forensic-cli 1.2.5__py3-none-any.whl

core/browser/downloads_history.py

@@ -0,0 +1,129 @@
+import os
+import sqlite3
+import time
+import json
+import shutil
+from pathlib import Path
+
+def timestamp_chrome(microsegundos):
+    if microsegundos:
+        return time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(microsegundos / 1000000 - 11644473600))
+    return "N/A"
+
+def timestamp_firefox(microsegundos):
+    if microsegundos:
+        return time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(microsegundos / 1000000))
+    return "N/A"
+
+def salvar_em_json(dados, navegador, usuario, output_dir: Path):
+    output_dir.mkdir(parents=True, exist_ok=True)
+    nome_arquivo = output_dir / f"Downloads_{navegador}_{usuario}.json"
+    with open(nome_arquivo, "w", encoding="utf-8") as f:
+        json.dump(dados, f, indent=4, ensure_ascii=False)
+    print(f"[✓] Arquivo salvo: {nome_arquivo}")
+
+def copiar_banco(origem):
+    destino = f"temp_{os.path.basename(origem)}"
+    shutil.copy2(origem, destino)
+    return destino
+
+def extrair_downloads_chrome_edge(caminho_banco, navegador, usuario, output_dir: Path):
+    caminho_temp = copiar_banco(caminho_banco)
+    try:
+        conn = sqlite3.connect(caminho_temp)
+        cursor = conn.cursor()
+
+        cursor.execute("""
+            SELECT d.target_path, d.tab_url, d.start_time, d.received_bytes, d.state, u.url
+            FROM downloads d
+            LEFT JOIN downloads_url_chains u ON d.id = u.id
+            ORDER BY d.start_time DESC
+            LIMIT 10;
+        """)
+        rows = cursor.fetchall()
+
+        downloads = []
+        for row in rows:
+            path, tab_url, start_time, bytes_received, state, source_url = row
+            downloads.append({
+                "arquivo": path,
+                "url_origem": source_url,
+                "url_abas": tab_url,
+                "inicio_download": timestamp_chrome(start_time),
+                "bytes_recebidos": bytes_received,
+                "estado": state
+            })
+
+        salvar_em_json(downloads, navegador, usuario, output_dir)
+
+    except Exception as e:
+        print(f"[!] Erro ({navegador}): {e}")
+    finally:
+        conn.close()
+        os.remove(caminho_temp)
+
+def extrair_downloads_firefox(caminho_banco, usuario, output_dir: Path):
+    caminho_temp = copiar_banco(caminho_banco)
+    try:
+        conn = sqlite3.connect(caminho_temp)
+        cursor = conn.cursor()
+
+        cursor.execute("""
+            SELECT source, target, startTime, endTime, state
+            FROM moz_downloads
+            ORDER BY startTime DESC
+            LIMIT 10;
+        """)
+        rows = cursor.fetchall()
+
+        downloads = []
+        for row in rows:
+            source, target, startTime, endTime, state = row
+            downloads.append({
+                "arquivo": target,
+                "url_origem": source,
+                "inicio_download": timestamp_firefox(startTime),
+                "estado": state
+            })
+
+        salvar_em_json(downloads, "Firefox", usuario, output_dir)
+
+    except Exception as e:
+        print(f"[!] Erro (Firefox): {e}")
+    finally:
+        conn.close()
+        os.remove(caminho_temp)
+
+def extract_downloads_history(output_dir: Path, chrome=True, edge=True, firefox=True):
+    usuario = os.getlogin()
+    home = Path.home()
+
+    if chrome:
+        caminho_chrome = home / "AppData/Local/Google/Chrome/User Data/Default/History"
+        if caminho_chrome.exists():
+            print("[*] Extraindo downloads do Chrome...")
+            extrair_downloads_chrome_edge(caminho_chrome, "Chrome", usuario, output_dir)
+        else:
+            print("[!] Chrome não encontrado.")
+
+    if edge:
+        caminho_edge = home / "AppData/Local/Microsoft/Edge/User Data/Default/History"
+        if caminho_edge.exists():
+            print("[*] Extraindo downloads do Edge...")
+            extrair_downloads_chrome_edge(caminho_edge, "Edge", usuario, output_dir)
+        else:
+            print("[!] Edge não encontrado.")
+
+    if firefox:
+        caminho_firefox_perfis = home / "AppData/Roaming/Mozilla/Firefox/Profiles"
+        if caminho_firefox_perfis.exists():
+            for perfil in caminho_firefox_perfis.iterdir():
+                caminho_downloads_sqlite = perfil / "downloads.sqlite"
+                if caminho_downloads_sqlite.exists():
+                    print(f"[*] Extraindo downloads do Firefox ({perfil.name})...")
+                    extrair_downloads_firefox(caminho_downloads_sqlite, usuario, output_dir)
+                    break
+            else:
+                print("[!] downloads.sqlite do Firefox não encontrado.")
+        else:
+            print("[!] Perfis do Firefox não encontrados.")

