casualscripter/evolution-mail-forensics
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

bugfixing

Browse Source
This commit is contained in:
Patrick Neumann 2019-04-08 18:27:16 +02:00
parent f0ffadfa27
commit 0b05db1beb
1 changed files with 47 additions and 41 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

88
extract-and-index-evolution-mail-storage
View File

@ -37,9 +37,8 @@ usage () {
#------------------------------------------------------------------------------- #-------------------------------------------------------------------------------
if [ "${#}" -ne 1 ]; then if [ "${#}" -ne 1 ]; then
echo "Please provide exactly one parameter!" echo "Please provide exactly one parameter!"
echo
usage usage
exit 2 exit 2
fi fi
#=== CONFIGURATION (params) ==================================================== #=== CONFIGURATION (params) ====================================================
@ -48,8 +47,7 @@ fi
#------------------------------------------------------------------------------- #-------------------------------------------------------------------------------
if ! file "${1}" | grep -F "EWF" > /dev/null ; then if ! file "${1}" | grep -F "EWF" > /dev/null ; then
echo "Please provide EWF image!" echo "Please provide EWF image!"
echo usage
usage
exit 3 exit 3
fi fi
readonly IMG="${1}" readonly IMG="${1}"
@ -58,6 +56,9 @@ readonly IMG="${1}"
#------------------------------------------------------------------------------- #-------------------------------------------------------------------------------
# Find and set home directory: # Find and set home directory:
#------------------------------------------------------------------------------- #-------------------------------------------------------------------------------
echo "Searching for /home... please wait..."
PRE="./recovered"
offsets="$( mmls -aM "${IMG}" \ offsets="$( mmls -aM "${IMG}" \
| awk '/^[[:digit:]]{3}:/ { print $3; }' \ | awk '/^[[:digit:]]{3}:/ { print $3; }' \
| sed 's/0*//' )" | sed 's/0*//' )"
@ -67,26 +68,26 @@ for offset in ${offsets} ; do
then then
home="" home=""
readonly S_PRE="" readonly S_PRE=""
readonly T_PRE="./recovered/home" readonly T_PRE="${PRE}/home"
readonly OFS="${offset}" readonly OFS="${offset}"
elif fsstat -o "${offset}" "${IMG}" \ elif fsstat -o "${offset}" "${IMG}" \
| grep -E "^Last mounted on: /$" > /dev/null | grep -E "^Last mounted on: /$" > /dev/null
then then
home="$( ifind -o "${offset}" -n "/home" "${IMG}" )" home="$( ifind -o "${offset}" -n "/home" "${IMG}" )"
if [ "${home}" != "File not found" ] ; then if [ "${home}" != "File not found" ] ; then
readonly S_PRE="/home" readonly S_PRE="/home"
readonly T_PRE="./recovered" readonly T_PRE="${PRE}"
readonly OFS="${offset}" readonly OFS="${offset}"
fi fi
else else
echo "/home not found!" echo "/home not found!"
echo echo
echo "Hint:" echo "Hint:"
echo " 1.: assemble RAID and/or LVM" echo " 1.: assemble RAID and/or LVM"
echo " 2.: ewfacquire the file system of /home" echo " 2.: ewfacquire the file system of /home"
echo " 3.: use that image with ${0}" echo " 3.: use that image with ${0}"
exit 4 exit 4
fi fi
done done
#=== CONFIGURATION (user) ====================================================== #=== CONFIGURATION (user) ======================================================
@ -110,6 +111,8 @@ readonly DIRS="${DIRS} ${S_PRE}/${user}/${CACHE}/"
#------------------------------------------------------------------------------- #-------------------------------------------------------------------------------
# ... magic ... # ... magic ...
#------------------------------------------------------------------------------- #-------------------------------------------------------------------------------
echo "Extracting folders and files... please wait..."
for DIR in ${DIRS} ; do for DIR in ${DIRS} ; do
#----------------------------------------------------------------------------- #-----------------------------------------------------------------------------
# Store inode of DIR as start: # Store inode of DIR as start:
@ -117,8 +120,8 @@ for DIR in ${DIRS} ; do
start="$( ifind -o "${OFS}" -n "${DIR}" "${IMG}" )" start="$( ifind -o "${OFS}" -n "${DIR}" "${IMG}" )"
if [ "${start}" = "File not found" ] ; then if [ "${start}" = "File not found" ] ; then
echo "${DIR} not found!" echo "${DIR} not found!"
continue continue
fi fi
#----------------------------------------------------------------------------- #-----------------------------------------------------------------------------
