Esempio n. 1
0
class com_android_vending(IApp):
    name = "com.android.vending"
    cname = "Android Vending"
    databases = {
        "suggestions.db": [
            KnownTable("suggestions", None, {"date": ConvertUtils.JsToUnix},
                       {"date": DataTypes.DATE})
        ],
        "localappstate.db": [
            KnownTable(
                "appstate", None, {
                    "first_download_ms": ConvertUtils.JsToUnix,
                    "delivery_data_timestamp_ms": ConvertUtils.JsToUnix,
                    "last_update_timestamp_ms": ConvertUtils.JsToUnix
                }, {
                    "first_download_ms": DataTypes.DATE,
                    "delivery_data_timestamp_ms": DataTypes.DATE,
                    "last_update_timestamp_ms": DataTypes.DATE
                }),
        ],
        "package_verification.db": [
            KnownTable("verification_cache", None,
                       {"cache_fingerprint": ConvertUtils.JsToUnix},
                       {"cache_fingerprint": DataTypes.DATE})
        ],
    }

    def __init__(self):
        self.known = True
Esempio n. 2
0
class com_viber_voip(IApp):
    name = "com.viber.voip"
    cname = "Android Viber Voip"
    databases = {
        "webviewCookiesChromium.db": [
            KnownTable(
                "cookies", None, {
                    "creation_utc": ConvertUtils.WebkitToUnix,
                    "expires_utc": ConvertUtils.WebkitToUnix,
                    "last_access_utc": ConvertUtils.WebkitToUnix
                }, {
                    "creation_utc": DataTypes.DATE,
                    "expires_utc": DataTypes.DATE,
                    "last_access_utc": DataTypes.DATE
                })
        ],
        "viber_messages": [
            KnownTable(
                "conversations", None, {
                    "smart_event_date": ConvertUtils.JsToUnix,
                    "date": ConvertUtils.JsToUnix
                }, {
                    "smart_event_date": DataTypes.DATE,
                    "date": DataTypes.DATE
                }),
            KnownTable("messages", None, {
                "date": ConvertUtils.JsToUnix,
                "date_real": ConvertUtils.JsToUnix
            }, {
                "date": DataTypes.DATE,
                "date_real": DataTypes.DATE
            }),
            KnownTable("messages_calls", None, {"date": ConvertUtils.JsToUnix},
                       {"date": DataTypes.DATE}),
            KnownTable("purchase", None,
                       {"purchase_time": ConvertUtils.JsToUnix},
                       {"purchase_time": DataTypes.DATE})
        ],
        "viber_data": [
            KnownTable("blockednumbers", None,
                       {"blocked_date": ConvertUtils.JsToUnix},
                       {"blocked_date": DataTypes.DATE}),
            KnownTable("calls", None, {"date": ConvertUtils.JsToUnix}, {
                "date": DataTypes.DATE,
            }),
            KnownTable(
                "phonebookcontact", None, {
                    "recently_joined_date": ConvertUtils.JsToUnix,
                    "joined_date": ConvertUtils.JsToUnix
                }, {
                    "recently_joined_date": DataTypes.DATE,
                    "joined_date": DataTypes.DATE
                })
        ],
    }

    def __init__(self):
        self.known = True
Esempio n. 3
0
class com_google_android_gm(IApp):
    name = "com.google.android.gm"
    cname = "Google Gmail"
    databases = {
        re.compile("mailstore\.[^@]+@[^@]+\.[^@]+\.db"): [
            KnownTable("conversation_labels", None, {
                "date": ConvertUtils.JsToUnix,
            }, {
                "date": DataTypes.DATE,
            }),
            KnownTable("conversations_to_fetch", None,
                       {"nextAttemptDateM": ConvertUtils.JsToUnix},
                       {"nextAttemptDateM": DataTypes.DATE}),
            KnownTable(
                "labels", None, {
                    "lastTouched": ConvertUtils.JsToUnix,
                    "lastMessageTimestamp": ConvertUtils.JsToUnix
                }, {
                    "lastTouched": DataTypes.DATE,
                    "lastMessageTimestamp": DataTypes.DATE
                }),
            KnownTable(
                "messages", None, {
                    "dateSentMs": ConvertUtils.JsToUnix,
                    "dateReceivedMs": ConvertUtils.JsToUnix
                }, {
                    "dateSentMs": DataTypes.DATE,
                    "dateReceivedMs": DataTypes.DATE
                }),
            KnownTable("operations", None,
                       {"nextTimeToAttempt": ConvertUtils.JsToUnix},
                       {"nextTimeToAttempt": DataTypes.DATE}),
        ],
        "webview.db": [
            KnownTable(
                "formdata", """
                    SELECT 
                        formdata._id, 
                        urlid, 
                        formurl.url, 
                        value 
                    FROM formdata 
                    INNER JOIN formurl on formdata.urlid = formurl._id""")
        ],
        "webviewCookiesChromium.db": [
            KnownTable(
                "cookies", None, {
                    "creation_utc": ConvertUtils.WebkitToUnix,
                    "expires_utc": ConvertUtils.WebkitToUnix,
                    "last_access_utc": ConvertUtils.WebkitToUnix
                }, {
                    "creation_utc": DataTypes.DATE,
                    "expires_utc": DataTypes.DATE,
                    "last_access_utc": DataTypes.DATE
                })
        ],
    }