core/browser/fav_screen.py

@@ -0,0 +1,70 @@
+from pathlib import Path
+from selenium import webdriver
+from selenium.webdriver.chrome.options import Options
+from urllib.parse import urlparse
+import hashlib
+import requests
+import json
+import time
+
+def carregar_json(caminho):
+    with open(caminho, 'r', encoding='utf-8') as f:
+        return json.load(f)
+
+def extrair_urls_validas(dados_json):
+    urls = []
+
+    for chave in ["historico_ultimas_urls", "ultimas_10_urls", "historico_completo"]:
+        entradas = dados_json.get(chave, [])
+        for entrada in entradas:
+            url = entrada.get("url")
+            if url and url.startswith("http"):
+                urls.append(url)
+
+    return urls
+
+def baixar_favicon(url, pasta_destino: Path):
+    try:
+        pasta_destino.mkdir(parents=True, exist_ok=True)
+        dominio = urlparse(url).netloc
+        favicon_url = f"https://{dominio}/favicon.ico"
+        resposta = requests.get(favicon_url, timeout=5)
+        if resposta.status_code == 200:
+            nome_arquivo = hashlib.md5(dominio.encode()).hexdigest() + ".ico"
+            caminho = pasta_destino / nome_arquivo
+            with open(caminho, "wb") as f:
+                f.write(resposta.content)
+            print(f"[FAVICON] Baixado: {dominio}")
+        else:
+            print(f"[FAVICON] Não encontrado para {dominio}")
+    except Exception as e:
+        print(f"[FAVICON] Erro ao baixar de {url}: {e}")
+
+def capturar_print(url, pasta_destino: Path):
+    try:
+        pasta_destino.mkdir(parents=True, exist_ok=True)
+        nome_arquivo = hashlib.md5(url.encode()).hexdigest() + ".png"
+        caminho = pasta_destino / nome_arquivo
+
+        chrome_options = Options()
+        chrome_options.add_argument("--headless=new")
+        chrome_options.add_argument("--disable-gpu")
+        chrome_options.add_argument("--window-size=1280,1024")
+
+        driver = webdriver.Chrome(options=chrome_options)
+        driver.set_page_load_timeout(10)
+        driver.get(url)
+        time.sleep(3)
+        driver.save_screenshot(str(caminho))
+        driver.quit()
+        print(f"[PRINT] Capturado: {url}")
+    except Exception as e:
+        print(f"[PRINT] Erro ao capturar print de {url}: {e}")
+
+def processar_urls(urls, output_dir: Path):
+    fav_dir = output_dir / "favicons"
+    print_dir = output_dir / "prints"
+    for url in urls:
+        print(f"\n[PROCESSANDO] {url}")
+        baixar_favicon(url, fav_dir)
+        capturar_print(url, print_dir)

core/browser/logins.py

@@ -0,0 +1,108 @@
+import os
+import json
+import base64
+import shutil
+import sqlite3
+from Crypto.Cipher import AES
+from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+import win32crypt
+
+def find_chrome_profiles() -> list[tuple[str, str]]:
+    base = os.path.join(os.environ["USERPROFILE"], "AppData", "Local", "Google", "Chrome", "User Data")
+    profiles = []
+
+    for name in os.listdir(base):
+        if name == "Default" or name.startswith("Profile"):
+            db = os.path.join(base, name, "Login Data")
+            if os.path.isfile(db):
+                profiles.append((name, db))
+
+    return profiles
+
+def collect_chrome_logins() -> dict:
+    result = []
+    profiles = find_chrome_profiles()
+    for profile_name, db_path in profiles:
+        tmp_db = os.path.join(os.getenv("TEMP"), f"{profile_name}_LoginData.db")
+        shutil.copy2(db_path, tmp_db)
+
+        conn = sqlite3.connect(tmp_db)
+        cursor = conn.cursor()
+        cursor.execute("SELECT origin_url, username_value, password_value FROM logins")
+        rows = cursor.fetchall()
+
+        for origin_url, username, pwd_blob in rows:
+            pwd_b64 = base64.b64encode(pwd_blob).decode('ascii')
+            result.append({
+                "profile": profile_name,
+                "site": origin_url,
+                "user": username,
+                "password_encrypted": pwd_b64
+            })
+
+        cursor.close()
+        conn.close()
+        os.remove(tmp_db)
+
+    return {"logins": result}
+
+def get_edge_user_data_path():
+    user = os.getenv("USERNAME")
+
+    return f"C:/Users/{user}/AppData/Local/Microsoft/Edge/User Data/Default"
+
+def get_edge_encryption_key():
+    user = os.getenv("USERNAME")
+    local_state_path = f"C:/Users/{user}/AppData/Local/Microsoft/Edge/User Data/Local State"
+
+    with open(local_state_path, 'r', encoding='utf-8') as file:
+        local_state = json.load(file)
+
+    encrypted_key = base64.b64decode(local_state["os_crypt"]["encrypted_key"])
+    encrypted_key = encrypted_key[5:]
+    key = win32crypt.CryptUnprotectData(encrypted_key, None, None, None, 0)[1]
+
+    return key
+
+def decrypt_edge_password(password_encrypted, key):
+    try:
+        if password_encrypted.startswith(b'v10') or password_encrypted.startswith(b'v11'):
+            password_encrypted = password_encrypted[3:]
+            iv = password_encrypted[:12]
+            payload = password_encrypted[12:]
+            aesgcm = AESGCM(key)
+
+            return aesgcm.decrypt(iv, payload, None).decode()
+        else:
+            return win32crypt.CryptUnprotectData(password_encrypted, None, None, None, 0)[1].decode()
+    except Exception:
+        return None
+
+def collect_edge_logins() -> dict:
+    user_data_path = get_edge_user_data_path()
+    login_data_path = os.path.join(user_data_path, "Login Data")
+    tmp_db = os.path.join(os.getenv("TEMP"), "Edge_LoginData.db")
+    shutil.copy2(login_data_path, tmp_db)
+
+    key = get_edge_encryption_key()
+    result = []
+
+    conn = sqlite3.connect(tmp_db)
+    cursor = conn.cursor()
+    try:
+        cursor.execute("SELECT origin_url, username_value, password_value FROM logins")
+        for origin_url, username, pwd_encrypted in cursor.fetchall():
+            if not pwd_encrypted:
+                continue
+            pwd = decrypt_edge_password(pwd_encrypted, key)
+            result.append({
+                "site": origin_url,
+                "user": username,
+                "password": pwd
+            })
+    finally:
+        cursor.close()
+        conn.close()
+        os.remove(tmp_db)
+
+    return {"logins": result}

core/browser/unusual_patterns.py

@@ -0,0 +1,111 @@
+import os
+import json
+import pandas as pd
+import matplotlib.pyplot as plt
+from datetime import datetime
+
+def carregar_json(caminho):
+    with open(caminho, 'r', encoding='utf-8') as f:
+        return json.load(f)
+
+def tratar_data_acesso(data_str):
+    try:
+        if data_str == "N/A" or not data_str:
+            return None
+        return pd.to_datetime(data_str, format="%Y-%m-%d %H:%M:%S", errors='raise')
+    except Exception as e:
+        print(f"[ALERTA] Erro ao processar data: {data_str}. Erro: {e}")
+        return None
+
+def detectar_acessos_horarios_diferentes(df, output_dir=None, arquivo_prefixo=""):
+    df['ultimo_acesso'] = df['ultimo_acesso'].apply(tratar_data_acesso)
+    df = df.dropna(subset=['ultimo_acesso']).copy()
+    df.loc[:, 'hora'] = df['ultimo_acesso'].dt.hour
+
+    acessos_madrugada = df[df['hora'].between(0, 6)]
+    acessos_manha = df[df['hora'].between(7, 11)]
+    acessos_tarde = df[df['hora'].between(12, 17)]
+    acessos_noite = df[df['hora'].between(18, 23)]
+
+    plt.figure(figsize=(10, 6))
+    acessos_por_hora = df['hora'].value_counts().sort_index()
+    acessos_por_hora.plot(kind='bar', color='skyblue')
+    plt.title('Acessos por Hora do Dia')
+    plt.xlabel('Hora')
+    plt.ylabel('Número de Acessos')
+    plt.xticks(rotation=0)
+    plt.tight_layout()
+
+    if output_dir:
+        caminho_grafico = os.path.join(output_dir, f"{arquivo_prefixo}acessos_por_hora.png")
+        plt.savefig(caminho_grafico)
+        plt.close()
+        print(f"[INFO] Gráfico salvo em: {caminho_grafico}")
+    else:
+        plt.show()
+
+    acessos_por_periodo = {
+        "Madrugada (00h-06h)": len(acessos_madrugada),
+        "Manhã (07h-11h)": len(acessos_manha),
+        "Tarde (12h-17h)": len(acessos_tarde),
+        "Noite (18h-23h)": len(acessos_noite),
+    }
+    print("\nAcessos por período:")
+    print(pd.DataFrame(list(acessos_por_periodo.items()), columns=["Período", "Quantidade de Acessos"]))
+
+    acessos_incomuns = pd.concat([acessos_madrugada, acessos_noite])
+    if not acessos_incomuns.empty:
+        print(f"\nAcessos em horários incomuns (madrugada/noite):")
+        print(acessos_incomuns[['url', 'ultimo_acesso']].head())
+
+def detectar_acessos_repetidos(df, intervalo_maximo=5):
+    df['ultimo_acesso'] = pd.to_datetime(df['ultimo_acesso'])
+    df['diferenca'] = df['ultimo_acesso'].diff().fillna(pd.Timedelta(seconds=0))
+
+    acessos_repetidos = df[df['diferenca'] < pd.Timedelta(minutes=intervalo_maximo)]
+
+    if not acessos_repetidos.empty:
+        print(f"\nAcessos repetidos detectados em intervalos menores que {intervalo_maximo} minutos:")
+        print(acessos_repetidos[['url', 'ultimo_acesso', 'diferenca']].head())
+
+def processar_historico_da_pasta(pasta, output_dir=None):
+    arquivos_json = [f for f in os.listdir(pasta) if f.endswith('.json')]
+
+    if not arquivos_json:
+        print("[ALERTA] Nenhum arquivo JSON encontrado na pasta especificada.")
+        return
+
+    if output_dir:
+        os.makedirs(output_dir, exist_ok=True)
+
+    for arquivo in arquivos_json:
+        caminho_arquivo = os.path.join(pasta, arquivo)
+        try:
+            print(f"\n[INFO] Processando arquivo: {caminho_arquivo}")
+
+            dados = carregar_json(caminho_arquivo)
+
+            if "historico_completo" in dados:
+                lista_acessos = dados["historico_completo"]
+            elif "ultimas_10_urls" in dados:
+                lista_acessos = dados["ultimas_10_urls"]
+            else:
+                print(f"[AVISO] Nenhum histórico válido encontrado em {arquivo}")
+                continue
+
+            df = pd.DataFrame(lista_acessos).copy()
+
+            prefixo = os.path.splitext(arquivo)[0] + "_"
+            detectar_acessos_horarios_diferentes(df, output_dir=output_dir, arquivo_prefixo=prefixo)
+            detectar_acessos_repetidos(df, intervalo_maximo=5)
+
+        except Exception as erro:
+            print(f"\n❌ Erro ao processar o arquivo {arquivo}: {erro}")
+
+if __name__ == "__main__":
+    try:
+        pasta_json = "artefatos/historico"
+        output_dir = "artefatos/patterns_output"
+        processar_historico_da_pasta(pasta_json, output_dir=output_dir)
+    except Exception as erro:
+        print(f"\n❌ Erro geral: {erro}")

core/data/data_recovery.py

@@ -0,0 +1,157 @@
+import os
+import json
+import csv
+import platform
+from datetime import datetime
+import shutil
+
+IS_WINDOWS = platform.system() == "Windows"
+RECOVERY_DIR = os.path.join(os.getcwd(), "recovered_files")
+os.makedirs(RECOVERY_DIR, exist_ok=True)
+
+FILE_FILTERS = {
+    "imagens": [".jpg", ".jpeg", ".png", ".gif", ".bmp", ".tiff"],
+    "documentos": [".txt", ".doc", ".docx", ".odt", ".json"],
+    "pdfs": [".pdf"],
+    "planilhas": [".xls", ".xlsx", ".ods", ".csv"]
+}
+
+ACTIVE_FILTERS = FILE_FILTERS["imagens"] + FILE_FILTERS["documentos"] + FILE_FILTERS["pdfs"] + FILE_FILTERS["planilhas"]
+
+if IS_WINDOWS:
+    try:
+        import winshell
+        WIN_AVAILABLE = True
+    except ImportError:
+        WIN_AVAILABLE = False
+        print("⚠️ winshell não disponível. Módulo de recuperação Windows desativado.")
+else:
+    WIN_AVAILABLE = False
+
+def filter_file(filename):
+    if not ACTIVE_FILTERS:
+        return True
+    _, ext = os.path.splitext(filename.lower())
+    return ext in ACTIVE_FILTERS
+
+def list_deleted_files_windows():
+    deleted_files = []
+    if not WIN_AVAILABLE:
+        return deleted_files
+    try:
+        for item in winshell.recycle_bin():
+            try:
+                original_path = item.original_filename()
+                name = os.path.basename(original_path)
+                if not filter_file(name):
+                    continue
+
+                deleted_files.append({
+                    "original_path": original_path,
+                    "recycle_path": item.filename(),
+                    "name": name,
+                    "deleted_time": item.recycle_date().isoformat(),
+                    "hidden": False
+                })
+            except Exception as e:
+                print(f"⚠️ Falha ao processar item da Lixeira: {e}")
+        print(f"[INFO] {len(deleted_files)} arquivo(s) encontrados na Lixeira com filtro aplicado.")
+    except Exception as e:
+        print(f"⚠️ Erro ao acessar a Lixeira: {e}")
+    return deleted_files
+
+def recover_file_windows(file_info):
+    try:
+        src = file_info["recycle_path"]
+        dst = os.path.join(RECOVERY_DIR, file_info["name"])
+        shutil.copy2(src, dst)
+        print(f"[OK] Arquivo recuperado: {file_info['name']}")
+        return True
+    except Exception as e:
+        print(f"[ERRO] Falha ao recuperar {file_info['name']}: {e}")
+        return False
+
+try:
+    import pytsk3
+    PYTSK3_AVAILABLE = True
+except ImportError:
+    PYTSK3_AVAILABLE = False
+    if not IS_WINDOWS:
+        print("⚠️ pytsk3 não instalado. Recuperação Linux desativada.")
+
+def list_deleted_files_linux(partition="/"):
+    deleted_files = []
+    if not PYTSK3_AVAILABLE:
+        return deleted_files
+    try:
+        img = pytsk3.Img_Info(partition)
+        fs = pytsk3.FS_Info(img)
+        directory = fs.open_dir(path="/")
+        for entry in directory:
+            try:
+                if entry.info.meta and entry.info.meta.flags & pytsk3.TSK_FS_META_FLAG_UNALLOC:
+                    name = entry.info.name.name.decode("utf-8")
+                    if not filter_file(name):
+                        continue
+                    deleted_files.append({
+                        "name": name,
+                        "inode": entry.info.meta.addr,
+                        "size": entry.info.meta.size,
+                        "deleted_time": datetime.fromtimestamp(entry.info.meta.mtime).isoformat()
+                    })
+            except:
+                continue
+        print(f"[INFO] {len(deleted_files)} arquivo(s) deletados encontrados na partição {partition} com filtro aplicado.")
+    except Exception as e:
+        print(f"[ERRO] Não foi possível acessar a partição {partition}: {e}")
+    return deleted_files
+
+def recover_file_linux(file_info, partition="/"):
+    dst = os.path.join(RECOVERY_DIR, file_info["name"])
+    try:
+        with open(dst, "w") as f:
+            f.write("Recuperação simulada para Linux")
+        print(f"[OK] Arquivo simulado recuperado: {file_info['name']}")
+        return True
+    except Exception as e:
+        print(f"[ERRO] Falha ao recuperar {file_info['name']}: {e}")
+        return False
+
+def save_recovery_results(results, prefix="data_recovery"):
+    timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
+    json_file = f"{prefix}_{timestamp}.json"
+    csv_file = f"{prefix}_{timestamp}.csv"
+
+    if not results:
+        results.append({"info": "Nenhum arquivo encontrado"})
+
+    with open(json_file, "w", encoding="utf-8") as f:
+        json.dump(results, f, indent=4, ensure_ascii=False)
+
+    headers = results[0].keys()
+    with open(csv_file, "w", newline="", encoding="utf-8") as f:
+        writer = csv.DictWriter(f, fieldnames=headers)
+        writer.writeheader()
+        for r in results:
+            writer.writerow(r)
+
+    print(f"\n✅ Resultados salvos em JSON: {json_file} e CSV: {csv_file}")
+
+if __name__ == "__main__":
+    recovered_results = []
+
+    if IS_WINDOWS:
+        files = list_deleted_files_windows()
+        for f in files:
+            status = recover_file_windows(f)
+            f["recovered"] = "Sim" if status else "Falha"
+            recovered_results.append(f)
+    else:
+        partition = input("Digite a partição ou device para recuperar arquivos (ex: /dev/sda1): ").strip()
+        files = list_deleted_files_linux(partition)
+        for f in files:
+            status = recover_file_linux(f, partition)
+            f["recovered"] = "Sim" if status else "Falha"
+            recovered_results.append(f)
+
+    save_recovery_results(recovered_results)

