mirror of
https://github.com/overcuriousity/autopsy-flatpak.git
synced 2025-07-10 07:09:32 +00:00
Update ThunderbirdMboxFileIngestModule.java
Check threaded messageId if null and skip it if it is. Format code also.
This commit is contained in:
parent
57ba69c4d2
commit
f73eb23ad9
@ -65,6 +65,7 @@ import org.sleuthkit.datamodel.TskException;
|
|||||||
* structure and metadata.
|
* structure and metadata.
|
||||||
*/
|
*/
|
||||||
public final class ThunderbirdMboxFileIngestModule implements FileIngestModule {
|
public final class ThunderbirdMboxFileIngestModule implements FileIngestModule {
|
||||||
|
|
||||||
private static final Logger logger = Logger.getLogger(ThunderbirdMboxFileIngestModule.class.getName());
|
private static final Logger logger = Logger.getLogger(ThunderbirdMboxFileIngestModule.class.getName());
|
||||||
private final IngestServices services = IngestServices.getInstance();
|
private final IngestServices services = IngestServices.getInstance();
|
||||||
private FileManager fileManager;
|
private FileManager fileManager;
|
||||||
@ -80,7 +81,7 @@ public final class ThunderbirdMboxFileIngestModule implements FileIngestModule {
|
|||||||
}
|
}
|
||||||
|
|
||||||
@Override
|
@Override
|
||||||
@Messages ({"ThunderbirdMboxFileIngestModule.noOpenCase.errMsg=Exception while getting open case."})
|
@Messages({"ThunderbirdMboxFileIngestModule.noOpenCase.errMsg=Exception while getting open case."})
|
||||||
public void startUp(IngestJobContext context) throws IngestModuleException {
|
public void startUp(IngestJobContext context) throws IngestModuleException {
|
||||||
this.context = context;
|
this.context = context;
|
||||||
try {
|
try {
|
||||||
@ -103,8 +104,8 @@ public final class ThunderbirdMboxFileIngestModule implements FileIngestModule {
|
|||||||
}
|
}
|
||||||
|
|
||||||
//skip unalloc
|
//skip unalloc
|
||||||
if ((abstractFile.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS)) ||
|
if ((abstractFile.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS))
|
||||||
(abstractFile.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.SLACK))) {
|
|| (abstractFile.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.SLACK))) {
|
||||||
return ProcessResult.OK;
|
return ProcessResult.OK;
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -188,11 +189,11 @@ public final class ThunderbirdMboxFileIngestModule implements FileIngestModule {
|
|||||||
PstParser parser = new PstParser(services);
|
PstParser parser = new PstParser(services);
|
||||||
PstParser.ParseResult result = parser.open(file, abstractFile.getId());
|
PstParser.ParseResult result = parser.open(file, abstractFile.getId());
|
||||||
|
|
||||||
switch( result) {
|
switch (result) {
|
||||||
case OK:
|
case OK:
|
||||||
Iterator<EmailMessage> pstMsgIterator = parser.getEmailMessageIterator();
|
Iterator<EmailMessage> pstMsgIterator = parser.getEmailMessageIterator();
|
||||||
if (pstMsgIterator != null) {
|
if (pstMsgIterator != null) {
|
||||||
processEmails(parser.getPartialEmailMessages(), pstMsgIterator , abstractFile);
|
processEmails(parser.getPartialEmailMessages(), pstMsgIterator, abstractFile);
|
||||||
} else {
|
} else {
|
||||||
// sometimes parser returns ParseResult=OK but there are no messages
|
// sometimes parser returns ParseResult=OK but there are no messages
|
||||||
postErrorMessage(
|
postErrorMessage(
|
||||||
@ -298,12 +299,12 @@ public final class ThunderbirdMboxFileIngestModule implements FileIngestModule {
|
|||||||
return ProcessResult.OK;
|
return ProcessResult.OK;
|
||||||
}
|
}
|
||||||
|
|
||||||
MboxParser emailIterator = MboxParser.getEmailIterator( emailFolder, file, abstractFile.getId());
|
MboxParser emailIterator = MboxParser.getEmailIterator(emailFolder, file, abstractFile.getId());
|
||||||
List<EmailMessage> emails = new ArrayList<>();
|
List<EmailMessage> emails = new ArrayList<>();
|
||||||
if(emailIterator != null) {
|
if (emailIterator != null) {
|
||||||
while(emailIterator.hasNext()) {
|
while (emailIterator.hasNext()) {
|
||||||
EmailMessage emailMessage = emailIterator.next();
|
EmailMessage emailMessage = emailIterator.next();
|
||||||
if(emailMessage != null) {
|
if (emailMessage != null) {
|
||||||
emails.add(emailMessage);
|
emails.add(emailMessage);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@ -315,7 +316,7 @@ public final class ThunderbirdMboxFileIngestModule implements FileIngestModule {
|
|||||||
abstractFile.getName()), errors);
|
abstractFile.getName()), errors);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
processEmails(emails, MboxParser.getEmailIterator( emailFolder, file, abstractFile.getId()), abstractFile);
|
processEmails(emails, MboxParser.getEmailIterator(emailFolder, file, abstractFile.getId()), abstractFile);
|
||||||
|
|
||||||
if (file.delete() == false) {
|
if (file.delete() == false) {
|
||||||
logger.log(Level.INFO, "Failed to delete temp file: {0}", file.getName()); //NON-NLS
|
logger.log(Level.INFO, "Failed to delete temp file: {0}", file.getName()); //NON-NLS
|
||||||
@ -438,35 +439,37 @@ public final class ThunderbirdMboxFileIngestModule implements FileIngestModule {
|
|||||||
|
|
||||||
// Putting try/catch around this to catch any exception and still allow
|
// Putting try/catch around this to catch any exception and still allow
|
||||||
// the creation of the artifacts to continue.
