From 42c1a3167c3ccafcf879934f5381c2a2f1534f44 Mon Sep 17 00:00:00 2001
From: Greg DiCristofaro <gregd@basistech.com>
Date: Mon, 18 Jan 2021 15:38:25 -0500
Subject: [PATCH 1/4] reconcile with catalog

---
 .../aleap-artifact-attribute-reference.xml         | 14 +++++++-------
 .../ileap-artifact-attribute-reference.xml         |  6 +++---
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/aleap-artifact-attribute-reference.xml b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/aleap-artifact-attribute-reference.xml
index 784ccefa18..87bbb3e93a 100644
--- a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/aleap-artifact-attribute-reference.xml
+++ b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/aleap-artifact-attribute-reference.xml
@@ -66,7 +66,7 @@
 
         <FileName filename="Browser cookies.tsv" description="Browser Cookies">
             <ArtifactName artifactname="TSK_WEB_COOKIE" comment="Browser Cookies">
-                <AttributeName attributename="TSK_DATETIME_ACCESSED" columnName="Last Access Date" required="yes" />
+                <AttributeName attributename="TSK_DATETIME_START" columnName="Last Access Date" required="yes" />
                 <AttributeName attributename="TSK_DOMAIN" columnName="Host" required="yes" />
                 <AttributeName attributename="TSK_NAME" columnName="Name" required="yes" />
                 <AttributeName attributename="TSK_VALUE" columnName="Value" required="yes" />
@@ -78,7 +78,7 @@
 
         <FileName filename="Browser History.tsv" description="Browser History">
             <ArtifactName artifactname="TSK_WEB_HISTORY" comment="Browser History">
-                <AttributeName attributename="TSK_DATETIME_ACCESSED" columnName="Last Visit Time" required="yes"/>
+                <AttributeName attributename="TSK_DATETIME_START" columnName="Last Visit Time" required="yes"/>
                 <AttributeName attributename="TSK_URL" columnName="URL" required="yes"/>
                 <AttributeName attributename="TSK_TITLE" columnName="Title" required="yes"/>
                 <AttributeName attributename="null" columnName="Visit Count" required="no"/>
@@ -97,7 +97,7 @@
         <FileName filename="Browser login data.tsv" description="Browser Login Data">
             <ArtifactName artifactname="TSK_SERVICE_ACCOUNT" comment="Browser Login">
                 <AttributeName attributename="TSK_DATETIME_CREATED" columnName="Created Time" required="yes" />
-                <AttributeName attributename="TSK_USER_NAME" columnName="Username" required="yes" />
+                <AttributeName attributename="TSK_USER_ID" columnName="Username" required="yes" />
                 <AttributeName attributename="TSK_PASSWORD" columnName="Password" required="yes" />
                 <AttributeName attributename="TSK_URL" columnName="Origin URL" required="no" />
                 <AttributeName attributename="null" columnName="Blacklisted by User" required="no" />
@@ -167,7 +167,7 @@
             <AttributeName attributename="TSK_DOMAIN" columnName="Host" required="yes" />
             <AttributeName attributename="TSK_NAME" columnName="Name" required="yes" />
             <AttributeName attributename="TSK_VALUE" columnName="Value" required="yes" />
-            <AttributeName attributename="TSK_DATETIME_CREATED" columnName="Created Date" required="yes" />
+            <AttributeName attributename="TSK_DATETIME_START" columnName="Created Date" required="yes" />
             <AttributeName attributename="TSK_DATETIME_END" columnName="Expiration Date" required="yes" />
             <AttributeName attributename="TSK_PATH" columnName="Path" required="yes" />
         </ArtifactName>
@@ -186,7 +186,7 @@
     <FileName filename="Chrome login data.tsv" description="Chrome Login Data">
         <ArtifactName artifactname="TSK_SERVICE_ACCOUNT" comment="Chrome Login">
             <AttributeName attributename="TSK_DATETIME_CREATED" columnName="Created Time" required="yes" />
-            <AttributeName attributename="TSK_USER_NAME" columnName="Username" required="yes" />
+            <AttributeName attributename="TSK_USER_ID" columnName="Username" required="yes" />
             <AttributeName attributename="TSK_PASSWORD" columnName="Password" required="yes" />
             <AttributeName attributename="TSK_URL" columnName="Origin URL" required="no" />
             <AttributeName attributename="null" columnName="Blacklisted by User" required="no" />
@@ -248,7 +248,7 @@
 
