feat: Samsung Secure Folder HistoryLog artifact

[abrignoni]

Summary

Adds a new LAVA artifact, Samsung Secure Folder - History Log (category Knox Secure Folder), that parses the Samsung Secure Folder HistoryLog database (com.samsung.knox.securefolder, Android user 150) and reconstructs folder move-in/move-out activity between the personal profile (user 0) and the Secure Folder.

This is a port of the forensic core of 4n6Wizard's Samsung Secure Folder History Log Parser. Full credit to 4n6Wizard for the original tool and parsing research.

For each event the artifact decodes:

• Direction — e.g. [0 -> 150] (move-in) / [150 -> 0] (move-out)
• Source app that initiated the transfer (Gallery, MyFiles, …)
• Requested vs. moved file counts (flags partial transfers)
• Source / transferred folder paths — extracted from the request, or derived from the transferred path using the source/destination profile IDs
• Timestamps and duration

Request and result records are paired into events using the upstream scoring logic; unpaired requests/results and non-conforming rows are reported with warnings rather than dropped.

What was ported vs. dropped

Ported: the message-decoding regexes, the request↔result pairing scorer, and source-path derivation.

Dropped (ALEAPP provides these): the standalone PyQt GUI, CSV/HTML writers, WAL/SHM consolidation, and the heuristic table/column auto-detection — the schema (HistoryLog(id, timestamp, tag, message)) is known, so the artifact queries it directly and gates on the HistoryLog table existing in each candidate DB.

Notes for review

• Timestamps are device-LOCAL and reported as recorded (no UTC conversion). Samsung stores them as naive local-time strings; converting would mislabel them.
• Path glob: */com.samsung.knox.securefolder/databases/*, gated on the HistoryLog table actually existing (won't false-fire). Worth confirming the on-disk DB filename against a real Secure Folder extraction.
• Scope: triage tool — live records only, no carving/deleted-record recovery. The HistoryLog records which folders and how many files moved, not individual file names.

Testing

• pylint scripts/artifacts/samsungSecureFolderHistoryLog.py --disable=C,R → 10.00/10.
• Ran the ported logic against the upstream project's build_fixture_db.py fixture → output reproduces the shipped Example_Report.csv byte-for-byte (all 8 events: paired, no-Total result, multi-path, both unpaired types, and the blank-timestamp sequence-paired case).
• PluginLoader loads the artifact without error (category Knox Secure Folder).