|
// the creation of the artifacts to continue.
|
||||||
try{
|
try {
|
||||||
EmailMessageThreader.threadMessages(partialEmailsForThreading);
|
EmailMessageThreader.threadMessages(partialEmailsForThreading);
|
||||||
} catch(Exception ex) {
|
} catch (Exception ex) {
|
||||||
logger.log(Level.WARNING, String.format("Exception thrown parsing emails from %s", abstractFile.getName()), ex);
|
logger.log(Level.WARNING, String.format("Exception thrown parsing emails from %s", abstractFile.getName()), ex);
|
||||||
}
|
}
|
||||||
|
|
||||||
List<AbstractFile> derivedFiles = new ArrayList<>();
|
List<AbstractFile> derivedFiles = new ArrayList<>();
|
||||||
|
|
||||||
int msgCnt = 0;
|
int msgCnt = 0;
|
||||||
while(fullMessageIterator.hasNext()) {
|
while (fullMessageIterator.hasNext()) {
|
||||||
EmailMessage current = fullMessageIterator.next();
|
EmailMessage current = fullMessageIterator.next();
|
||||||
|
|
||||||
if(current == null) {
|
if (current == null) {
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
|
|
||||||
if(partialEmailsForThreading.size() > msgCnt) {
|
if (partialEmailsForThreading.size() > msgCnt) {
|
||||||
EmailMessage threaded = partialEmailsForThreading.get(msgCnt++);
|
EmailMessage threaded = partialEmailsForThreading.get(msgCnt++);
|
||||||
|
|
||||||
if(threaded.getMessageID().equals(current.getMessageID()) &&
|
if (threaded.getMessageID() != null) {
|
||||||
threaded.getSubject().equals(current.getSubject())) {
|
if (threaded.getMessageID().equals(current.getMessageID())
|
||||||
|
&& threaded.getSubject().equals(current.getSubject())) {
|
||||||
current.setMessageThreadID(threaded.getMessageThreadID());
|
current.setMessageThreadID(threaded.getMessageThreadID());
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
}
|
||||||
|
|
||||||
BlackboardArtifact msgArtifact = addEmailArtifact(current, abstractFile);
|
BlackboardArtifact msgArtifact = addEmailArtifact(current, abstractFile);
|
||||||
|
|
||||||
if ((msgArtifact != null) && (current.hasAttachment())) {
|
if ((msgArtifact != null) && (current.hasAttachment())) {
|
||||||
derivedFiles.addAll(handleAttachments(current.getAttachments(), abstractFile, msgArtifact ));
|
derivedFiles.addAll(handleAttachments(current.getAttachments(), abstractFile, msgArtifact));
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -477,6 +480,7 @@ public final class ThunderbirdMboxFileIngestModule implements FileIngestModule {
|
|||||||
}
|
}
|
||||||
context.addFilesToJob(derivedFiles);
|
context.addFilesToJob(derivedFiles);
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Add the given attachments as derived files and reschedule them for
|
* Add the given attachments as derived files and reschedule them for
|
||||||
* ingest.
|
* ingest.
