mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-12 16:06:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #5195 from raman-bt/5492-refactor-appdbparserhelper

Browse Source 
5492: Refactor AppDBParserHelper
This commit is contained in:
Richard Cordovano 2019-09-18 16:39:34 -04:00 committed by GitHub
commit df8fa03ed3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 12 additions and 1330 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1321
Core/src/org/sleuthkit/autopsy/coreutils/AppDBParserHelper.java
View File

File diff suppressed because it is too large Load Diff

21
InternalPythonModules/android/imo.py
View File

@ -32,9 +32,7 @@ from org.sleuthkit.autopsy.casemodule import Case
from org.sleuthkit.autopsy.coreutils import Logger from org.sleuthkit.autopsy.coreutils import Logger
from org.sleuthkit.autopsy.coreutils import MessageNotifyUtil from org.sleuthkit.autopsy.coreutils import MessageNotifyUtil
from org.sleuthkit.autopsy.coreutils import AppSQLiteDB from org.sleuthkit.autopsy.coreutils import AppSQLiteDB
from org.sleuthkit.autopsy.coreutils import AppDBParserHelper
from org.sleuthkit.autopsy.coreutils.AppDBParserHelper import MessageReadStatusEnum
from org.sleuthkit.autopsy.coreutils.AppDBParserHelper import CommunicationDirection
from org.sleuthkit.autopsy.datamodel import ContentUtils from org.sleuthkit.autopsy.datamodel import ContentUtils
from org.sleuthkit.autopsy.ingest import IngestJobContext from org.sleuthkit.autopsy.ingest import IngestJobContext
from org.sleuthkit.datamodel import AbstractFile from org.sleuthkit.datamodel import AbstractFile
@ -42,7 +40,11 @@ from org.sleuthkit.datamodel import BlackboardArtifact
from org.sleuthkit.datamodel import BlackboardAttribute from org.sleuthkit.datamodel import BlackboardAttribute
from org.sleuthkit.datamodel import Content from org.sleuthkit.datamodel import Content
from org.sleuthkit.datamodel import TskCoreException from org.sleuthkit.datamodel import TskCoreException
from org.sleuthkit.datamodel.Blackboard import BlackboardException
from org.sleuthkit.datamodel import Account from org.sleuthkit.datamodel import Account
from org.sleuthkit.datamodel.blackboardutils import CommunicationArtifactsHelper
from org.sleuthkit.datamodel.blackboardutils.CommunicationArtifactsHelper import MessageReadStatus
from org.sleuthkit.datamodel.blackboardutils.CommunicationArtifactsHelper import CommunicationDirection
import traceback import traceback
import general import general
@ -76,7 +78,8 @@ class IMOAnalyzer(general.AndroidComponentAnalyzer):
friendsDbs = AppSQLiteDB.findAppDatabases(dataSource, "imofriends.db", True, "com.imo.android.imous") friendsDbs = AppSQLiteDB.findAppDatabases(dataSource, "imofriends.db", True, "com.imo.android.imous")
for friendsDb in friendsDbs: for friendsDb in friendsDbs:
try: try:
friendsDBHelper = AppDBParserHelper("IMO Parser", friendsDb.getDBFile(), friendsDBHelper = CommunicationArtifactsHelper(Case.getCurrentCase().getSleuthkitCase(),
"IMO Parser", friendsDb.getDBFile(),
Account.Type.IMO, Account.Type.IMO, selfAccountAddress ) Account.Type.IMO, Account.Type.IMO, selfAccountAddress )
contactsResultSet = friendsDb.runQuery("SELECT buid, name FROM friends") contactsResultSet = friendsDb.runQuery("SELECT buid, name FROM friends")
if contactsResultSet is not None: if contactsResultSet is not None:
@ -108,11 +111,11 @@ class IMOAnalyzer(general.AndroidComponentAnalyzer):
message_read = messagesResultSet.getInt("message_read") message_read = messagesResultSet.getInt("message_read")
if (message_read == 1): if (message_read == 1):
msgReadStatus = MessageReadStatusEnum.READ msgReadStatus = MessageReadStatus.READ
elif (message_read == 0): elif (message_read == 0):
msgReadStatus = MessageReadStatusEnum.UNREAD msgReadStatus = MessageReadStatus.UNREAD
else: else:
msgReadStatus = MessageReadStatusEnum.UNKNOWN msgReadStatus = MessageReadStatus.UNKNOWN
timeStamp = messagesResultSet.getLong("timestamp") / 1000000000 timeStamp = messagesResultSet.getLong("timestamp") / 1000000000
@ -134,8 +137,8 @@ class IMOAnalyzer(general.AndroidComponentAnalyzer):
except SQLException as ex: except SQLException as ex:
self._logger.log(Level.WARNING, "Error processing query result for IMO friends", ex) self._logger.log(Level.WARNING, "Error processing query result for IMO friends", ex)
except TskCoreException as ex: except (TskCoreException, BlackboardException) as ex:
self._logger.log(Level.WARNING, "Failed to create AppDBParserHelper for adding artifacts.", ex) self._logger.log(Level.WARNING, "Failed to message artifacts.", ex)
finally: finally:
friendsDb.close() friendsDb.close()