diff --git a/Core/src/org/sleuthkit/autopsy/modules/embeddedfileextractor/DocumentEmbeddedContentExtractor.java b/Core/src/org/sleuthkit/autopsy/modules/embeddedfileextractor/DocumentEmbeddedContentExtractor.java index 35f27ca8f6..a25dd9e1d7 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/embeddedfileextractor/DocumentEmbeddedContentExtractor.java +++ b/Core/src/org/sleuthkit/autopsy/modules/embeddedfileextractor/DocumentEmbeddedContentExtractor.java @@ -491,7 +491,7 @@ class DocumentEmbeddedContentExtractor { try { Path outputDirectory = Paths.get(getOutputFolderPath(parentFileName)); //Get map of attachment name -> location disk. - Map extractedAttachments = pdfExtractor.extract( + Map extractedAttachments = pdfExtractor.extract( new ReadContentInputStream(abstractFile), abstractFile.getId(), outputDirectory); @@ -499,10 +499,11 @@ class DocumentEmbeddedContentExtractor { List extractedFiles = new ArrayList<>(); extractedAttachments.entrySet().forEach((pathEntry) -> { String fileName = pathEntry.getKey(); - Path writeLocation = pathEntry.getValue(); + Path writeLocation = pathEntry.getValue().getPath(); + int fileSize = pathEntry.getValue().getLength(); extractedFiles.add(new ExtractedFile(fileName, getFileRelativePath(writeLocation.getFileName().toString()), - writeLocation.toFile().length())); + fileSize)); }); return extractedFiles; diff --git a/Core/src/org/sleuthkit/autopsy/modules/embeddedfileextractor/PDFAttachmentExtractor.java b/Core/src/org/sleuthkit/autopsy/modules/embeddedfileextractor/PDFAttachmentExtractor.java index 9cea0f63e7..d898aaa1ca 100755 --- a/Core/src/org/sleuthkit/autopsy/modules/embeddedfileextractor/PDFAttachmentExtractor.java +++ b/Core/src/org/sleuthkit/autopsy/modules/embeddedfileextractor/PDFAttachmentExtractor.java @@ -73,7 +73,7 @@ final class PDFAttachmentExtractor { * @throws SAXException * @throws TikaException */ - public Map extract(InputStream input, long parentID, Path outputDir) throws IOException, SAXException, TikaException { + public Map extract(InputStream input, long parentID, Path outputDir) throws IOException, SAXException, TikaException { ExtractionPreconditions.checkArgument(Files.exists(outputDir), String.format("Output directory: %s, does not exist.", outputDir.toString())); //NON-NLS @@ -139,8 +139,8 @@ final class PDFAttachmentExtractor { try (EncodedFileOutputStream outputStream = new EncodedFileOutputStream( new FileOutputStream(outputFile.toFile()), TskData.EncodingType.XOR1)){ - IOUtils.copy(in, outputStream); - watcher.notify(name, outputFile); + int bytesCopied = IOUtils.copy(in, outputStream); + watcher.notify(name, outputFile, bytesCopied); } catch (IOException ex) { logger.log(Level.WARNING, String.format("Could not extract attachment %s into directory %s", //NON-NLS uniqueExtractedName, outputFile), ex); @@ -148,6 +148,29 @@ final class PDFAttachmentExtractor { } } + /** + * Utility class to hold an extracted file's path and length. + * Note that we can not use the length of the file on disk because + * the XOR header has been added to it. + */ + static class NewResourceData { + private final Path path; + private final int length; + + NewResourceData(Path path, int length) { + this.path = path; + this.length = length; + } + + Path getPath() { + return path; + } + + int getLength() { + return length; + } + } + /** * Convenient wrapper for keeping track of new resource paths and the display * name for each of these resources. @@ -157,17 +180,17 @@ final class PDFAttachmentExtractor { */ static class NewResourceWatcher { - private final Map newResourcePaths; + private final Map newResourcePaths; public NewResourceWatcher() { newResourcePaths = new HashMap<>(); } - public void notify(String name, Path newResource) { - newResourcePaths.put(name, newResource); + public void notify(String name, Path localPath, int length) { + newResourcePaths.put(name, new NewResourceData(localPath, length)); } - public Map getSnapshot() { + public Map getSnapshot() { return newResourcePaths; } } diff --git a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/MimeJ4MessageParser.java b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/MimeJ4MessageParser.java index 6a95e8729a..828968d750 100755 --- a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/MimeJ4MessageParser.java +++ b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/MimeJ4MessageParser.java @@ -318,8 +318,10 @@ class MimeJ4MessageParser { Body body = e.getBody(); if (body instanceof SingleBody) { + long fileLength; try (EncodedFileOutputStream fos = new EncodedFileOutputStream(new FileOutputStream(outPath), TskData.EncodingType.XOR1)) { ((SingleBody) body).writeTo(fos); + fileLength = fos.getBytesWritten(); } catch (IOException ex) { logger.log(Level.WARNING, "Failed to create file output stream for: " + outPath, ex); //NON-NLS return; @@ -328,7 +330,7 @@ class MimeJ4MessageParser { EmailMessage.Attachment attach = new EmailMessage.Attachment(); attach.setName(filename); attach.setLocalPath(relModuleOutputPath + uniqueFilename); - attach.setSize(new File(outPath).length()); + attach.setSize(fileLength); attach.setEncodingType(TskData.EncodingType.XOR1); email.addAttachment(attach); }