From e4d874296838185f8d41d72c4b23920118f86e80 Mon Sep 17 00:00:00 2001
From: Greg DiCristofaro <gregd@basistech.com>
Date: Thu, 21 Apr 2022 14:15:55 -0400
Subject: [PATCH] regex fix for mbox parsing

---
 .../sleuthkit/autopsy/thunderbirdparser/MboxParser.java    | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java
index a3256d3aa2..a0628c593b 100644
--- a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java
+++ b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/MboxParser.java
@@ -133,7 +133,12 @@ class MboxParser extends MimeJ4MessageParser implements Iterator<EmailMessage> {
         // That will usually be one of the first ones.
         for (CharsetEncoder encoder : encoders) {
             try {
-                mboxIterable = MboxIterator.fromFile(mboxFile).charset(encoder.charset()).build();
+                mboxIterable = MboxIterator
+                        .fromFile(mboxFile)
+                        // use more permissive from line from mbox iterator 0.8.0, but handling CRLF/LF
+                        .fromLine("^From .*\r?\n")
+                        .charset(encoder.charset())
+                        .build();
                 if (mboxIterable != null) {
                     emailIterator = new MBoxEmailIterator(mboxIterable.iterator(), encoder, fileID, wholeMsg);
                 }