mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-17 18:17:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

Most recent changes to mbox.

Browse Source
This commit is contained in:
Alex Ebadirad 2012-06-12 16:41:20 -07:00
parent 9be21b7b52
commit f11e3cbc5e
2 changed files with 22 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
MboxEmailModule/src/org/sleuthkit/autopsy/mboxparser/MboxEmailParser.java
View File

@ -65,9 +65,10 @@ public class MboxEmailParser {
this.mimeType = tika.detect(this.stream); this.mimeType = tika.detect(this.stream);
this.parser = new MboxParser(); this.parser = new MboxParser();
this.context = new ParseContext(); this.context = new ParseContext();
this.contentHandler = new BodyContentHandler(10*1024*1024);
this.contentHandler = new BodyContentHandler(-1);
//Seems like setting this causes the metadata not to output all of it. //Seems like setting this causes the metadata not to output all of it.
this.metadata.set(Metadata.CONTENT_TYPE, this.mimeType); // this.metadata.set(Metadata.CONTENT_TYPE, this.mimeType);
} }
public void parse() throws FileNotFoundException, IOException, SAXException, TikaException public void parse() throws FileNotFoundException, IOException, SAXException, TikaException
@ -82,6 +83,7 @@ public class MboxEmailParser {
{ {
init(); init();
parser.parse(inStream,this.contentHandler, this.metadata, context); parser.parse(inStream,this.contentHandler, this.metadata, context);
String blbha = "stop";
} }
public Metadata getMetadata() public Metadata getMetadata()
@ -147,6 +149,21 @@ public class MboxEmailParser {
return ftime; return ftime;
} }
public String getApplication()
{
String client;
String userAgent = "";
userAgent = this.metadata.get("MboxParser-user-agent");
if(userAgent.matches("(?i).*Thunderbird.*"))
{
client = "Thunderbird";
}
else{
client = "Unknown";
}
return client;
}
public String getContenType() public String getContenType()
{ {
return this.metadata.get(Metadata.CONTENT_TYPE); return this.metadata.get(Metadata.CONTENT_TYPE);
@ -159,7 +176,7 @@ public class MboxEmailParser {
public String getFrom() public String getFrom()
{ {
return this.metadata.get(Metadata.MESSAGE_FROM); return this.metadata.get(Metadata.AUTHOR);
} }
public String getTo() public String getTo()

2
MboxEmailModule/src/org/sleuthkit/autopsy/mboxparser/MboxFileIngestService.java
View File

@ -77,6 +77,7 @@ public class MboxFileIngestService implements IngestServiceAbstractFile {
ReadContentInputStream contentStream = new ReadContentInputStream(fsContent); ReadContentInputStream contentStream = new ReadContentInputStream(fsContent);
mbox.parse(contentStream); mbox.parse(contentStream);
String content = mbox.getContent(); String content = mbox.getContent();
String client = mbox.getApplication();
String from = mbox.getFrom(); String from = mbox.getFrom();
String to = mbox.getTo(); String to = mbox.getTo();
Long date = mbox.getDateCreated(); Long date = mbox.getDateCreated();
@ -95,6 +96,7 @@ public class MboxFileIngestService implements IngestServiceAbstractFile {
bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME_RCVD.getTypeID(), classname, "", date)); bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME_RCVD.getTypeID(), classname, "", date));
bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME_SENT.getTypeID(), classname, "", date)); bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME_SENT.getTypeID(), classname, "", date));
bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_SUBJECT.getTypeID(), classname, "", subject)); bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_SUBJECT.getTypeID(), classname, "", subject));
bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PROG_NAME.getTypeID(), classname, "", client));
BlackboardArtifact bbart; BlackboardArtifact bbart;
try { try {
bbart = fsContent.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG); bbart = fsContent.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG);