ALeapp task by patrickdalla · Pull Request #2095 · sepinf-inc/IPED

patrickdalla · 2024-02-22T19:45:07Z

Hi @lfcnassif , I decided to create this pull request, but marked it as draft, as I am leaving on vacation

that does informs the non existence of registered artifacts in script, meaning it won't be treated as a plugin. Other exceptions are rethrown.

static variable, multiple plugins concurrent execution were scrambling device info between their specific file Output. As the necessary result is the merging of those all info, the concurrency is not a problem, being it done at the end of all individual plugins processing (4th queue).

allowing replacement of methods to redirect HTML table lines insertion to IPED classes, as long as logfunc and logdevinfo calls.

ALeapp, making it possible to override python class. It skips any keyword arguments passed to any class method.

report file, this means that this file is a genereted detailed content for this item. So, it is exported as the content of the artifact item.

exported file, saves it as a link and return, avoiding duplicate metadatas.

was leading to exception as fileLoader does not work with these files inside zip. So, for now, as ALeapp will be deployed unzipped, ignores the override of any files that are inside ZIP libs.

children), as the Leapp Report.

with double backslash, as it backslash is a escape char in python.

ilapfuncs that depends of this name.

not changed.

integrated with IPED timeline.

names.

referenced media file in html report. Inside IPED, this can just add a link to the media (TO BE IMPLEMENTED).

debugging compatibility).

method declaration. If so, method name is not declared, so a direct access to this PyCallable should be done.

entries.

…tion:" for chats and "Communication:" for messages

patrickdalla · 2026-07-23T12:24:11Z

BTW, it would be nice to show also some credits to the project somewhere. Maybe we could prepare a simple HTML that would be shown in "preview" tab informing that the resulting subitens were produced by the execution of the ALeapp, with the name of the project and a link to its github page.

That would be great. Where should we set it? In thought in case data item.

I think in the Aleapp report tree root node. Maybe specific plugin credit could be also rendered in the plugin tree node (create author field in PluginSpec).

patrickdalla · 2026-07-23T13:24:50Z

I noticed some file references weren't added in Linked_ITEMS.

For example:

Offline pages plugin does not reference the existent "mhtml" in "aleapp:File Path" metadata with starting path "/data/user/0" that should map to extraction path "samsung/EXTRACTION_FFS.zip/data/data" in IPED result tree.
Myfiles Download History. It has 2 metadata separated, 1 is the path starting with "/storage/emulated/0" that should map to "samsung/EXTRACTION_FFS.zip/data/media/0" and the other is the file name.
Myfiles Recent Files. I has one metadata "aleapp:Filed ID" with full path to the file starting with "/storage/emulated/0" that should map to "samsung/EXTRACTION_FFS.zip/data/media/0".

I let a case running this night, but IPED was compiled with ec4902d, so maybe you have already fixed.

Maybe this mapping identification and correction can be done the line 311 of LavaInsertSqliteDataInterceptor

patrickdalla · 2026-07-23T18:18:38Z

Some items categorizations I did in the processClassificationAndMappings aren't being done anymore. The logic may have changed but the items are still extracted but not categorized.

    private void processClassificationAndMappings(IItem e) {
        try {
            Metadata m = e.getMetadata();
            String pluginName = m.get(ALEAPP_PLUGIN);

            if (pluginName.startsWith("FCMQueueMessages")) {
                e.setCategory("APP Notifications");
                return;
            }

            if (pluginName.equals("accounts_ce") || pluginName.equals("accounts_de")) {
                e.setCategory("User Accounts");
                return;
            }
            if (pluginName.equals("accounts_ce_authtokens")) {
                e.setCategory("Passwords");
                return;
            }
            if (pluginName.equals("siminfo")) {
                e.setCategory("SIM Data");
                return;
            }
            if (pluginName.equals("Cello")) {
                e.setCategory("GDrive File Entries");
                return;
            }
            if (pluginName.equals("roles")) {
                e.setCategory("AppRoles");
                return;
            }
            if (pluginName.equals("frosting")) {
                e.setCategory("Update information");
                return;
            }
            if (pluginName.equals("smsmms")) {
                String type = m.get("ALEAPP:Type");
                String thisPhone = "This phone";
                if (type != null && type.equals("Received")) {
                    m.add("Communitactions:TO", thisPhone);
                    m.add("Communitactions:FROM", m.get("ALEAPP:Address"));
                } else {
                    if (type != null && type.equals("Sent")) {
                        m.add("Communitactions:TO", m.get("ALEAPP:Address"));
                        m.add("Communitactions:FROM", thisPhone);
                    }
                    // other types are DRAFT, OUTBOX, QUEUED and Failed
                }
            }
            String mime = e.getMediaType().toString();
            if (pluginName.equals("gmailEmails")) {
                if (mime.contains("appemails")) {
                    e.setCategory("Emails");
                    m.add("Communitactions:TO", m.get("ALEAPP:To"));
                    String from = m.get("ALEAPP:FROM");
                    if (from == null || from.isBlank()) {
                        from = m.get("ALEAPP:Reply To");
                    }
                    m.add("Communitactions:FROM", from);
                }
                return;
            }
            if (pluginName.equals("FacebookMessenger")) {
                if (mime.contains("contacts")) {
                    e.setCategory("Contacts");
                }
                if (mime.contains("userid")) {
                    e.setCategory("User Accounts");
                }
                if (mime.contains("chats")) {
                    e.setCategory("Instant Messages");
                    var linked = m.get("linkedItems");
                    var start = linked.indexOf("msys_database_") + 14;
                    var uid = linked.substring(start, linked.indexOf("\"", start));
                    if (m.get("ALEAPP:Sender ID").equals(uid)) {
                        m.add(ExtraProperties.COMMUNICATION_FROM, uid);
                        m.add(ExtraProperties.COMMUNICATION_TO, m.get("ALEAPP:Thread Key"));
                    } else {
                        m.add(ExtraProperties.COMMUNICATION_FROM, m.get("ALEAPP:Sender ID"));
                        m.add(ExtraProperties.COMMUNICATION_TO, uid);
                    }
                }
                return;
            }
            if (pluginName.equals("settingsSecure")) {
                String name = m.get("ALEAPP:Name");
                String value = m.get("ALEAPP:Value");
                if ((name == "bluetooth_address") || (name == "bluetooth_name")) {
                    e.setCategory("Bluetooth Devices");
                }
                return;
            }
            if (pluginName.equals("chromeCookies")) {
                e.setCategory("Cookies");
            }
        } catch (Exception ex) {
            logger.debug("Exception while trying to classify evidence:" + e.getName());
            ex.printStackTrace();
        }
    }

Add a FILE_PATH fallback in the LEAPP integration: untyped columns whose values are device file paths (File Path, Local Path To Media, *Path, etc.) are resolved to the matching case item and added as linked items. Path resolution handles Android storage symlinks and is deferred to AleappTask.process() so the per-row searches spread across the worker pool. Cookie/URL and other non-file "Path" columns are excluded per plugin.

aberenguel · 2026-07-23T23:41:24Z

I noticed some file references weren't added in Linked_ITEMS.

For example:

Offline pages plugin does not reference the existent "mhtml" in "aleapp:File Path" metadata with starting path "/data/user/0" that should map to extraction path "samsung/EXTRACTION_FFS.zip/data/data" in IPED result tree.

Myfiles Download History. It has 2 metadata separated, 1 is the path starting with "/storage/emulated/0" that should map to "samsung/EXTRACTION_FFS.zip/data/media/0" and the other is the file name.

Myfiles Recent Files. I has one metadata "aleapp:Filed ID" with full path to the file starting with "/storage/emulated/0" that should map to "samsung/EXTRACTION_FFS.zip/data/media/0".

I let a case running this night, but IPED was compiled with ec4902d, so maybe you have already fixed.

Maybe this mapping identification and correction can be done the line 311 of LavaInsertSqliteDataInterceptor

Thanks, @patrickdalla, for alerting such fact! These columns are not mapped to files by ALEAPP. So I took the code you had implemented and added some other maps for symbolic links. The result is in commit 7b51954.

Move media-type derivation out of LavaInsertSqliteDataInterceptor into a dedicated AleappMediaTypeResolver, and make it the single classification point: plugin-specific rules emit stable subtypes (notification, account, email, siminfo, etc.) that map to categories via CategoriesConfig.json, instead of setting categories in code.

aberenguel · 2026-07-24T01:28:33Z

Some items categorizations I did in the processClassificationAndMappings aren't being done anymore. The logic may have changed but the items are still extracted but not categorized.