    def __init__(self):
        self.known = True
class com_google_android_gallery3d(IApp):
    name = "com.google.android.gallery3d"
    cname = "Google android Gallery3d"
    databases = {
        "picasa.db": [
            KnownTable(
                "albums", None, {
                    "date_updated": ConvertUtils.JsToUnix,
                    "date_published": ConvertUtils.JsToUnix,
                    "date_edited": ConvertUtils.JsToUnix
                }, {
                    "date_updated": DataTypes.DATE,
                    "date_published": DataTypes.DATE,
                    "date_edited": DataTypes.DATE
                }),
            KnownTable(
                "photos", None, {
                    "date_edited": ConvertUtils.JsToUnix,
                    "date_updated": ConvertUtils.JsToUnix,
                    "date_taken": ConvertUtils.JsToUnix,
                    "date_published": ConvertUtils.JsToUnix
                }, {
                    "date_edited": DataTypes.DATE,
                    "date_updated": DataTypes.DATE,
                    "date_taken": DataTypes.DATE,
                    "date_published": DataTypes.DATE
                }),
        ],
        "picasa.upload.db": [
            KnownTable(
                "upload_records", None, {
                    "uploaded_time": ConvertUtils.JsToUnix,
                    "timestamp": ConvertUtils.UnixTimestamp
                }, {
                    "uploaded_time": DataTypes.DATE,
                    "timestamp": DataTypes.DATE
                }),
            KnownTable("upload_tasks", None,
                       {"uploaded_time": ConvertUtils.JsToUnix},
                       {"uploaded_time": DataTypes.DATE})
        ],
    }

    def __init__(self):
        self.known = True
Esempio n. 5
0
class com_linkedin_android(IApp):
    name = "com.linkedin.android"
    cname = "LinkedIn"
    databases = { 
         "linkedin.db": [ 
                KnownTable("messages", None, 
                    {"timestamp":ConvertUtils.JsToUnix}, 
                    {"timestamp":DataTypes.DATE}),
            ],
            "webviewCookiesChromium.db": [         
                KnownTable("cookies", None, 
                    {"creation_utc":ConvertUtils.WebkitToUnix,
                     "expires_utc":ConvertUtils.WebkitToUnix,
                     "last_access_utc":ConvertUtils.WebkitToUnix},
                    {"creation_utc":DataTypes.DATE, 
                     "expires_utc":DataTypes.DATE, 
                     "last_access_utc":DataTypes.DATE})
            ],
            "webviewCookiesChromiumPrivate.db": [         
                KnownTable("cookies", None, 
                    {"creation_utc":ConvertUtils.WebkitToUnix,
                     "expires_utc":ConvertUtils.WebkitToUnix,
                     "last_access_utc":ConvertUtils.WebkitToUnix},
                    {"creation_utc":DataTypes.DATE, 
                     "expires_utc":DataTypes.DATE, 
                     "last_access_utc":DataTypes.DATE})
            ],
            "webview.db": [
                KnownTable("formdata", 
                    """
                    SELECT 
                        formdata._id, 
                        urlid, 
                        formurl.url, 
                        value 
                    FROM formdata 
                    INNER JOIN formurl on formdata.urlid = formurl._id""")
            ]
            
