mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-06 21:00:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed bugs with contact creation

Browse Source
This commit is contained in:
Kelly Kelly 2019-04-22 10:37:56 -04:00
parent 72b30ea922
commit ae796dfcb0
3 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
Core/src/org/sleuthkit/autopsy/modules/iOS/ContactAnalyzer.java
View File

@ -163,6 +163,8 @@ final class ContactAnalyzer {
data1 = resultSet.getString("data1"); //NON-NLS data1 = resultSet.getString("data1"); //NON-NLS
mimetype = resultSet.getString("mimetype"); //NON-NLS mimetype = resultSet.getString("mimetype"); //NON-NLS
if (name.equals(oldName) == false) { if (name.equals(oldName) == false) {
bba = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT);
attributes = new ArrayList<>();
attributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME, moduleName, name)); attributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME, moduleName, name));
} }
if (mimetype.equals("vnd.android.cursor.item/phone_v2")) { //NON-NLS if (mimetype.equals("vnd.android.cursor.item/phone_v2")) { //NON-NLS
@ -170,6 +172,12 @@ final class ContactAnalyzer {
} else { } else {
attributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL, moduleName, data1)); attributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL, moduleName, data1));
} }
// TODO: If this code comes back to life, add code to create the account
// and relationship between the phone numbers & emails. Also
// investigate if the mimetype "vnd.android.cursor.item/phone_v2"
// makes sense in an ios word
oldName = name; oldName = name;
bba.addAttributes(attributes); bba.addAttributes(attributes);

1
InternalPythonModules/android/contact.py
View File

@ -141,6 +141,7 @@ class ContactAnalyzer(general.AndroidComponentAnalyzer):
name = resultSet.getString("display_name") name = resultSet.getString("display_name")
data1 = resultSet.getString("data1") # the phone number or email data1 = resultSet.getString("data1") # the phone number or email
mimetype = resultSet.getString("mimetype") # either phone or email mimetype = resultSet.getString("mimetype") # either phone or email
attributes = ArrayList()
if name != oldName: if name != oldName:
artifact = abstractFile.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT) artifact = abstractFile.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT)
attributes.add(BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME, general.MODULE_NAME, name)) attributes.add(BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME, general.MODULE_NAME, name))

4
thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/VcardParser.java
View File

@ -193,7 +193,7 @@ final class VcardParser {
} }
} }
} }
ThunderbirdMboxFileIngestModule.addArtifactAttribute(name, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME_PERSON, attributes); ThunderbirdMboxFileIngestModule.addArtifactAttribute(name, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME, attributes);
for (Telephone telephone : vcard.getTelephoneNumbers()) { for (Telephone telephone : vcard.getTelephoneNumbers()) {
addPhoneAttributes(telephone, abstractFile, attributes); addPhoneAttributes(telephone, abstractFile, attributes);
@ -412,7 +412,7 @@ final class VcardParser {
type.getValue().toUpperCase().replaceAll("\\s+","").split(",")); type.getValue().toUpperCase().replaceAll("\\s+","").split(","));
for (String splitType : splitTelephoneTypes) { for (String splitType : splitTelephoneTypes) {
String attributeTypeName = "TSK_PHONE_" + splitType; String attributeTypeName = "TSK_PHONE_NUMBER_" + splitType;
try { try {
BlackboardAttribute.Type attributeType = tskCase.getAttributeType(attributeTypeName); BlackboardAttribute.Type attributeType = tskCase.getAttributeType(attributeTypeName);
if (attributeType == null) { if (attributeType == null) {