     <FileName filename="Edge History.tsv" description="Edge History">
         <ArtifactName artifactname="TSK_WEB_HISTORY" comment="Edge History">
-            <AttributeName attributename="TSK_DATETIME_ACCESSED" columnName="Last Visit Time" required="yes"/>
+            <AttributeName attributename="TSK_DATETIME_START" columnName="Last Visit Time" required="yes"/>
             <AttributeName attributename="TSK_URL" columnName="URL" required="yes"/>
             <AttributeName attributename="TSK_TITLE" columnName="Title" required="yes"/>
             <AttributeName attributename="null" columnName="Visit Count" required="no"/>
@@ -259,7 +259,7 @@
     <FileName filename="Edge login data.tsv" description="Edge Login Data">
         <ArtifactName artifactname="TSK_SERVICE_ACCOUNT" comment="Edge Login">
             <AttributeName attributename="TSK_DATETIME_CREATED" columnName="Created Time" required="yes" />
-            <AttributeName attributename="TSK_USER_NAME" columnName="Username" required="yes" />
+            <AttributeName attributename="TSK_USER_ID" columnName="Username" required="yes" />
             <AttributeName attributename="TSK_PASSWORD" columnName="Password" required="yes" />
             <AttributeName attributename="TSK_URL" columnName="Origin URL" required="no" />
             <AttributeName attributename="null" columnName="Blacklisted by User" required="no" />
diff --git a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ileap-artifact-attribute-reference.xml b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ileap-artifact-attribute-reference.xml
index c0c1b43985..430668a60a 100644
--- a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ileap-artifact-attribute-reference.xml
+++ b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ileap-artifact-attribute-reference.xml
@@ -31,8 +31,8 @@
         <FileName filename="Account Data.tsv" description="Account Data">
             <ArtifactName artifactname="TSK_ACCOUNT" comment="Account Data">
                 <AttributeName attributename="TSK_DATETIME" columnName="Timestamp" required="yes" />
-                <AttributeName attributename="TSK_PROG_NAME" columnName="Account Desc." required="yes" />
-                <AttributeName attributename="TSK_USER_NAME" columnName="Username" required="yes" />
+                <AttributeName attributename="TSK_ACCOUNT_TYPE" columnName="Account Desc." required="yes" />
+                <AttributeName attributename="TSK_ID" columnName="Username" required="yes" />
                 <AttributeName attributename="null" columnName="Description" required="no" />
                 <AttributeName attributename="TSK_PATH" columnName="Identifier" required="yes" />
                 <AttributeName attributename="null" columnName="Bundle ID" required="no" />
@@ -68,7 +68,7 @@
         <FileName filename="Bluetooth paired.tsv" description="Bluetooth Paired">
             <ArtifactName artifactname="TSK_BLUETOOTH_PAIRING" comment="Bluetooth Paired">
                 <AttributeName attributename="TSK_DEVICE_ID" columnName="UUID" required="yes" />
-                <AttributeName attributename="TSK_NAME" columnName="Name" required="yes" />
+                <AttributeName attributename="TSK_DEVICE_NAME" columnName="Name" required="yes" />
                 <AttributeName attributename="null" columnName="Name Origin" required="no" />
                 <AttributeName attributename="null" columnName="Address" required="no" />
                 <AttributeName attributename="null" columnName="Resolved Address" required="no" />			

From e8a90ce757d052c8590b31d3ab66bea9357ab2be Mon Sep 17 00:00:00 2001
From: Greg DiCristofaro <gregd@basistech.com>
Date: Tue, 19 Jan 2021 10:10:09 -0500
Subject: [PATCH 2/4] reconcile xml

---
 .../leappanalyzers/aleap-artifact-attribute-reference.xml   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/aleap-artifact-attribute-reference.xml b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/aleap-artifact-attribute-reference.xml
index 87bbb3e93a..0d26ab9bc4 100644
--- a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/aleap-artifact-attribute-reference.xml
+++ b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/aleap-artifact-attribute-reference.xml
@@ -78,7 +78,7 @@
 
         <FileName filename="Browser History.tsv" description="Browser History">
             <ArtifactName artifactname="TSK_WEB_HISTORY" comment="Browser History">
-                <AttributeName attributename="TSK_DATETIME_START" columnName="Last Visit Time" required="yes"/>
+                <AttributeName attributename="TSK_DATETIME_ACCESSED" columnName="Last Visit Time" required="yes"/>
                 <AttributeName attributename="TSK_URL" columnName="URL" required="yes"/>
                 <AttributeName attributename="TSK_TITLE" columnName="Title" required="yes"/>
                 <AttributeName attributename="null" columnName="Visit Count" required="no"/>
@@ -167,7 +167,7 @@
             <AttributeName attributename="TSK_DOMAIN" columnName="Host" required="yes" />
             <AttributeName attributename="TSK_NAME" columnName="Name" required="yes" />
             <AttributeName attributename="TSK_VALUE" columnName="Value" required="yes" />
-            <AttributeName attributename="TSK_DATETIME_START" columnName="Created Date" required="yes" />
+            <AttributeName attributename="TSK_DATETIME_CREATED" columnName="Created Date" required="yes" />
             <AttributeName attributename="TSK_DATETIME_END" columnName="Expiration Date" required="yes" />
             <AttributeName attributename="TSK_PATH" columnName="Path" required="yes" />
         </ArtifactName>
@@ -248,7 +248,7 @@
 