    }

    def __init__(self):
        self.known = True
Esempio n. 6
0
class com_whatsapp(IApp):
    name = "com.whatsapp"
    cname = "Android WhatsApp"
    databases = {
        "wa.db": [
            KnownTable(
                "wa_contacts", None, {
                    "status_timestamp": ConvertUtils.JsToUnix,
                    "photo_id_timestamp": ConvertUtils.JsToUnix
                }, {
                    "status_timestamp": DataTypes.DATE,
                    "photo_id_timestamp": DataTypes.DATE
                })
        ],
        "msgstore.db": [
            KnownTable(
                "chat_list", None, {
                    "creation": ConvertUtils.JsToUnix,
                    "sort_timestamp": ConvertUtils.JsToUnix
                }, {
                    "creation": DataTypes.DATE,
                    "sort_timestamp": DataTypes.DATE
                }),
            KnownTable(
                "messages", None, {
                    "timestamp": ConvertUtils.JsToUnix,
                    "received_timestamp": ConvertUtils.JsToUnix,
                    "send_timestamp": ConvertUtils.JsToUnix,
                    "receipt_server_timestamp": ConvertUtils.JsToUnix,
                    "receipt_device_timestamp": ConvertUtils.JsToUnix
                }, {
                    "timestamp": DataTypes.DATE,
                    "received_timestamp": DataTypes.DATE,
                    "send_timestamp": DataTypes.DATE,
                    "receipt_server_timestamp": DataTypes.DATE,
                    "receipt_device_timestamp": DataTypes.DATE
                }),
        ],
    }

    def __init__(self):
        self.known = True
Esempio n. 7
0
class com_google_android_gsf(IApp):
    name = "com.google.android.gsf"
    cname = "Google Services Framework"
    databases = {
        "subscribedfeeds.db": [
            KnownTable("_sync_state", None, None, {"data": DataTypes.DATA}),
        ]
    }

    def __init__(self):
        self.known = True
Esempio n. 8
0
class com_android_settings(IApp):
    name = "com.android.settings"
    cname = "Android Settings"
    databases = {
        "superuser.sqlite": [
            KnownTable("log", None, {"date": ConvertUtils.UnixTimestamp},
                       {"date": DataTypes.DATE})
        ],
    }

    def __init__(self):
        self.known = True
Esempio n. 9
0
class com_android_deskclock(IApp):
    name = "com.android.deskclock"
    cname = "Android deskclock"
    databases = {
        "alarms.db": [
            KnownTable("alarms", None, {"alarmtime": ConvertUtils.JsToUnix},
                       {"alarmtime": DataTypes.DATE})
        ]
    }

    def __init__(self):
        self.known = True
Esempio n. 10
0
class com_android_email(IApp):
    name = "com.android.email"
    cname = "Android Email"
    databases = {
        "EmailProviderBackup.db": [
            KnownTable("Mailbox", None,
                {"syncTime":ConvertUtils.JsToUnix,
                 "lastTouchedTime":ConvertUtils.JsToUnix},
                {"syncTime":DataTypes.DATE, "lastTouchedTime":DataTypes.DATE}),
            KnownTable("Message", None,
                {"syncServerTimeStamp":ConvertUtils.UnixTimestamp,
                 "timeStamp":ConvertUtils.UnixTimestamp},
                {"syncServerTimeStamp": DataTypes.DATE, 
                 "timeStamp": DataTypes.DATE}),
            KnownTable("Message_Deletes", None,
                {"syncServerTimeStamp":ConvertUtils.UnixTimestamp,
                 "timeStamp":ConvertUtils.UnixTimestamp},
                {"syncServerTimeStamp":DataTypes.DATE, 
                 "timeStamp":DataTypes.DATE}),
            KnownTable("Message_Updates", None,
                {"syncServerTimeStamp":ConvertUtils.UnixTimestamp,
                 "timeStamp":ConvertUtils.UnixTimestamp},
                {"syncServerTimeStamp":DataTypes.DATE, 
                 "timeStamp":DataTypes.DATE}),
        ],
        "EmailProvider.db": [
            KnownTable("Mailbox", None,
                {"syncTime":ConvertUtils.JsToUnix,
                 "lastTouchedTime":ConvertUtils.JsToUnix},
                {"syncTime":DataTypes.DATE, "lastTouchedTime":DataTypes.DATE}),
            KnownTable("Message", None,
                {"syncServerTimeStamp":ConvertUtils.UnixTimestamp,
                 "timeStamp":ConvertUtils.UnixTimestamp},
                {"syncServerTimeStamp": DataTypes.DATE, 
                 "timeStamp": DataTypes.DATE}),
            KnownTable("Message_Deletes", None,
                {"syncServerTimeStamp":ConvertUtils.UnixTimestamp,
                 "timeStamp":ConvertUtils.UnixTimestamp},
                {"syncServerTimeStamp":DataTypes.DATE, 
                 "timeStamp":DataTypes.DATE}),
            KnownTable("Message_Updates", None,
                {"syncServerTimeStamp":ConvertUtils.UnixTimestamp,
                 "timeStamp":ConvertUtils.UnixTimestamp},
                {"syncServerTimeStamp":DataTypes.DATE, 
                 "timeStamp":DataTypes.DATE}),
        ],
    }

