codex-admin/autopsy
1
0
Fork 0
mirror of https://github.com/elisspace/autopsy.git synced 2026-08-30 16:11:57 +00:00
Code Issues Releases Wiki Activity

Merge remote-tracking branch 'raman-bt/5394-dbparser-helper' into 5444-viber-database-parser

Browse Source
This commit is contained in:
U-BASIS\dsmyda
2019-09-11 15:23:27 -04:00
parent db467414ba 77ed043911
commit 2461cf580f
3 changed files with 389 additions and 227 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
InternalPythonModules/android/imo.py
View File

@@ -33,6 +33,8 @@ from org.sleuthkit.autopsy.coreutils import Logger
from org.sleuthkit.autopsy.coreutils import MessageNotifyUtil
from org.sleuthkit.autopsy.coreutils import AppSQLiteDB
from org.sleuthkit.autopsy.coreutils import AppDBParserHelper
from org.sleuthkit.autopsy.coreutils.AppDBParserHelper import MessageReadStatusEnum
from org.sleuthkit.autopsy.coreutils.AppDBParserHelper import CommunicationDirection
from org.sleuthkit.autopsy.datamodel import ContentUtils
from org.sleuthkit.autopsy.ingest import IngestJobContext
from org.sleuthkit.datamodel import AbstractFile
@@ -97,20 +99,20 @@ class IMOAnalyzer(general.AndroidComponentAnalyzer):
uniqueId = messagesResultSet.getString("buid")
if (messagesResultSet.getInt("message_type") == 1):
direction = "Incoming"
direction = CommunicationDirection.INCOMING
fromAddress = Account.Address(uniqueId, name)
else:
direction = "Outgoing"
direction = CommunicationDirection.OUTGOING
toAddress = Account.Address(uniqueId, name)
message_read = messagesResultSet.getInt("message_read")
if (message_read == 1):
msgReadStatus = AppDBParserHelper.MessageReadStatusEnum.READ
msgReadStatus = MessageReadStatusEnum.READ
elif (message_read == 0):
msgReadStatus = AppDBParserHelper.MessageReadStatusEnum.UNREAD
msgReadStatus = MessageReadStatusEnum.UNREAD
else:
msgReadStatus = AppDBParserHelper.MessageReadStatusEnum.UNKNOWN
msgReadStatus = MessageReadStatusEnum.UNKNOWN
timeStamp = messagesResultSet.getLong("timestamp") / 1000000000
@@ -129,9 +131,11 @@ class IMOAnalyzer(general.AndroidComponentAnalyzer):
# TBD: parse the imdata JSON structure to figure out if there is an attachment.
# If one exists, add the attachment as a derived file and a child of the message artifact.
except SQLException as ex:
self._logger.log(Level.SEVERE, "Error processing query result for IMO friends", ex)
self._logger.log(Level.SEVERE, "Error processing query result for IMO friends", ex)
except TskCoreException as ex:
self._logger.log(Level.SEVERE, "Failed to create AppDBParserHelper for adding artifacts.", ex)
finally:
friendsDb.close()