Great! A similar logic was applied in commit 91b493c that introduced the class AleappMediaTypeResolver.

patrickdalla · 2026-07-24T19:26:14Z

I am trying to process again the same case with last commit, but it freezes in LeapUtils findItemByPath method.

It seems that the plugin "Emulated Storage Metadata" returns some unexpected value that causes this method to freeze.

It calls findItemByPath with pathRoot="samsung" and pathValue="samsung", then called searchItemByPath freezes

patrickdalla · 2026-07-24T20:33:06Z

One thing i have noticed: the case I am processing is an UFDR.

The Aleapp report node is being created right at the root of the ufdr zip, but the extracted cell phone file system structure root is a subfolder of this zip/ufdr folder.
So the pathRoot is returning the ufdr root, not the real FFS root.

Have you tested UFDR processing? It seems the problem cause is in this report node positioning.

Another detail. I named as "samsung" the evidence when starting IPED using the -d parameter.

aberenguel · 2026-07-24T21:38:05Z

One thing i have noticed: the case I am processing is an UFDR.

The Aleapp report node is being created right at the root of the ufdr zip, but the extracted cell phone file system structure root is a subfolder of this zip/ufdr folder. So the pathRoot is returning the ufdr root, not the real FFS root.

Have you tested UFDR processing? It seems the problem cause is in this report node positioning.

Another detail. I named as "samsung" the evidence when starting IPED using the -d parameter.

I tested a case with Emulated Storage Metadata plugin directly on a folder and zip extractions. It worked without any issues. I'm getting to process the correpondent UFDR now.

patrickdalla · 2026-07-24T22:57:32Z

Right. UFDR processing was a request from @lfcnassif : #2095 (comment)

…inkedItems

aberenguel · 2026-07-24T23:24:55Z

@patrickdalla I've just fixed it.
Before the ALEAPP results were in evidence.ufdr/ALEAPP_Results.
Now it is in evidence.ufdr/EXTRACTION_FFS.zip/ALEAPP_Results.

Validates each extraction type in isSupportedAndroidExtraction: ufdr file systems must hold a "data"/"system" top level folder. Reuses LeappUtils.findItemByPath for the checks, now iterating the hits lazily.

patrickdalla · 2026-07-27T12:56:00Z

It worked.

Ignore linking to FFS file system root if a filepath to it is found as a referece in plugin entries. The linking process was slow, and irrelevant as it is easyly found. So I decided to simply ignore it.

patrickdalla · 2026-07-27T15:53:33Z

Hi @aberenguel. The code have passed all my previous test cases. I've made a little change to ignore linking to FFS root this info seems to be irrelevant (straightforward in fact) and was slow as the item search was returning to many entries.

aberenguel · 2026-07-28T03:16:10Z

Hi @aberenguel. The code have passed all my previous test cases. I've made a little change to ignore linking to FFS root this info seems to be irrelevant (straightforward in fact) and was slow as the item search was returning to many entries.

Good catch, @patrickdalla . I've just changed to compare the string with equals and to also trim the pathValue.

aberenguel · 2026-07-28T03:20:02Z

The property enableAleapp is being disabled only in profile triage. Should it be disabled in fastmode too?

patrickdalla added 30 commits October 6, 2023 14:49

Makes some internal functionality visible to Task implementations.

ae77041

'#43 Initial ALeapp/ILeapp integration classes.

8f325da

'#43 improves exception handling. Unique skipped exception is the one

cd8ede2

that does informs the non existence of registered artifacts in script, meaning it won't be treated as a plugin. Other exceptions are rethrown.

'#43 adds the device info to the 4th processing queue.

63d4b19

'#43 corrects loop on data fields

b2ff524

'#43 downloads ALEAPP into tools dir.

dfaf2bd

'#43 get ALeappPlugins from ALeappConfig.

aaf3064

'#43 implements Python hook to change ALeapp code before loading,

442cc73

allowing replacement of methods to redirect HTML table lines insertion to IPED classes, as long as logfunc and logdevinfo calls.

'#43 Repositions PythonHook class to iped-utils and adjust dependecies.

787c2a0

'#43 Implements method wrapsClass that inserts a decoupled Wrapper from

539f0bc

ALeapp, making it possible to override python class. It skips any keyword arguments passed to any class method.

'#43 If the artifact has a field that corresponds to a href to a temp

947fdb1

report file, this means that this file is a genereted detailed content for this item. So, it is exported as the content of the artifact item.

'#43 If the value of the html column is a path to the dump or to an

03af1ac

exported file, saves it as a link and return, avoiding duplicate metadatas.