    def __init__(self):
        self.known = True
Esempio n. 11
0
class com_android_providers_calendar(IApp):
    name = "com.android.providers.calendar"
    cname = "Calendar Provider"
    databases = {
        "calendar.db": [
            KnownTable("_sync_state", None, None, {"data": DataTypes.DATA}),
            KnownTable(
                "Events", None, {
                    "dtend": ConvertUtils.JsToUnix,
                    "lastDate": ConvertUtils.JsToUnix,
                    "dtstart": ConvertUtils.JsToUnix
                }, {
                    "dtend": DataTypes.DATE,
                    "lastDate": DataTypes.DATE,
                    "dtstart": DataTypes.DATE
                }),
            KnownTable("Instances", None, {
                "begin": ConvertUtils.JsToUnix,
                "end": ConvertUtils.JsToUnix
            }, {
                "begin": DataTypes.DATE,
                "end": DataTypes.DATE
            }),
            KnownTable(
                "view_events", None, {
                    "lastDate": ConvertUtils.JsToUnix,
                    "dtend": ConvertUtils.JsToUnix,
                    "dtstart": ConvertUtils.JsToUnix,
                    "dtend": ConvertUtils.JsToUnix
                }, {
                    "lastDate": DataTypes.DATE,
                    "dtend": DataTypes.DATE,
                    "dtstart": DataTypes.DATE,
                    "dtend": DataTypes.DATE
                })
        ]
    }

    def __init__(self):
        self.known = True
class com_android_providers_telephony(IApp):
    name = "com.android.providers.telephony"
    cname = "Android Providers Telephony"
    databases = {
        "mmssms.db": [
            KnownTable("pdu", None, 
                {"date":ConvertUtils.UnixTimestamp, 
                 "date_sent":ConvertUtils.UnixTimestamp }, 
                {"date":DataTypes.DATE, "date_sent":DataTypes.DATE }),
            KnownTable("pending_msgs", None,
                {"due_time":ConvertUtils.UnixTimestamp,
                 "last_try":ConvertUtils.UnixTimestamp },
                {"due_time": DataTypes.DATE,
                 "last_try":DataTypes.DATE }),
            KnownTable("rate", None,
                {"sent_time":ConvertUtils.UnixTimestamp },
                {"sent_time": DataTypes.DATE }),
            KnownTable("raw", None,
                {"date":ConvertUtils.UnixTimestamp },
                {"date": DataTypes.DATE }),
            KnownTable("sms", None,
                {"date":ConvertUtils.JsToUnix, 
                 "date_sent":ConvertUtils.JsToUnix },
                {"date": DataTypes.DATE,"date_sent":DataTypes.DATE }),
            KnownTable("threads", None, 
                    {"date":ConvertUtils.JsToUnix },
                    {"date": DataTypes.DATE })
        ],
  }

    def __init__(self):
        self.known = True
class com_android_inputmethod_latin(IApp):
    name = "com.android.inputmethod.latin"
    cname = "Android Inputmethod"
    databases = { 
         "pendingUpdates": [ 
                KnownTable("pendingupdates", None, 
                    {"date":ConvertUtils.UnixTimestamp }, 
                    {"date":DataTypes.DATE })
            ],
  }

    def __init__(self):
        self.known = True
Esempio n. 14
0
class com_andrew_apollo(IApp):
    name = "com.andrew.apollo"
    cname = "Andrew Apollo"
    databases = {
        "albumhistory.db": [
            KnownTable("albumhistory", None,
                       {"timeplayed": ConvertUtils.JsToUnix},
                       {"timeplayed": DataTypes.DATE}),
        ]
    }

    def __init__(self):
        self.known = True
Esempio n. 15
0
class com_opera_browser(IApp):
    name = "com.opera.browser"
    cname = "Android Opera Browser"
    databases = { 
         re.compile(".*\.localstore"): [ 
                KnownTable("cookies", None, 
                    {"creation_utc":ConvertUtils.WebkitToUnix,
		     "expires_utc":ConvertUtils.WebkitToUnix, 
		     "last_access_utc":ConvertUtils.WebkitToUnix }, 
                    {"creation_utc":DataTypes.DATE, 
		     "expires_utc":DataTypes.DATE, 
		     "last_access_utc":DataTypes.DATE })
            ],
  }