     <FileName filename="Edge History.tsv" description="Edge History">
         <ArtifactName artifactname="TSK_WEB_HISTORY" comment="Edge History">
-            <AttributeName attributename="TSK_DATETIME_START" columnName="Last Visit Time" required="yes"/>
+            <AttributeName attributename="TSK_DATETIME_ACCESSED" columnName="Last Visit Time" required="yes"/>
             <AttributeName attributename="TSK_URL" columnName="URL" required="yes"/>
             <AttributeName attributename="TSK_TITLE" columnName="Title" required="yes"/>
             <AttributeName attributename="null" columnName="Visit Count" required="no"/>

From 17168870e0d8d8a9bb07f1f295dc584a694fd76d Mon Sep 17 00:00:00 2001
From: Greg DiCristofaro <gregd@basistech.com>
Date: Tue, 19 Jan 2021 11:37:42 -0500
Subject: [PATCH 3/4] cookie update

---
 .../leappanalyzers/aleap-artifact-attribute-reference.xml     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/aleap-artifact-attribute-reference.xml b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/aleap-artifact-attribute-reference.xml
index 0d26ab9bc4..d39075fdb9 100644
--- a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/aleap-artifact-attribute-reference.xml
+++ b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/aleap-artifact-attribute-reference.xml
@@ -163,7 +163,7 @@
 
     <FileName filename="Chrome cookies.tsv" description="Chrome Cookies">
         <ArtifactName artifactname="TSK_WEB_COOKIE" comment="Chrome Cookies">
-            <AttributeName attributename="TSK_DATETIME_ACCESSED" columnName="Last Access Date" required="yes" />
+            <AttributeName attributename="TSK_DATETIME_START" columnName="Last Access Date" required="yes" />
             <AttributeName attributename="TSK_DOMAIN" columnName="Host" required="yes" />
             <AttributeName attributename="TSK_NAME" columnName="Name" required="yes" />
             <AttributeName attributename="TSK_VALUE" columnName="Value" required="yes" />
@@ -236,7 +236,7 @@
 
     <FileName filename="Edge cookies.tsv" description="Edge Cookies">
         <ArtifactName artifactname="TSK_WEB_COOKIE" comment="Edge Cookies">
-            <AttributeName attributename="TSK_DATETIME_ACCESSED" columnName="Last Access Date" required="yes" />
+            <AttributeName attributename="TSK_DATETIME_START" columnName="Last Access Date" required="yes" />
             <AttributeName attributename="TSK_DOMAIN" columnName="Host" required="yes" />
             <AttributeName attributename="TSK_NAME" columnName="Name" required="yes" />
             <AttributeName attributename="TSK_VALUE" columnName="Value" required="yes" />

From 0091af92a2c6f2edb923b8a3ce7b918bde843be1 Mon Sep 17 00:00:00 2001
From: Greg DiCristofaro <gregd@basistech.com>
Date: Thu, 21 Jan 2021 19:54:27 -0500
Subject: [PATCH 4/4] commented out tsk_account and changed column

---
 .../leappanalyzers/ileap-artifact-attribute-reference.xml   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ileap-artifact-attribute-reference.xml b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ileap-artifact-attribute-reference.xml
index 430668a60a..5799161685 100644
--- a/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ileap-artifact-attribute-reference.xml
+++ b/Core/src/org/sleuthkit/autopsy/modules/leappanalyzers/ileap-artifact-attribute-reference.xml
@@ -28,7 +28,7 @@
     -->
     <iLeap_Files_To_Process>
 
-        <FileName filename="Account Data.tsv" description="Account Data">
+        <!-- <FileName filename="Account Data.tsv" description="Account Data">
             <ArtifactName artifactname="TSK_ACCOUNT" comment="Account Data">
                 <AttributeName attributename="TSK_DATETIME" columnName="Timestamp" required="yes" />
                 <AttributeName attributename="TSK_ACCOUNT_TYPE" columnName="Account Desc." required="yes" />
@@ -37,7 +37,7 @@
                 <AttributeName attributename="TSK_PATH" columnName="Identifier" required="yes" />
                 <AttributeName attributename="null" columnName="Bundle ID" required="no" />
             </ArtifactName>
-        </FileName>
+        </FileName> -->
 
         <FileName filename="Application State.tsv" description="Application State">
             <ArtifactName artifactname="TSK_INSTALLED_PROG" comment="Application State">
@@ -143,7 +143,7 @@
                 <AttributeName attributename="null" columnName="Start" required="no" />
                 <AttributeName attributename="null" columnName="End" required="no" />
                 <AttributeName attributename="null" columnName="ZSTREAMNAME" required="no" />
-                <AttributeName attributename="TSK_PROG_NAME" columnName="ZVALUESTRING" required="no" />
+                <AttributeName attributename="TSK_PROG_NAME" columnName="Value String" required="no" />
                 <AttributeName attributename="null" columnName="Activity Type" required="no" />
                 <AttributeName attributename="null" columnName="Title" required="no" />
                 <AttributeName attributename="null" columnName="Expiration Date" required="no" />