'#43 Adds ALeapp device details html as sub type of text/html mimetype.

724850e

'#43 Removes dependency of aleapp from class PythonHook.

3dbd758

'#43 In the IPED embedded python some code were inside zip files. This

ce81e08

was leading to exception as fileLoader does not work with these files inside zip. So, for now, as ALeapp will be deployed unzipped, ignores the override of any files that are inside ZIP libs.

'#43 Removes redundant code.

ebbd15a

'#43 removes debugging error messages.

e0a0d64

'#43 Adds a distinct tree icon for report folders (decoded data that has

318fba3

children), as the Leapp Report.

'#43 Replaces backslash occurrences of path strings passed to python

fa1488c

with double backslash, as it backslash is a escape char in python.

'#43 Adjust temp report folder name, as there is a method inside

fefb2a7

ilapfuncs that depends of this name.

'#43 Makes aleappDir static as it is a config that is loaded once and is

c390424

not changed.

'#43 overrides timeline function to do nothing as the timeline will be

58218ec

integrated with IPED timeline.

'#43 Puts task report folder in upper tmp folder, to avoid too long path

e6af24f

names.

'#43 media_to_html override. ALeapp uses this method is used to show a

c9e9ea4

referenced media file in html report. Inside IPED, this can just add a link to the media (TO BE IMPLEMENTED).

'#43 adds suport for multiple parameter python function override.

6ad1a2e

'#43 Add support for folder class path search when debugging (Eclipse

5ead16f

debugging compatibility).

'#43 some plugins declares a lambda function directly on artifact parse

17eaec9

method declaration. If so, method name is not declared, so a direct access to this PyCallable should be done.

'#43 Implements a more detailed naming scheme for timestamp fields.

84883ab

'#43 uses package name to describe eventtype of FCMQueuedMessageDump

715d5d5

entries.

aberenguel added 2 commits July 23, 2026 00:33

#43: convert chat aleapp metadata to the ones prefixed with "Conversa…

4980b66

…tion:" for chats and "Communication:" for messages

#43: fix unit tests related to conversation items

1e22c70

patrickdalla closed this Jul 23, 2026

github-project-automation Bot moved this from In progress to Done in 4.3 Jul 23, 2026

patrickdalla reopened this Jul 23, 2026

github-project-automation Bot moved this from Done to In progress in 4.3 Jul 23, 2026

aberenguel added 2 commits July 23, 2026 16:24

Merge branch 'master' into ALeappTask

9629016

aberenguel added 2 commits July 24, 2026 20:15

#43: change extraction root detection for UFDR files and fix adding l…

67a437a

…inkedItems

#43: don't exclude "appicons" plugin since it supports lava

f20330c

#43: skip ALEAPP over non-android extractions, e.g. iOS inside an ufdr

b7ae853

Validates each extraction type in isSupportedAndroidExtraction: ufdr file systems must hold a "data"/"system" top level folder. Reuses LeappUtils.findItemByPath for the checks, now iterating the hits lazily.

'#2095

9e93606

Ignore linking to FFS file system root if a filepath to it is found as a referece in plugin entries. The linking process was slow, and irrelevant as it is easyly found. So I decided to simply ignore it.

patrickdalla requested review from aberenguel and marcosammoura July 27, 2026 15:53

#43: fix FFS root skip check: compare path with equals instead of ==

6d917f8

Uh oh!

Conversation

patrickdalla commented Feb 22, 2024

Uh oh!

patrickdalla commented Jul 23, 2026

Uh oh!

patrickdalla commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

patrickdalla commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

aberenguel commented Jul 23, 2026

Uh oh!

aberenguel commented Jul 24, 2026

Uh oh!

patrickdalla commented Jul 24, 2026

Uh oh!

patrickdalla commented Jul 24, 2026

Uh oh!

aberenguel commented Jul 24, 2026

Uh oh!

patrickdalla commented Jul 24, 2026

Uh oh!

aberenguel commented Jul 24, 2026

Uh oh!

patrickdalla commented Jul 27, 2026

Uh oh!

patrickdalla commented Jul 27, 2026

Uh oh!

aberenguel commented Jul 28, 2026

Uh oh!

aberenguel commented Jul 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

patrickdalla commented Jul 23, 2026 •

edited

Loading

patrickdalla commented Jul 23, 2026 •

edited

Loading