Skip to content

Fix export CSV for emails run program artifacts#7964

Open
markmckinnon wants to merge 6 commits intosleuthkit:developfrom
markmckinnon:Fix-Export-Emails-Run-program-artifacts
Open

Fix export CSV for emails run program artifacts#7964
markmckinnon wants to merge 6 commits intosleuthkit:developfrom
markmckinnon:Fix-Export-Emails-Run-program-artifacts

Conversation

@markmckinnon
Copy link
Copy Markdown
Contributor

@markmckinnon markmckinnon commented Apr 24, 2025

Fix errors with exporting list as a csv for Email and run program artifacts

Summary by CodeRabbit

  • Bug Fixes

    • CSV exports now consistently use UTF-8 encoding to prevent character issues.
    • Email artifacts now record attachment presence explicitly as "Yes" or "No" instead of leaving blank values.
    • Attachment attribute label updated to "Has Attachment" for clearer display.
  • Chores

    • Adjusted execution order of extractors to refine ingest workflow sequencing.

fix export csv erroring out with cannot find has_attachments
Fix csv export erroring out where it could not find bytes_sent/Recvd
Fix error with surrogate pairs exception when exporting a CSV file.
@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented Apr 9, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: dfabc948-693e-4bfd-99bb-22034be156e1

📥 Commits

Reviewing files that changed from the base of the PR and between 59fb884 and 504419e.

📒 Files selected for processing (1)
  • RecentActivity/src/org/sleuthkit/autopsy/recentactivity/RAImageIngestModule.java
🚧 Files skipped from review as they are similar to previous changes (1)
  • RecentActivity/src/org/sleuthkit/autopsy/recentactivity/RAImageIngestModule.java

📝 Walkthrough

Walkthrough

CSV export now writes via an explicit UTF-8 OutputStreamWriter; recent activity ingest adds sru and prefetch earlier in the extractor order; Thunderbird mbox email artifacts set EMAIL_HAS_ATTACHMENT to "Yes" or "No" and adjusted its display name.

Changes

Cohort / File(s) Summary
CSV Export IO Handling
Core/src/org/sleuthkit/autopsy/directorytree/ExportCSVAction.java
Switched CSV output to write through an OutputStreamWriter with explicit UTF-8 encoding (using Files.newOutputStream with CREATE_NEW, WRITE) and adjusted try-with-resources scope so the writer wraps the stream.
Ingest Module Execution Order
RecentActivity/src/org/sleuthkit/autopsy/recentactivity/RAImageIngestModule.java
Reordered startUp() extractor initialization: sru and prefetch are now added immediately after jumpList, changing their execution position relative to zoneInfo.
Email Artifact Attribute Values
thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/ThunderbirdMboxFileIngestModule.java
EMAIL_HAS_ATTACHMENT attribute now uses explicit "Yes"/"No" string values for presence/absence of attachments; attribute display name adjusted from "Has Attachments" to "Has Attachment".

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Poem

🐰 I nibble bytes with careful cheer,
UTF-8 trails now crisp and clear,
Extractors hop to earlier ground,
Attachments say "Yes" or "No" aloud,
A tiny hop—new order found.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (2 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title directly addresses the primary change across all three files: fixing CSV export functionality for email and run program artifacts.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 PMD (7.23.0)
RecentActivity/src/org/sleuthkit/autopsy/recentactivity/RAImageIngestModule.java

[ERROR] Cannot load ruleset rulesets/java/basic.xml/SimplifiedTernary: Cannot resolve rule/ruleset reference 'rulesets/java/basic.xml/SimplifiedTernary'. Make sure the resource is a valid file or URL and is on the CLASSPATH. Use --debug (or a fine log level) to see the current classpath.
[WARN] Progressbar rendering conflicts with reporting to STDOUT. No progressbar will be shown. Try running with argument -r to output the report to a file instead.


Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@Core/src/org/sleuthkit/autopsy/directorytree/ExportCSVAction.java`:
- Around line 325-326: The code currently uses new FileOutputStream(outputFile)
in the OutputStreamWriter/SequenceWriter block (see OutputStreamWriter and
SequenceWriter seqWriter usage in ExportCSVAction) which can accidentally
overwrite a file created after the earlier existence check; change the creation
to be atomic by opening the output with atomic create semantics (e.g., use
Files.newOutputStream(outputFile.toPath(), StandardOpenOption.CREATE_NEW,
StandardOpenOption.WRITE) or write to a temp file and then Files.move(tempPath,
outputFile.toPath(), StandardCopyOption.ATOMIC_MOVE) after successful write) so
the file is never silently overwritten.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: aa8a0a4a-be3e-44b4-9e77-1fce0766cb07

📥 Commits

Reviewing files that changed from the base of the PR and between 6901fa7 and 0a370e0.

📒 Files selected for processing (3)
  • Core/src/org/sleuthkit/autopsy/directorytree/ExportCSVAction.java
  • RecentActivity/src/org/sleuthkit/autopsy/recentactivity/RAImageIngestModule.java
  • thunderbirdparser/src/org/sleuthkit/autopsy/thunderbirdparser/ThunderbirdMboxFileIngestModule.java

Comment thread Core/src/org/sleuthkit/autopsy/directorytree/ExportCSVAction.java Outdated
Suggestion based on coderabbit
@bcarrier
Copy link
Copy Markdown
Member

@markmckinnon Can you resolve the merge conflict? I think it came in from another PR from you I just merged?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants