddress())); email.setSentDate(msg.getMessageDeliveryTime()); email.setTextBody(msg.getBody()); if (false == msg.getTransportMessageHeaders().isEmpty()) { @@ -318,7 +318,7 @@ class PstParser implements AutoCloseable{ email.setSubject(msg.getSubject()); email.setId(msg.getDescriptorNodeId()); email.setMessageID(msg.getInternetMessageId()); - + String inReplyToID = msg.getInReplyToId(); email.setInReplyToID(inReplyToID); @@ -479,7 +479,7 @@ class PstParser implements AutoCloseable{ } else if (addr.isEmpty()) { return name; } else { - return name + ": " + addr; + return name + " <" + addr + ">"; } }