diff --git a/Core/src/org/sleuthkit/autopsy/modules/iOS/ContactAnalyzer.java b/Core/src/org/sleuthkit/autopsy/modules/iOS/ContactAnalyzer.java index 85fa762300..ce3f971bee 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/iOS/ContactAnalyzer.java +++ b/Core/src/org/sleuthkit/autopsy/modules/iOS/ContactAnalyzer.java @@ -163,6 +163,8 @@ final class ContactAnalyzer { data1 = resultSet.getString("data1"); //NON-NLS mimetype = resultSet.getString("mimetype"); //NON-NLS if (name.equals(oldName) == false) { + bba = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT); + attributes = new ArrayList<>(); attributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME, moduleName, name)); } if (mimetype.equals("vnd.android.cursor.item/phone_v2")) { //NON-NLS @@ -170,6 +172,12 @@ final class ContactAnalyzer { } else { attributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL, moduleName, data1)); } + + // TODO: If this code comes back to life, add code to create the account + // and relationship between the phone numbers & emails. Also + // investigate if the mimetype "vnd.android.cursor.item/phone_v2" + // makes sense in an ios word + oldName = name; bba.addAttributes(attributes); diff --git a/InternalPythonModules/android/contact.py b/InternalPythonModules/android/contact.py index e387d73920..2d442c8e4a 100644 --- a/InternalPythonModules/android/contact.py +++ b/InternalPythonModules/android/contact.py @@ -141,6 +141,7 @@ class ContactAnalyzer(general.AndroidComponentAnalyzer): name = resultSet.getString("display_name") data1 = resultSet.getString("data1") # the phone number or email mimetype = resultSet.getString("mimetype") # either phone or email + attributes = ArrayList() if name != oldName: artifact = abstractFile.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT) attributes.add(BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME, general.MODULE_NAME, name)) diff --git a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/VcardParser.java b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/VcardParser.java index d1f5f25777..15d52b536e 100755 --- a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/VcardParser.java +++ b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/VcardParser.java @@ -193,7 +193,7 @@ final class VcardParser { } } } - ThunderbirdMboxFileIngestModule.addArtifactAttribute(name, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME_PERSON, attributes); + ThunderbirdMboxFileIngestModule.addArtifactAttribute(name, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME, attributes); for (Telephone telephone : vcard.getTelephoneNumbers()) { addPhoneAttributes(telephone, abstractFile, attributes); @@ -412,7 +412,7 @@ final class VcardParser { type.getValue().toUpperCase().replaceAll("\\s+","").split(",")); for (String splitType : splitTelephoneTypes) { - String attributeTypeName = "TSK_PHONE_" + splitType; + String attributeTypeName = "TSK_PHONE_NUMBER_" + splitType; try { BlackboardAttribute.Type attributeType = tskCase.getAttributeType(attributeTypeName); if (attributeType == null) {