From de0a8d1bd50110f7369f9ad9eb7a2d91eb1a7407 Mon Sep 17 00:00:00 2001 From: Oliver Spohngellert Date: Tue, 23 Feb 2016 12:05:28 -0500 Subject: [PATCH 1/7] Started thunderbird update --- .../autopsy/thunderbirdparser/MboxParser.java | 10 +++++++--- .../sleuthkit/autopsy/thunderbirdparser/PstParser.java | 7 ++++++- 2 files changed, 13 insertions(+), 4 deletions(-) diff --git a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java index 69255cf7d8..7667036de3 100755 --- a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java +++ b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java @@ -51,6 +51,7 @@ import org.apache.james.mime4j.dom.field.ContentTypeField; import org.apache.james.mime4j.mboxiterator.CharBufferWrapper; import org.apache.james.mime4j.mboxiterator.MboxIterator; import org.apache.james.mime4j.message.DefaultMessageBuilder; +import org.apache.james.mime4j.stream.Field; import org.apache.james.mime4j.stream.MimeConfig; import org.apache.tika.parser.txt.CharsetDetector; import org.apache.tika.parser.txt.CharsetMatch; @@ -179,7 +180,7 @@ class MboxParser { if (msg.isMultipart()) { handleMultipart(email, (Multipart) msg.getBody(), fileID); } else { - handleTextBody(email, (TextBody) msg.getBody(), msg.getMimeType()); + handleTextBody(email, (TextBody) msg.getBody(), msg.getMimeType(), msg.getHeader().getFields()); } return email; @@ -204,7 +205,7 @@ class MboxParser { handleAttachment(email, e, fileID, index); } else if (e.getMimeType().equals(HTML_TYPE) || e.getMimeType().equals(ContentTypeField.TYPE_TEXT_PLAIN)) { - handleTextBody(email, (TextBody) e.getBody(), e.getMimeType()); + handleTextBody(email, (TextBody) e.getBody(), e.getMimeType(), e.getHeader().getFields()); } else { // Ignore other types. } @@ -221,7 +222,7 @@ class MboxParser { * @param tb * @param type The Mime type of the body. */ - private void handleTextBody(EmailMessage email, TextBody tb, String type) { + private void handleTextBody(EmailMessage email, TextBody tb, String type, List fields) { BufferedReader r; try { r = new BufferedReader(tb.getReader()); @@ -230,6 +231,9 @@ class MboxParser { while ((line = r.readLine()) != null) { bodyString.append(line).append("\n"); } + for(Field field: fields) { + bodyString.append("---").append(field.getBody()); + } switch (type) { case ContentTypeField.TYPE_TEXT_PLAIN: diff --git a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/PstParser.java b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/PstParser.java index 800e283b55..43d04173a0 100755 --- a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/PstParser.java +++ b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/PstParser.java @@ -172,7 +172,12 @@ class PstParser { email.setBcc(msg.getDisplayBCC()); email.setSender(getSender(msg.getSenderName(), msg.getSenderEmailAddress())); email.setSentDate(msg.getMessageDeliveryTime()); - email.setTextBody(msg.getBody()); + if(msg.getTransportMessageHeaders().isEmpty()) { + email.setTextBody(msg.getBody()); + } else { + email.setTextBody(msg.getBody() + "---" + msg.getTransportMessageHeaders()); + } + email.setHtmlBody(msg.getBodyHTML()); String rtf = ""; try { From 6cae8e8c29b9502a7ae7f204b5aaad6efa05abc5 Mon Sep 17 00:00:00 2001 From: Oliver Spohngellert Date: Tue, 23 Feb 2016 13:25:19 -0500 Subject: [PATCH 2/7] Header update --- .../org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java index 7667036de3..cb66d2ca48 100755 --- a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java +++ b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java @@ -232,7 +232,8 @@ class MboxParser { bodyString.append(line).append("\n"); } for(Field field: fields) { - bodyString.append("---").append(field.getBody()); + String body = field.getBody(); + bodyString.append("---").append(body); } switch (type) { From 99285d06474699f35b21a844b049155bebb09837 Mon Sep 17 00:00:00 2001 From: Oliver Spohngellert Date: Wed, 24 Feb 2016 13:20:24 -0500 Subject: [PATCH 3/7] Fixed header display --- .../org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java index cb66d2ca48..b71ca6aff2 100755 --- a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java +++ b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java @@ -232,8 +232,8 @@ class MboxParser { bodyString.append(line).append("\n"); } for(Field field: fields) { - String body = field.getBody(); - bodyString.append("---").append(body); + String nextLine = field.getName() + ": " + field.getBody(); + bodyString.append("\n").append(nextLine); } switch (type) { From 0adfe26aec4f3a987ace5c6a8bd0d9c902772460 Mon Sep 17 00:00:00 2001 From: Oliver Spohngellert Date: Wed, 24 Feb 2016 16:08:22 -0500 Subject: [PATCH 4/7] Fixed --- to \n --- .../src/org/sleuthkit/autopsy/thunderbirdparser/PstParser.