From 8fef328308b5747578c54f1fbca126cd88da9bf3 Mon Sep 17 00:00:00 2001 From: Kelly Kelly Date: Wed, 3 Jul 2019 11:14:02 -0400 Subject: [PATCH] Update the email threader, android wwf and SMS code to assign unique cross ingest run threadIDs --- InternalPythonModules/android/textmessage.py | 4 +++- InternalPythonModules/android/wwfmessage.py | 5 ++++- .../thunderbirdparser/EmailMessageThreader.java | 11 +++++------ .../ThunderbirdMboxFileIngestModule.java | 2 +- 4 files changed, 13 insertions(+), 9 deletions(-) diff --git a/InternalPythonModules/android/textmessage.py b/InternalPythonModules/android/textmessage.py index ef8fa498c8..803cfa5b96 100644 --- a/InternalPythonModules/android/textmessage.py +++ b/InternalPythonModules/android/textmessage.py @@ -29,6 +29,7 @@ from java.sql import SQLException from java.sql import Statement from java.util.logging import Level from java.util import ArrayList +from java.util import UUID from org.sleuthkit.autopsy.casemodule import Case from org.sleuthkit.autopsy.casemodule.services import Blackboard from org.sleuthkit.autopsy.casemodule.services import FileManager @@ -95,6 +96,7 @@ class TextMessageAnalyzer(general.AndroidComponentAnalyzer): ds = Case.getCurrentCase().getSleuthkitCase().getDataSource(datasourceObjId) deviceID = ds.getDeviceId() deviceAccountInstance = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().createAccountFileInstance(Account.Type.DEVICE, deviceID, general.MODULE_NAME, abstractFile) + uuid = UUID.randomUUID().toString() resultSet = None try: @@ -106,7 +108,7 @@ class TextMessageAnalyzer(general.AndroidComponentAnalyzer): read = resultSet.getInt("read") # may be unread = 0, read = 1 subject = resultSet.getString("subject") # message subject body = resultSet.getString("body") # message body - thread_id = "{0}_{1}".format(abstractFile.getId(), resultSet.getInt("thread_id")) + thread_id = "{0}-{1}".format(uuid, resultSet.getInt("thread_id")) attributes = ArrayList() artifact = abstractFile.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE); #create Message artifact and then add attributes from result set. if resultSet.getString("type") == "1": diff --git a/InternalPythonModules/android/wwfmessage.py b/InternalPythonModules/android/wwfmessage.py index faf62bb4e2..bf00ea54c0 100644 --- a/InternalPythonModules/android/wwfmessage.py +++ b/InternalPythonModules/android/wwfmessage.py @@ -27,6 +27,7 @@ from java.sql import SQLException from java.sql import Statement from java.util.logging import Level from java.util import ArrayList +from java.util import UUID from org.sleuthkit.autopsy.casemodule import Case from org.sleuthkit.autopsy.casemodule.services import Blackboard from org.sleuthkit.autopsy.casemodule.services import FileManager @@ -99,6 +100,7 @@ class WWFMessageAnalyzer(general.AndroidComponentAnalyzer): ds = Case.getCurrentCase().getSleuthkitCase().getDataSource(datasourceObjId) deviceID = ds.getDeviceId() deviceAccountInstance = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().createAccountFileInstance(Account.Type.DEVICE, deviceID, general.MODULE_NAME, abstractFile) + uuid = UUID.randomUUID().toString() resultSet = None try: @@ -110,6 +112,7 @@ class WWFMessageAnalyzer(general.AndroidComponentAnalyzer): created_at = resultSet.getLong("datetime") user_id = resultSet.getString("user_id") # the ID of the user who sent the message. game_id = resultSet.getString("game_id") # ID of the game which the the message was sent. + thread_id = "{0}-{1}".format(uuid, user_id) attributes = ArrayList() artifact = abstractFile.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE) # create a call log and then add attributes from result set. @@ -118,7 +121,7 @@ class WWFMessageAnalyzer(general.AndroidComponentAnalyzer): attributes.add(BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MSG_ID, general.MODULE_NAME, game_id)) attributes.add(BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT, general.MODULE_NAME, message)) attributes.add(BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE, general.MODULE_NAME, "Words With Friends Message")) - attributes.add(BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_THREAD_ID, general.MODULE_NAME, user_id)) + attributes.add(BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_THREAD_ID, general.MODULE_NAME, thread_id)) artifact.addAttributes(attributes) diff --git a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/EmailMessageThreader.java b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/EmailMessageThreader.java index 6e003a54a6..431c7cc74c 100755 --- a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/EmailMessageThreader.java +++ b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/EmailMessageThreader.java @@ -25,6 +25,7 @@ import java.util.Iterator; import java.util.List; import java.util.Map; import java.util.Set; +import java.util.UUID; /** * Given a list of email messages arranges the message into threads using the @@ -41,7 +42,7 @@ final class EmailMessageThreader { private EmailMessageThreader(){} - public static void threadMessages(List emailMessages, String threadIDPrefix) { + public static void threadMessages(List emailMessages) { EmailMessageThreader instance = new EmailMessageThreader(); Map id_table = instance.createIDTable(emailMessages); @@ -51,7 +52,7 @@ final class EmailMessageThreader { Set finalRootSet = instance.groupBySubject(rootSet); - instance.assignThreadIDs(finalRootSet, threadIDPrefix); + instance.assignThreadIDs(finalRootSet); } /** @@ -413,12 +414,10 @@ final class EmailMessageThreader { * * @param IDPrefix A string to make the threadIDs unique. */ - private void assignThreadIDs(Set containerSet, String IDPrefix) { - int threadCounter = 0; - + private void assignThreadIDs(Set containerSet) { for(EmailContainer container: containerSet) { // Generate a threadID - String threadID = String.format("%s-%d", IDPrefix, threadCounter++); + String threadID = UUID.randomUUID().toString(); // Add the IDs to this thread addThreadID(container, threadID); } diff --git a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/ThunderbirdMboxFileIngestModule.java b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/ThunderbirdMboxFileIngestModule.java index 33da281def..40580dc346 100644 --- a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/ThunderbirdMboxFileIngestModule.java +++ b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/ThunderbirdMboxFileIngestModule.java @@ -413,7 +413,7 @@ public final class ThunderbirdMboxFileIngestModule implements FileIngestModule { // Putting try/catch around this to catch any exception and still allow // the creation of the artifacts to continue. try{ - EmailMessageThreader.threadMessages(emails, String.format("%d", abstractFile.getId())); + EmailMessageThreader.threadMessages(emails); } catch(Exception ex) { logger.log(Level.WARNING, String.format("Exception thrown parsing emails from %s", abstractFile.getName()), ex); }