core/db/db.py

@@ -0,0 +1,12 @@
+from sqlalchemy import create_engine
+from sqlalchemy.orm import sessionmaker, declarative_base
+
+SQLALCHEMY_DATABASE_URL = "sqlite:///./devkit.db"
+
+engine = create_engine(
+    SQLALCHEMY_DATABASE_URL, connect_args={"check_same_thread": False}
+)
+
+SessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=engine)
+
+Base = declarative_base()

core/email/email_parser.py

@@ -0,0 +1,87 @@
+import os
+import json
+import csv
+import email
+from email import policy
+from email.parser import BytesParser
+from datetime import datetime
+import hashlib
+
+BASE_DIR = os.getcwd()
+ATTACHMENT_DIR = os.path.join(BASE_DIR, "attachments")
+os.makedirs(ATTACHMENT_DIR, exist_ok=True)
+
+def hash_file(filepath, method="md5"):
+    h = hashlib.md5() if method == "md5" else hashlib.sha256()
+    with open(filepath, "rb") as f:
+        for chunk in iter(lambda: f.read(4096), b""):
+            h.update(chunk)
+    return h.hexdigest()
+
+def parse_eml_file(filepath):
+    with open(filepath, "rb") as f:
+        msg = BytesParser(policy=policy.default).parse(f)
+
+    email_data = {
+        "subject": msg.get("subject"),
+        "from": msg.get("from"),
+        "to": msg.get("to"),
+        "cc": msg.get("cc"),
+        "bcc": msg.get("bcc"),
+        "date": msg.get("date"),
+        "message_id": msg.get("message-id"),
+        "attachments": []
+    }
+
+    for part in msg.iter_attachments():
+        filename = part.get_filename()
+        if filename:
+            safe_filename = filename.replace("/", "_").replace("\\", "_")
+            filepath = os.path.join(ATTACHMENT_DIR, safe_filename)
+            with open(filepath, "wb") as af:
+                af.write(part.get_payload(decode=True))
+            email_data["attachments"].append({
+                "name": safe_filename,
+                "size": os.path.getsize(filepath),
+                "hash_md5": hash_file(filepath)
+            })
+
+    return email_data
+
+def parse_eml_folder(folder_path):
+    results = []
+    for root, _, files in os.walk(folder_path):
+        for file in files:
+            if file.lower().endswith(".eml"):
+                filepath = os.path.join(root, file)
+                try:
+                    data = parse_eml_file(filepath)
+                    results.append(data)
+                    print(f"[OK] E-mail processado: {file}")
+                except Exception as e:
+                    print(f"[ERRO] Falha ao processar {file}: {e}")
+    return results
+
+def export_results(results, prefix="email_analysis"):
+    timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
+    json_file = f"{prefix}_{timestamp}.json"
+    csv_file = f"{prefix}_{timestamp}.csv"
+
+    with open(json_file, "w", encoding="utf-8") as f:
+        json.dump(results, f, indent=4, ensure_ascii=False)
+
+    headers = ["subject", "from", "to", "cc", "bcc", "date", "message_id", "attachments"]
+    with open(csv_file, "w", newline="", encoding="utf-8") as f:
+        writer = csv.DictWriter(f, fieldnames=headers)
+        writer.writeheader()
+        for r in results:
+            r_copy = r.copy()
+            r_copy["attachments"] = ", ".join([a["name"] for a in r["attachments"]])
+            writer.writerow(r_copy)
+
+    print(f"\n✅ Resultados salvos em JSON: {json_file} e CSV: {csv_file}")
+
+if __name__ == "__main__":
+    folder = input("Digite o caminho da pasta com arquivos .eml: ").strip()
+    results = parse_eml_folder(folder)
+    export_results(results)