email parser multipart/mixed issue

sleuthkit / autopsy

Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It can be used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card.

http://www.sleuthkit.org/autopsy/

2.3k stars 586 forks source link

email parser multipart/mixed issue #5011

Open tothi opened 5 years ago

tothi commented 5 years ago

email parser (in release 4.11.0) shows wrong headers in case of multipart/mixed content-type mails. instead of the full headers only the "headers" of the 1st part of the multipart content is displayed (e.g. Content-Type: text/plain; charset=us-ascii; Content-Disposition: inline).

bcarrier commented 4 years ago

Was this for MBOX, PST, or both?

tothi commented 4 years ago

MBOX (Thunderbird).

tried Outlook 2016 (.ost) as well, but it does not seem to be supported by Autopsy, so it is another issue ;).

compufuzz commented 4 years ago

ran into a similar issue with an OST file. Autopsy started processing but choked and coughed up a stack overflow error. will try to replicate or get error details and post here.