    def __init__(self):
        self.known = True
Esempio n. 16
0
class com_android_browser(IApp):
    name = "com.android.browser"
    cname = "Android Browser"
    databases = {
        "browser2.db": [
            KnownTable("history", None, {"date": ConvertUtils.JsToUnix},
                       {"date": DataTypes.DATE}),
            KnownTable(
                "bookmarks", None, {
                    "created": ConvertUtils.JsToUnix,
                    "modified": ConvertUtils.JsToUnix
                }, {
                    "created": DataTypes.DATE,
                    "modified": DataTypes.DATE
                }),
            KnownTable("searches", None, {"date": ConvertUtils.JsToUnix},
                       {"date": DataTypes.DATE}),
            KnownTable("_sync_state", None, None, {"data": DataTypes.DATA})
        ],
        "webviewCookiesChromium.db": [
            KnownTable(
                "cookies", None, {
                    "creation_utc": ConvertUtils.WebkitToUnix,
                    "expires_utc": ConvertUtils.WebkitToUnix,
                    "last_access_utc": ConvertUtils.WebkitToUnix
                }, {
                    "creation_utc": DataTypes.DATE,
                    "expires_utc": DataTypes.DATE,
                    "last_access_utc": DataTypes.DATE
                })
        ],
        "webview.db": [
            KnownTable(
                "formdata", """
                    SELECT 
                        formdata._id, 
                        urlid, 
                        formurl.url, 
                        value 
                    FROM formdata 
                    INNER JOIN formurl on formdata.urlid = formurl._id""")
        ]
    }

    def __init__(self):
        self.known = True
class com_android_providers_contacts(IApp):
    name = "com.android.providers.contacts"
    cname = "Contacts Provider"
    databases = {
        "contacts2.db": [
            KnownTable("_sync_state", None, None, {"data": DataTypes.DATA}),
            KnownTable("data", None, None, {"data15": DataTypes.DATA}),
            KnownTable(
                "contacts",
                None,
                {
                    "contact_last_updated_timestamp":
                    ConvertUtils.JsToUnix,  #18
                    "last_time_contacted": ConvertUtils.JsToUnix
                },  #15
                {
                    "contact_last_updated_timestamp": DataTypes.DATE,
                    "last_time_contacted": DataTypes.DATE
                }),
            KnownTable(
                "deleted_contacts",
                None,  #18
                {"contact_deleted_timestamp": ConvertUtils.JsToUnix},
                {"contact_deleted_timestamp": DataTypes.DATE}),
            KnownTable(
                "raw_contacts",
                None,
                {"last_time_contacted": ConvertUtils.JsToUnix},  #15 
                {"last_time_contacted": DataTypes.DATE}),
            KnownTable("calls", None, {"date": ConvertUtils.JsToUnix},
                       {"date": DataTypes.DATE}),
            KnownTable("data_usage_stat", None,
                       {"last_time_used": ConvertUtils.JsToUnix},
                       {"last_time_contacted": DataTypes.DATE}),
            KnownTable("view_raw_contacts", None,
                       {"last_time_contacted": ConvertUtils.JsToUnix},
                       {"last_time_contacted": DataTypes.DATE}),
            KnownTable("view_contacts", None,
                       {"last_time_contacted": ConvertUtils.JsToUnix},
                       {"last_time_contacted": DataTypes.DATE}),
            KnownTable(
                "view_entities", None,
                {"contact_last_updated_timestamp": ConvertUtils.JsToUnix},
                {"contact_last_updated_timestamp": DataTypes.DATE}),
            KnownTable("view_data_usage_stat", None,
                       {"last_time_used": ConvertUtils.JsToUnix},
                       {"last_time_used": DataTypes.DATE}),
            KnownTable("view_v1_people", None,
                       {"last_time_contacted": ConvertUtils.JsToUnix},
                       {"last_time_contacted": DataTypes.DATE}),
            KnownTable("view_v1_contact_methods", None,
                       {"last_time_contacted": ConvertUtils.JsToUnix},
                       {"last_time_contacted": DataTypes.DATE}),
            KnownTable("view_v1_phones", None,
                       {"last_time_contacted": ConvertUtils.JsToUnix},
                       {"last_time_contacted": DataTypes.DATE})
        ],
        "profile.db": [
            KnownTable("_sync_state", None, None, {"data": DataTypes.DATA}),
            KnownTable("data", None, None, {"data15": DataTypes.DATA}),
            KnownTable(
                "contacts",
                None,
                {
                    "contact_last_updated_timestamp":
                    ConvertUtils.JsToUnix,  #18
                    "last_time_contacted": ConvertUtils.JsToUnix
                },  #15
                {
                    "contact_last_updated_timestamp": DataTypes.DATE,
                    "last_time_contacted": DataTypes.DATE
                }),
            KnownTable(
                "deleted_contacts",
                None,  #18
                {"contact_deleted_timestamp": ConvertUtils.JsToUnix},
                {"contact_deleted_timestamp": DataTypes.DATE}),
            KnownTable(
                "raw_contacts",
                None,
                {"last_time_contacted": ConvertUtils.JsToUnix},  #15 
                {"last_time_contacted": DataTypes.DATE}),
            KnownTable("calls", None, {"date": ConvertUtils.JsToUnix},
                       {"date": DataTypes.DATE}),
            KnownTable("data_usage_stat", None,
                       {"last_time_used": ConvertUtils.JsToUnix},
                       {"last_time_contacted": DataTypes.DATE}),
            KnownTable("view_raw_contacts", None,
                       {"last_time_contacted": ConvertUtils.JsToUnix},
                       {"last_time_contacted": DataTypes.DATE}),
            KnownTable("view_contacts", None,
                       {"last_time_contacted": ConvertUtils.JsToUnix},
                       {"last_time_contacted": DataTypes.DATE}),
            KnownTable(
                "view_entities", None,
                {"contact_last_updated_timestamp": ConvertUtils.JsToUnix},
                {"contact_last_updated_timestamp": DataTypes.DATE}),
            KnownTable("view_data_usage_stat", None,
                       {"last_time_used": ConvertUtils.JsToUnix},
                       {"last_time_used": DataTypes.DATE}),
            KnownTable("view_v1_people", None,
                       {"last_time_contacted": ConvertUtils.JsToUnix},
                       {"last_time_contacted": DataTypes.DATE}),
            KnownTable("view_v1_contact_methods", None,
                       {"last_time_contacted": ConvertUtils.JsToUnix},
                       {"last_time_contacted": DataTypes.DATE}),
            KnownTable("view_v1_phones", None,
                       {"last_time_contacted": ConvertUtils.JsToUnix},
                       {"last_time_contacted": DataTypes.DATE})
        ]
    }

