search

pjrinaldi / wombatforensics

linux c++, fox-toolkit, multi-threaded forensic gui tool
GNU General Public License v2.0
46 stars 12 forks source link

MBox Parser/Viewer #423

Closed pjrinaldi closed 2 years ago

pjrinaldi commented 2 years ago

Working on simplest attempt to start for an mbox viewer. got framework to launch the mbox viewer, now i need to start parsing the mbox viewer. will have to review standards to implement full mbox parsing, but will start with simplest format first and work my way up

pjrinaldi commented 2 years ago

rudimentary implementation... still need to tweak the content section so it doesn't include the "From " line from the next email.

Need to implement tagging and the subsequent reporting for it. also can probably remove the status bar and the toolbar since i shouldn't need them.

pjrinaldi commented 2 years ago

content is working, it includes the string of the next found message, so i need to subtract that string length from the content data point, probably when i set the mbox layout property, I can remove that string length for the next position prior to writing it to the position. this may change how the poslist is built, since the pos is right for the start of the pos, but too long for the end of the previous one.

pjrinaldi commented 2 years ago

working on adding tagging functionality to the mbox parser. need to work on html display for it

need to do the TransferArtifacts("mbox", path) for it.

pjrinaldi commented 2 years ago

still also need to look and see if i want to add the mbox files as the child of the mbox file.

pjrinaldi commented 2 years ago

tagging next to the mbox item works. need to fix the AddFileItem htmlentry so it actually displays something useful in the preview report. then i need to put a link which goes to the mboxfile and looks good, closer to an email message of some kind...

pjrinaldi commented 2 years ago

addfileitem is working, need to work on remove tag and removefileitem.

pjrinaldi commented 2 years ago

removing the artifact, file item, and tag work. mbox parser/viewer works for its current iteration. as more features are implemented, i'll open new tickets.