# Store directory paths recursively under start pipe separated as dirs: # Store directory paths recursively under start pipe separated as dirs:
@ -128,18 +131,20 @@ for DIR in ${DIRS} ; do
#----------------------------------------------------------------------------- #-----------------------------------------------------------------------------
# Create target folder structure recursively: # Create target folder structure recursively:
#----------------------------------------------------------------------------- #-----------------------------------------------------------------------------
IFS=$'\n'
for dir in ${dirs} ; do for dir in ${dirs} ; do
path="$( echo "${dir}" | cut -d "|" -f 2 )" path="$( echo "${dir}" | cut -d "|" -f 2 )"
# the subfolder between "cur" and the mail kill the RFC # the subfolder between "cur" and the mail kill the RFC
if ! echo ${path} \ if ! echo "${path}" \
| grep -E ".*/\.cache/evolution/mail/.*/folders/.*/cur/.*" > /dev/null | grep -E ".*/(cur|new|tmp)/.*" > /dev/null
then then
if ! [ -d "${path}" ] ; then if ! [ -d "${T_PRE}${path}" ] ; then
mkdir -p "${T_PRE}${path}" mkdir -p "${T_PRE}${path}"
fi fi
fi fi
done done
unset IFS
#----------------------------------------------------------------------------- #-----------------------------------------------------------------------------
# Store file names recursively under start pipe separated as files: # Store file names recursively under start pipe separated as files:
@ -149,40 +154,41 @@ for DIR in ${DIRS} ; do
#----------------------------------------------------------------------------- #-----------------------------------------------------------------------------
# Extract files recursively into target folder(s): # Extract files recursively into target folder(s):
#----------------------------------------------------------------------------- #-----------------------------------------------------------------------------
IFS=$'\n'
for file in ${files} ; do for file in ${files} ; do
inode="$( echo "${file}" | cut -d "|" -f 3 )" inode="$( echo "${file}" | cut -d "|" -f 3 )"
name="$( echo "${file}" | cut -d "|" -f 2 )" name="$( echo "${file}" | cut -d "|" -f 2 )"
if ! echo ${name} \ if ! echo "${name}" \
| grep -E ".*/\.cache/evolution/mail/.*/folders/.*/cur/.*/.*" > /dev/null | grep -E ".*/(cur|new|tmp)/.*/.*" > /dev/null
then then
icat -o "${OFS}" "${IMG}" "${inode}" > "${T_PRE}${name}" # Maildir format incl. colons is not possible with ntfs!
icat -o "${OFS}" "${IMG}" "${inode}" > "${T_PRE}${name/:/..}"
else else
left="$( echo "${name}" | sed -E 's#(/cur|new|tmp)/.*#\1#' )"
right="$( echo "${name}" | sed -E 's#.*/(cur|new|tmp)/##' )"
# replace the last slash with a hyphen # replace the last slash with a hyphen
icat -o "${OFS}" "${IMG}" "${inode}" > "${T_PRE}${name%/*}-${name##*/}" icat -o "${OFS}" "${IMG}" "${inode}" > "${T_PRE}${left}/${right//\//-}"
fi fi
done done
unset IFS
done done
#------------------------------------------------------------------------------- #-------------------------------------------------------------------------------
# Index the local mail storage: # Index the local and external mail storage:
#------------------------------------------------------------------------------- #-------------------------------------------------------------------------------
if [ -d "${T_PRE}${S_PRE}/${user}/${LOCAL}" ] ; then echo "Indexing mails... please wait..."
mu index --quiet --muhome=./mu --maildir="${T_PRE}${S_PRE}/${user}/${LOCAL}"
fi
#------------------------------------------------------------------------------- mailboxes="$( find "${T_PRE}${S_PRE}/${user}" \
# Index the external mail storage(s): -type d -regex ".*\(cur\|new\|tmp\)" -exec dirname '{}' \; )"
#-------------------------------------------------------------------------------
accounts="$( find -E "${T_PRE}${S_PRE}/${user}/${CACHE}" -type d -depth 1 \ IFS=$'\n'
-iregex ".*/[[:xdigit:]]{40}" -exec basename '{}' \; )" for mailbox in ${mailboxes} ; do
for account in ${accounts} ; do # \""${mailbox}\"" because: spaces are more evil as expected
folders="$( find -E "${T_PRE}${S_PRE}/${user}/${CACHE}/${account}/folders" \ mu index --quiet --muhome="${PRE}/mu" --maildir=\""${mailbox}\""
-type d -depth 1 -exec basename '{}' \; )"
for folder in ${folders} ; do
mu index --quiet --muhome=./mu \
--maildir="${T_PRE}${S_PRE}/${user}/${CACHE}/${account}/folders/${folder}"
done
done done
unset IFS
echo "Done."
exit 0 exit 0