    def __init__(self):
        self.known = True
Esempio n. 18
0
class org_mozilla_firefox(IApp):
    name = "org.mozilla.firefox"
    cname = "Android mozillafirefox Browser"
    databases = { 
         "signons.sqlite": [ 
                KnownTable("moz_deleted_logins", None, 
                    {"timeDeleted":ConvertUtils.JsToUnix }, 
                    {"timeDeleted":DataTypes.DATE }),
                KnownTable("moz_logins", None, 
                    {"timeCreated":ConvertUtils.JsToUnix, 
		     "timeLastUsed":ConvertUtils.JsToUnix,
		     "timePasswordChanged":ConvertUtils.JsToUnix },
                    {"timeCreated": DataTypes.DATE, 
		     "timeLastUsed":DataTypes.DATE,
		     "timePasswordChanged":DataTypes.DATE }),
            ],
            "downloads.sqlite": [         
                KnownTable("moz_downloads", None, 
                    {"startTime":ConvertUtils.JsToUnix,"endTime":ConvertUtils.JsToUnix },
                    {"endTime":DataTypes.DATE, "endTime":DataTypes.DATE })
            ],
            "browser.db": [         
                KnownTable("bookmarks", None, 
                    {"created":ConvertUtils.JsToUnix, "modified":ConvertUtils.JsToUnix, "deleted":ConvertUtils.JsToUnix },
                    {"created":DataTypes.DATE, "modified":DataTypes.DATE, "deleted":DataTypes.DATE }),
		KnownTable("favicons", None, 
                    {"created":ConvertUtils.JsToUnix, "modified":ConvertUtils.JsToUnix },
                    {"created":DataTypes.DATE, "modified":DataTypes.DATE }),
		KnownTable("history", None, 
                    {"date":ConvertUtils.JsToUnix, "created":ConvertUtils.JsToUnix, "modified":ConvertUtils.JsToUnix,"deleted":ConvertUtils.JsToUnix },
                    {"date":DataTypes.DATE, "created":DataTypes.DATE, "modified":DataTypes.DATE, "deleted":DataTypes.DATE }),
		KnownTable("reading_list", None, 
                    {"read":ConvertUtils.JsToUnix, "deleted":ConvertUtils.JsToUnix, "modified":ConvertUtils.JsToUnix,"created":ConvertUtils.JsToUnix },
                    {"read":DataTypes.DATE, "deleted":DataTypes.DATE, "modified":DataTypes.DATE, "created":DataTypes.DATE })
            ],
            "health.db": [         
                KnownTable("android_metadata", None, 
                    {"platformVersion":ConvertUtils.JsToUnix, "platformBuildID":ConvertUtils.JsToUnix },
                    {"platformVersion":DataTypes.DATE, "platformBuildID":DataTypes.DATE }),
		KnownTable("environments", None, 
                    {"profileCreation":ConvertUtils.JsToUnix, "appBuildID":ConvertUtils.JsToUnix, "platformBuildID":ConvertUtils.JsToUnix },
                    {"profileCreation":DataTypes.DATE, "appBuildID":DataTypes.DATE, "platformBuildID":DataTypes.DATE }),
		KnownTable("events_integer", None, 
                    {"date":ConvertUtils.JsToUnix },
                    {"date":DataTypes.DATE  })
            ],
            "cookies.sqlite": [         
                KnownTable("moz_cookies", None, 
                    {"expiry":ConvertUtils.JsToUnix,"lastAccessed":ConvertUtils.JsToUnix, "creationTime":ConvertUtils.JsToUnix },
                    {"expiry":DataTypes.DATE, "lastAccessed":DataTypes.DATE,"creationTime":DataTypes.DATE })
            ],
	    "permissions.sqlite": [         
                KnownTable("moz_hosts", None, 
                    {"expireTime":ConvertUtils.JsToUnix },
                    {"expireTime":DataTypes.DATE })
            ],
  }