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/PstParser.java b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/PstParser.java index 43d04173a0..31655cb578 100755 --- a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/PstParser.java +++ b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/PstParser.java @@ -175,7 +175,7 @@ class PstParser { if(msg.getTransportMessageHeaders().isEmpty()) { email.setTextBody(msg.getBody()); } else { - email.setTextBody(msg.getBody() + "---" + msg.getTransportMessageHeaders()); + email.setTextBody(msg.getBody() + "\n" + msg.getTransportMessageHeaders()); } email.setHtmlBody(msg.getBodyHTML()); From 8b9b97b910dd9f4f3b482383fc730e6abad1a829 Mon Sep 17 00:00:00 2001 From: Oliver Spohngellert Date: Wed, 24 Feb 2016 16:44:50 -0500 Subject: [PATCH 5/7] Updated mbox header line --- .../src/org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java index b71ca6aff2..aa32c35908 100755 --- a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java +++ b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java @@ -233,7 +233,7 @@ class MboxParser { } for(Field field: fields) { String nextLine = field.getName() + ": " + field.getBody(); - bodyString.append("\n").append(nextLine); + bodyString.append("\n-----HEADER-----\n").append(nextLine); } switch (type) { From 62b436c4ba71e4e2950586191c083d7d90005b47 Mon Sep 17 00:00:00 2001 From: Oliver Spohngellert Date: Wed, 24 Feb 2016 16:45:41 -0500 Subject: [PATCH 6/7] Updated header line --- .../org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java index aa32c35908..c0d397795a 100755 --- a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java +++ b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java @@ -229,11 +229,11 @@ class MboxParser { StringBuilder bodyString = new StringBuilder(); String line; while ((line = r.readLine()) != null) { - bodyString.append(line).append("\n"); + bodyString.append(line).append("\n-----HEADER-----\n"); } for(Field field: fields) { String nextLine = field.getName() + ": " + field.getBody(); - bodyString.append("\n-----HEADER-----\n").append(nextLine); + bodyString.append("\n").append(nextLine); } switch (type) { From 0528cb5952c55b0d9d8203e33731e2b2578682df Mon Sep 17 00:00:00 2001 From: Oliver Spohngellert Date: Thu, 25 Feb 2016 08:48:06 -0500 Subject: [PATCH 7/7] Updated headers formatting --- .../org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java | 4 +++- .../org/sleuthkit/autopsy/thunderbirdparser/PstParser.java | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java index c0d397795a..56aea2f826 100755 --- a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java +++ b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java @@ -229,12 +229,14 @@ class MboxParser { StringBuilder bodyString = new StringBuilder(); String line; while ((line = r.readLine()) != null) { - bodyString.append(line).append("\n-----HEADER-----\n"); + bodyString.append(line).append("\n"); } + bodyString.append("\n-----HEADERS-----\n"); for(Field field: fields) { String nextLine = field.getName() + ": " + field.getBody(); bodyString.append("\n").append(nextLine); } + bodyString.append("\n\n---END HEADERS--\n\n"); switch (type) { case ContentTypeField.TYPE_TEXT_PLAIN: diff --git a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/PstParser.java b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/PstParser.java index 31655cb578..7958464a22 100755 --- a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/PstParser.java +++ b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/PstParser.java @@ -175,7 +175,7 @@ class PstParser { if(msg.getTransportMessageHeaders().isEmpty()) { email.setTextBody(msg.getBody()); } else { - email.setTextBody(msg.getBody() + "\n" + msg.getTransportMessageHeaders()); + email.setTextBody(msg.getBody() + "\n-----HEADERS-----\n\n" + msg.getTransportMessageHeaders() + "\n\n---END HEADERS--\n\n"); } email.setHtmlBody(msg.getBodyHTML());