Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 6 additions & 5 deletions scripts/artifacts/FilesByGoogle.py
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@
# pylint: disable=W0613
__artifacts_v2__ = {
"fbg_master": {
"name": "Files By Google - Files Master",
Expand Down Expand Up @@ -31,7 +30,8 @@
from scripts.ilapfuncs import artifact_processor, open_sqlite_db_readonly, convert_ts_human_to_utc, convert_utc_human_to_timezone

@artifact_processor
def fbg_master(files_found, report_folder, seeker, wrap_text):
def fbg_master(context):
files_found = context.get_files_found()
data_list_master = []

for file_found in files_found:
Expand Down Expand Up @@ -79,14 +79,15 @@ def fbg_master(files_found, report_folder, seeker, wrap_text):
else:
last_mod_date = convert_utc_human_to_timezone(convert_ts_human_to_utc(last_mod_date),'UTC')

data_list_master.append((last_mod_date,row[1],row[2],row[3],row[4],row[5],row[6],row[7],row[8],row[9],row[10],file_found))
data_list_master.append((last_mod_date,row[1],row[2],row[3],row[4],row[5],row[6],row[7],row[8],row[9],row[10],context.get_relative_path(file_found)))
db.close()

data_headers = (('Date Modified','datetime'),'Root Path','Root Relative Path','File Name','Size','Mime Type','Media Type','URI','Hidden','Title','Parent Folder','Source File') # Don't remove the comma, that is required to make this a tuple as there is only 1 element
return data_headers, data_list_master, 'See source file(s) below'

@artifact_processor
def fbg_searchhistory(files_found, report_folder, seeker, wrap_text):
def fbg_searchhistory(context):
files_found = context.get_files_found()
data_list_search = []

for file_found in files_found:
Expand Down Expand Up @@ -115,7 +116,7 @@ def fbg_searchhistory(files_found, report_folder, seeker, wrap_text):
pass
else:
timestamp = convert_utc_human_to_timezone(convert_ts_human_to_utc(timestamp),'UTC')
data_list_search.append((timestamp,row[1],file_found))
data_list_search.append((timestamp,row[1],context.get_relative_path(file_found)))
db.close()

else:
Expand Down
8 changes: 4 additions & 4 deletions scripts/artifacts/appLockerfishingnet.py
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@
# pylint: disable=W0613
__artifacts_v2__ = {
"get_appLockerfishingnet": {
"name": "App Locker",
Expand Down Expand Up @@ -29,7 +28,8 @@


@artifact_processor
def get_appLockerfishingnet(files_found, report_folder, seeker, wrap_text):
def get_appLockerfishingnet(context):
files_found = context.get_files_found()
data_list = []
source_path = ''
for file_found in files_found:
Expand Down Expand Up @@ -63,7 +63,7 @@ def get_appLockerfishingnet(files_found, report_folder, seeker, wrap_text):
thumb = check_in_media(file_found, filename)
decrypted = 'False'

data_list.append((thumb, filename, decrypted, file_found))
data_list.append((thumb, filename, decrypted, context.get_relative_path(file_found)))

data_headers = (('Media', 'media'), 'Filename', 'Decrypted?', 'Full Path')
return data_headers, data_list, source_path
return data_headers, data_list, context.get_relative_path(source_path)
8 changes: 4 additions & 4 deletions scripts/artifacts/googleFitGMS.py
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@
# pylint: disable=W0611,W0613
__artifacts_v2__ = {
"googleFitGMS": {
"name": "Google Fit (GMS) - Activity Sessions",
Expand All @@ -15,10 +14,11 @@
}
}

from scripts.ilapfuncs import artifact_processor, get_file_path, get_sqlite_db_records
from scripts.ilapfuncs import artifact_processor, get_sqlite_db_records

@artifact_processor
def googleFitGMS(files_found, report_folder, seeker, wrap_text):
def googleFitGMS(context):
files_found = context.get_files_found()
data_list = []

for file_found in files_found:
Expand Down Expand Up @@ -46,7 +46,7 @@ def googleFitGMS(files_found, report_folder, seeker, wrap_text):
db_records = get_sqlite_db_records(file_found, query)

for record in db_records:
data_list.append((record[0],record[1],record[2],record[3],record[4],record[5],file_found))
data_list.append((record[0],record[1],record[2],record[3],record[4],record[5],context.get_relative_path(file_found)))

data_headers = (('Activity Start Time','datetime'),('Activity End Time','datetime'),'Contributing App','Activity Type','Activity Name','Activity Description','Source File')
return data_headers, data_list, 'See source file(s) below'
8 changes: 4 additions & 4 deletions scripts/artifacts/playgroundVault.py
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@
# pylint: disable=W0613
__artifacts_v2__ = {
"get_playgroundVault": {
"name": "Playground Vault",
Expand Down Expand Up @@ -55,7 +54,8 @@ def _find_key(files_found):


@artifact_processor
def get_playgroundVault(files_found, report_folder, seeker, wrap_text):
def get_playgroundVault(context):
files_found = context.get_files_found()
key = _find_key(files_found)
data_list = []
source_path = ''
Expand Down Expand Up @@ -90,7 +90,7 @@ def get_playgroundVault(files_found, report_folder, seeker, wrap_text):

match = re.search(r'(?:EIF|EVF)(\d+)', filename)
enctimestamp = _ms_to_utc(match.group(1)) if match else ''
data_list.append((thumb, filename, enctimestamp, file_found))
data_list.append((thumb, filename, enctimestamp, context.get_relative_path(file_found)))

data_headers = (('Media', 'media'), 'Filename', ('Encrypted On Timestamp', 'datetime'), 'Full Path')
return data_headers, data_list, source_path
return data_headers, data_list, context.get_relative_path(source_path)
Loading