    def __init__(self):
        self.known = True
Esempio n. 19
0
class com_android_providers_media(IApp):
    name = "com.android.providers.media"
    cname = "Android Providers Media"
    databases = {
        "external.db": [
            KnownTable(
                "files", None, {
                    "date_added": ConvertUtils.UnixTimestamp,
                    "date_modified": ConvertUtils.UnixTimestamp,
                    "datetaken": ConvertUtils.JsToUnix,
                    "duration": ConvertUtils.UnixTimestamp
                }, {
                    "date_added": DataTypes.DATE,
                    "date_modified": DataTypes.DATE,
                    "datetaken": DataTypes.DATE,
                    "duration": DataTypes.DATE
                }),
            KnownTable(
                "searchhelpertitle", None, {
                    "date_added": ConvertUtils.UnixTimestamp,
                    "date_modified": ConvertUtils.UnixTimestamp
                }, {
                    "date_added": DataTypes.DATE,
                    "date_modified": DataTypes.DATE
                }),
            KnownTable(
                "audio_meta", None, {
                    "date_added": ConvertUtils.UnixTimestamp,
                    "date_modified": ConvertUtils.UnixTimestamp
                }, {
                    "date_added": DataTypes.DATE,
                    "date_modified": DataTypes.DATE
                }),
            KnownTable(
                "audio", None, {
                    "date_added": ConvertUtils.UnixTimestamp,
                    "date_modified": ConvertUtils.UnixTimestamp
                }, {
                    "date_added": DataTypes.DATE,
                    "date_modified": DataTypes.DATE
                }),
            KnownTable(
                "images", None, {
                    "date_added": ConvertUtils.UnixTimestamp,
                    "date_modified": ConvertUtils.UnixTimestamp,
                    "datetaken": ConvertUtils.JsToUnix
                }, {
                    "date_added": DataTypes.DATE,
                    "date_modified": DataTypes.DATE,
                    "datetaken": DataTypes.DATE
                }),
            KnownTable(
                "video", None, {
                    "date_added": ConvertUtils.UnixTimestamp,
                    "date_modified": ConvertUtils.UnixTimestamp,
                    "datetaken": ConvertUtils.JsToUnix
                }, {
                    "date_added": DataTypes.DATE,
                    "date_modified": DataTypes.DATE,
                    "datetaken": DataTypes.DATE
                }),
            #KnownTable("log", None, #XXX need to fix this somehow
            #   {"time":ConvertUtils.UnixTimestamp },
            #   {"time": DataTypes.DATE })
        ],
        "internal.db": [
            KnownTable(
                "searchhelpertitle", None, {
                    "date_added": ConvertUtils.UnixTimestamp,
                    "date_modified": ConvertUtils.UnixTimestamp
                }, {
                    "date_added": DataTypes.DATE,
                    "date_modified": DataTypes.DATE
                }),
            KnownTable(
                "audio_meta", None, {
                    "date_added": ConvertUtils.UnixTimestamp,
                    "date_modified": ConvertUtils.UnixTimestamp
                }, {
                    "date_added": DataTypes.DATE,
                    "date_modified": DataTypes.DATE
                }),
            KnownTable(
                "audio", None, {
                    "date_added": ConvertUtils.UnixTimestamp,
                    "date_modified": ConvertUtils.UnixTimestamp
                }, {
                    "date_added": DataTypes.DATE,
                    "date_modified": DataTypes.DATE
                }),
            KnownTable(
                "images", None, {
                    "date_added": ConvertUtils.UnixTimestamp,
                    "date_modified": ConvertUtils.UnixTimestamp,
                    "datetaken": ConvertUtils.JsToUnix
                }, {
                    "date_added": DataTypes.DATE,
                    "date_modified": DataTypes.DATE,
                    "datetaken": DataTypes.DATE
                }),
            KnownTable(
                "video", None, {
                    "date_added": ConvertUtils.UnixTimestamp,
                    "date_modified": ConvertUtils.UnixTimestamp,
                    "datetaken": ConvertUtils.JsToUnix
                }, {
                    "date_added": DataTypes.DATE,
                    "date_modified": DataTypes.DATE,
                    "datetaken": DataTypes.DATE
                }),
            KnownTable(
                "files", None, {
                    "date_added": ConvertUtils.UnixTimestamp,
                    "date_modified": ConvertUtils.UnixTimestamp,
                    "datetaken": ConvertUtils.JsToUnix,
                    "duration": ConvertUtils.UnixTimestamp
                }, {
                    "date_added": DataTypes.DATE,
                    "date_modified": DataTypes.DATE,
                    "datetaken": DataTypes.DATE,
                    "duration": DataTypes.DATE
                }),
        ],
    }