|
||||||
@ -517,7 +521,8 @@ public final class ThunderbirdMboxFileIngestModule implements FileIngestModule {
|
|||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Finds and returns a set of unique email addresses found in the input string
|
* Finds and returns a set of unique email addresses found in the input
|
||||||
|
* string
|
||||||
*
|
*
|
||||||
* @param input - input string, like the To/CC line from an email header
|
* @param input - input string, like the To/CC line from an email header
|
||||||
*
|
*
|
||||||
@ -529,7 +534,7 @@ public final class ThunderbirdMboxFileIngestModule implements FileIngestModule {
|
|||||||
Matcher m = p.matcher(input);
|
Matcher m = p.matcher(input);
|
||||||
Set<String> emailAddresses = new HashSet<>();
|
Set<String> emailAddresses = new HashSet<>();
|
||||||
while (m.find()) {
|
while (m.find()) {
|
||||||
emailAddresses.add( m.group());
|
emailAddresses.add(m.group());
|
||||||
}
|
}
|
||||||
return emailAddresses;
|
return emailAddresses;
|
||||||
}
|
}
|
||||||
@ -570,12 +575,10 @@ public final class ThunderbirdMboxFileIngestModule implements FileIngestModule {
|
|||||||
senderAddress = senderAddressList.get(0);
|
senderAddress = senderAddressList.get(0);
|
||||||
try {
|
try {
|
||||||
senderAccountInstance = currentCase.getSleuthkitCase().getCommunicationsManager().createAccountFileInstance(Account.Type.EMAIL, senderAddress, EmailParserModuleFactory.getModuleName(), abstractFile);
|
senderAccountInstance = currentCase.getSleuthkitCase().getCommunicationsManager().createAccountFileInstance(Account.Type.EMAIL, senderAddress, EmailParserModuleFactory.getModuleName(), abstractFile);
|
||||||
}
|
} catch (TskCoreException ex) {
|
||||||
catch(TskCoreException ex) {
|
|
||||||
logger.log(Level.WARNING, "Failed to create account for email address " + senderAddress, ex); //NON-NLS
|
logger.log(Level.WARNING, "Failed to create account for email address " + senderAddress, ex); //NON-NLS
|
||||||
}
|
}
|
||||||
}
|
} else {
|
||||||
else {
|
|
||||||
logger.log(Level.WARNING, "Failed to find sender address, from = {0}", from); //NON-NLS
|
logger.log(Level.WARNING, "Failed to find sender address, from = {0}", from); //NON-NLS
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -587,12 +590,11 @@ public final class ThunderbirdMboxFileIngestModule implements FileIngestModule {
|
|||||||
List<AccountFileInstance> recipientAccountInstances = new ArrayList<>();
|
List<AccountFileInstance> recipientAccountInstances = new ArrayList<>();
|
||||||
recipientAddresses.forEach((addr) -> {
|
recipientAddresses.forEach((addr) -> {
|
||||||
try {
|
try {
|
||||||
AccountFileInstance recipientAccountInstance =
|
AccountFileInstance recipientAccountInstance
|
||||||
currentCase.getSleuthkitCase().getCommunicationsManager().createAccountFileInstance(Account.Type.EMAIL, addr,
|
= currentCase.getSleuthkitCase().getCommunicationsManager().createAccountFileInstance(Account.Type.EMAIL, addr,
|
||||||
EmailParserModuleFactory.getModuleName(), abstractFile);
|
EmailParserModuleFactory.getModuleName(), abstractFile);
|
||||||
recipientAccountInstances.add(recipientAccountInstance);
|
recipientAccountInstances.add(recipientAccountInstance);
|
||||||
}
|
} catch (TskCoreException ex) {
|
||||||
catch(TskCoreException ex) {
|
|
||||||
logger.log(Level.WARNING, "Failed to create account for email address " + addr, ex); //NON-NLS
|
logger.log(Level.WARNING, "Failed to create account for email address " + addr, ex); //NON-NLS
|
||||||
}
|
}
|
||||||
});
|
});
|
||||||
@ -618,14 +620,13 @@ public final class ThunderbirdMboxFileIngestModule implements FileIngestModule {
|
|||||||
addArtifactAttribute(rtf, ATTRIBUTE_TYPE.TSK_EMAIL_CONTENT_RTF, bbattributes);
|
addArtifactAttribute(rtf, ATTRIBUTE_TYPE.TSK_EMAIL_CONTENT_RTF, bbattributes);
|
||||||
addArtifactAttribute(threadID, ATTRIBUTE_TYPE.TSK_THREAD_ID, bbattributes);
|
addArtifactAttribute(threadID, ATTRIBUTE_TYPE.TSK_THREAD_ID, bbattributes);
|
||||||
|
|
||||||
|
|
||||||
try {
|
try {
|
||||||
|
|
||||||
bbart = abstractFile.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG);
|
bbart = abstractFile.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG);
|
||||||
bbart.addAttributes(bbattributes);
|
bbart.addAttributes(bbattributes);
|
||||||
|
|
||||||
// Add account relationships
|
// Add account relationships
|
||||||
currentCase.getSleuthkitCase().getCommunicationsManager().addRelationships(senderAccountInstance, recipientAccountInstances, bbart,Relationship.Type.MESSAGE, dateL);
|
currentCase.getSleuthkitCase().getCommunicationsManager().addRelationships(senderAccountInstance, recipientAccountInstances, bbart, Relationship.Type.MESSAGE, dateL);
|
||||||
|
|
||||||
try {
|
try {
|
||||||
// index the artifact for keyword search
|
// index the artifact for keyword search
|
||||||
|
Loading…
x
Reference in New Issue
Block a user