From 325d558303ff3934e1eedfa9b9892f052202b62a Mon Sep 17 00:00:00 2001 From: Alex Ebadirad Date: Thu, 21 Jun 2012 16:36:44 -0700 Subject: [PATCH 1/3] Addition of paths to the emails extracted --- .../nbproject/project.properties | 1 + thunderbirdparser/nbproject/project.xml | 4 + .../ThunderbirdMboxFileIngestService.java | 86 ++++++++++++++++++- .../autopsy/thunderbirdparser/layer.xml | 4 +- 4 files changed, 92 insertions(+), 3 deletions(-) diff --git a/thunderbirdparser/nbproject/project.properties b/thunderbirdparser/nbproject/project.properties index f9cb8e3889..ba51ec0265 100644 --- a/thunderbirdparser/nbproject/project.properties +++ b/thunderbirdparser/nbproject/project.properties @@ -1,3 +1,4 @@ +file.reference.commons-lang-2.4.jar=release/modules/ext/commons-lang-2.4.jar file.reference.tika-core-1.1.jar=release/modules/ext/tika-core-1.1.jar file.reference.tika-parsers-1.1.jar=release/modules/ext/tika-parsers-1.1.jar javac.source=1.6 diff --git a/thunderbirdparser/nbproject/project.xml b/thunderbirdparser/nbproject/project.xml index ea2c04cf47..feb9700d52 100644 --- a/thunderbirdparser/nbproject/project.xml +++ b/thunderbirdparser/nbproject/project.xml @@ -56,6 +56,10 @@ ext/tika-core-1.1.jar release/modules/ext/tika-core-1.1.jar + + ext/jmork-1.0.4.jar + release/modules/ext/jmork-1.0.4.jar + ext/commons-lang-2.4.jar release/modules/ext/commons-lang-2.4.jar diff --git a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/ThunderbirdMboxFileIngestService.java b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/ThunderbirdMboxFileIngestService.java index 1fb1e510c2..e5232b7f94 100644 --- a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/ThunderbirdMboxFileIngestService.java +++ b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/ThunderbirdMboxFileIngestService.java @@ -18,15 +18,25 @@ */ package org.sleuthkit.autopsy.thunderbirdparser; +import java.io.File; import java.io.FileNotFoundException; +import java.io.FileReader; import java.io.IOException; +import java.io.Reader; +import java.sql.ResultSet; +import java.sql.SQLException; +import java.sql.Statement; import java.util.ArrayList; import java.util.Collection; import java.util.HashMap; +import java.util.List; import java.util.Map; import java.util.Map.Entry; import java.util.logging.Level; import java.util.logging.Logger; +import mork.Dict; +import mork.MorkDocument; +import mork.Row; import org.apache.tika.exception.TikaException; import org.apache.tika.metadata.Metadata; import org.sleuthkit.autopsy.ingest.IngestManager; @@ -45,6 +55,11 @@ import org.sleuthkit.datamodel.TskCoreException; import org.sleuthkit.datamodel.TskException; import org.xml.sax.SAXException; import org.apache.commons.lang.StringEscapeUtils; +import org.sleuthkit.autopsy.casemodule.Case; +import org.sleuthkit.autopsy.datamodel.ContentUtils; +import org.sleuthkit.datamodel.Content; +import org.sleuthkit.datamodel.FsContent; +import org.sleuthkit.datamodel.SleuthkitCase; public class ThunderbirdMboxFileIngestService implements IngestServiceAbstractFile { @@ -77,6 +92,75 @@ public class ThunderbirdMboxFileIngestService implements IngestServiceAbstractFi if (isMbox) { managerProxy.postMessage(IngestMessage.createMessage(++messageId, MessageType.INFO, this, "Processing " + fsContent.getName())); + String mboxName = fsContent.getName(); + String msfName = mboxName + ".msf"; + Long mboxId = fsContent.getId(); + String mboxPath = ""; + Long msfId = 0L; + Case currentCase = Case.getCurrentCase(); // get the most updated case + SleuthkitCase tskCase = currentCase.getSleuthkitCase(); + try { + ResultSet rs = tskCase.runQuery("select parent_path from tsk_files where obj_id = '" + mboxId.toString() + "'"); + mboxPath = rs.getString("parent_path"); + Statement s = rs.getStatement(); + rs.close(); + if (s != null) { + s.close(); + } + rs.close(); + rs.getStatement().close(); + + ResultSet resultset = tskCase.runQuery("select obj_id from tsk_files where parent_path = '" + mboxPath + "' and name = '" + msfName + "'"); + msfId = resultset.getLong("obj_id"); + Statement st = resultset.getStatement(); + resultset.close(); + if (st != null) { + st.close(); + } + resultset.close(); + resultset.getStatement().close(); + + } catch (SQLException ex) { + logger.log(Level.WARNING, "Error while trying to get parent path for:" + this.getClass().getName(), ex); + } + + try { + Content msfContent = tskCase.getContentById(msfId); + ContentUtils.writeToFile(msfContent, new File(currentCase.getTempDirectory() + File.separator + msfName)); + } catch (IOException ex) { + Logger.getLogger(ThunderbirdMboxFileIngestService.class.getName()).log(Level.SEVERE, null, ex); + } catch (TskCoreException ex) { + logger.log(Level.SEVERE, "Unable to obtain msf file for mbox parsing:" + this.getClass().getName(), ex); + } + int index = 0; + String replace = ""; + boolean b = mboxPath.indexOf("/Mail/") > 0; + if(b == true) + { + index = mboxPath.indexOf("/Mail/"); + replace = "/Mail"; + } + else + { + index = mboxPath.indexOf("/ImapMail/"); + replace = "/ImapMail"; + } + String folderPath = mboxPath.substring(index); + folderPath = folderPath.replaceAll(replace, ""); + folderPath = folderPath+mboxName; + folderPath = folderPath.replaceAll(".sbd", ""); +// Reader reader = null; +// try { +// reader = new FileReader(currentCase.getTempDirectory() + File.separator + msfName); +// } catch (FileNotFoundException ex) { +// Logger.getLogger(ThunderbirdMboxFileIngestService.class.getName()).log(Level.SEVERE, null, ex); +// } +// MorkDocument morkDocument = new MorkDocument(reader); +// List dicts = morkDocument.getDicts(); +// for(Dict dict : dicts){ +// String path = dict.getValue("81").toString(); +// String account = dict.getValue("8D").toString(); +// } String emailId = ""; String content = ""; String from = ""; @@ -118,7 +202,7 @@ public class ThunderbirdMboxFileIngestService implements IngestServiceAbstractFi bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME_RCVD.getTypeID(), classname, "", date)); bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME_SENT.getTypeID(), classname, "", date)); bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_SUBJECT.getTypeID(), classname, "", subject)); - bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PATH.getTypeID(), classname, "", "/Account1/Folder1")); + bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PATH.getTypeID(), classname, "", folderPath)); BlackboardArtifact bbart; try { bbart = fsContent.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG); diff --git a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/layer.xml b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/layer.xml index 627a7335ab..95e5c988cb 100644 --- a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/layer.xml +++ b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/layer.xml @@ -5,7 +5,7 @@ - + - + From f3c7d549aa746c4359e3cc91a9de2637b4f425b5 Mon Sep 17 00:00:00 2001 From: Alex Ebadirad Date: Thu, 21 Jun 2012 16:37:38 -0700 Subject: [PATCH 2/3] Removed mork dependencies for now --- Report/src/org/sleuthkit/autopsy/report/ReportFilter.java | 2 +- .../ThunderbirdMboxFileIngestService.java | 7 ------- 2 files changed, 1 insertion(+), 8 deletions(-) diff --git a/Report/src/org/sleuthkit/autopsy/report/ReportFilter.java b/Report/src/org/sleuthkit/autopsy/report/ReportFilter.java index cdc6f2d0a2..30db663d3c 100644 --- a/Report/src/org/sleuthkit/autopsy/report/ReportFilter.java +++ b/Report/src/org/sleuthkit/autopsy/report/ReportFilter.java @@ -171,7 +171,7 @@ private void jButton1ActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRS getReports(newConfig, classList, preview); }//GEN-LAST:event_jButton1ActionPerformed - public void getReports(final ReportConfiguration reportConfig, final ArrayList classList, final String preview) { + public void getReports(final ReportConfiguration reportConfig, final ArrayList classList, final String preview) { new SwingWorker() { @Override diff --git a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/ThunderbirdMboxFileIngestService.java b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/ThunderbirdMboxFileIngestService.java index e5232b7f94..8cde54d9f4 100644 --- a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/ThunderbirdMboxFileIngestService.java +++ b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/ThunderbirdMboxFileIngestService.java @@ -20,23 +20,17 @@ package org.sleuthkit.autopsy.thunderbirdparser; import java.io.File; import java.io.FileNotFoundException; -import java.io.FileReader; import java.io.IOException; -import java.io.Reader; import java.sql.ResultSet; import java.sql.SQLException; import java.sql.Statement; import java.util.ArrayList; import java.util.Collection; import java.util.HashMap; -import java.util.List; import java.util.Map; import java.util.Map.Entry; import java.util.logging.Level; import java.util.logging.Logger; -import mork.Dict; -import mork.MorkDocument; -import mork.Row; import org.apache.tika.exception.TikaException; import org.apache.tika.metadata.Metadata; import org.sleuthkit.autopsy.ingest.IngestManager; @@ -58,7 +52,6 @@ import org.apache.commons.lang.StringEscapeUtils; import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.datamodel.ContentUtils; import org.sleuthkit.datamodel.Content; -import org.sleuthkit.datamodel.FsContent; import org.sleuthkit.datamodel.SleuthkitCase; public class ThunderbirdMboxFileIngestService implements IngestServiceAbstractFile { From d472d15a6bac6c582bbe42ef47ee97c83aa6dbfa Mon Sep 17 00:00:00 2001 From: Alex Ebadirad Date: Thu, 21 Jun 2012 16:43:19 -0700 Subject: [PATCH 3/3] Fixed situation where mbox files exist outside thunderbird directory --- .../ThunderbirdMboxFileIngestService.java | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/ThunderbirdMboxFileIngestService.java b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/ThunderbirdMboxFileIngestService.java index 8cde54d9f4..d7e4ed2cc7 100644 --- a/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/ThunderbirdMboxFileIngestService.java +++ b/thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/ThunderbirdMboxFileIngestService.java @@ -127,17 +127,22 @@ public class ThunderbirdMboxFileIngestService implements IngestServiceAbstractFi } int index = 0; String replace = ""; + boolean a = mboxPath.indexOf("/ImapMail/") > 0; boolean b = mboxPath.indexOf("/Mail/") > 0; if(b == true) { index = mboxPath.indexOf("/Mail/"); replace = "/Mail"; } - else + else if(a == true) { index = mboxPath.indexOf("/ImapMail/"); replace = "/ImapMail"; } + else{ + replace = ""; + + } String folderPath = mboxPath.substring(index); folderPath = folderPath.replaceAll(replace, ""); folderPath = folderPath+mboxName;