    def __init__(self):
        self.known = True
Esempio n. 20
0
class com_facebook_orca(IApp):
    name = "com.facebook.orca"
    cname = "Android Facebook Orca"
    databases = {
        "newsfeed_db": [
            KnownTable("home_stories", None,
                       {"fetched_at": ConvertUtils.JsToUnix},
                       {"fetched_at": DataTypes.DATE}),
            KnownTable("feed_unit_impression", None,
                       {"timestamp": ConvertUtils.JsToUnix},
                       {"timestamp": DataTypes.DATE}),
        ],
        "offline_mode_db": [
            KnownTable(
                "pending_request", None, {
                    "created_time": ConvertUtils.JsToUnix,
                    "expire_duration_ms": ConvertUtils.JsToUnix
                }, {
                    "created_time": DataTypes.DATE,
                    "expire_duration_ms": DataTypes.DATE
                })
        ],
        "contacts_db2": [
            KnownTable("contacts", None,
                       {"added_time_ms": ConvertUtils.JsToUnix},
                       {"added_time_ms": DataTypes.DATE}),
            KnownTable("contact_summaries", None,
                       {"added_time_ms": ConvertUtils.JsToUnix},
                       {"added_time_ms": DataTypes.DATE}),
        ],
        "videocache_db": [
            KnownTable(
                "videoads", None, {
                    "time_start": ConvertUtils.JsToUnix,
                    "time_end": ConvertUtils.JsToUnix,
                    "fetch_time": ConvertUtils.JsToUnix
                }, {
                    "time_start": DataTypes.DATE,
                    "time_end": DataTypes.DATE,
                    "fetch_time": DataTypes.DATE
                })
        ],
        "threads_db2": [
            KnownTable("folder_counts", None,
                       {"last_seen_time": ConvertUtils.JsToUnix},
                       {"last_seen_time": DataTypes.DATE}),
            KnownTable("folders", None,
                       {"timestamp_ms": ConvertUtils.JsToUnix},
                       {"timestamp_ms": DataTypes.DATE}),
            KnownTable(
                "threads", None, {
                    "timestamp_ms": ConvertUtils.JsToUnix,
                    "last_fetch_time_ms": ConvertUtils.JsToUnix
                }, {
                    "timestamp_ms": DataTypes.DATE,
                    "last_fetch_time_ms": DataTypes.DATE
                }),
            KnownTable(
                "messages", None, {
                    "timestamp_ms": ConvertUtils.JsToUnix,
                    "timestamp_send_ms": ConvertUtils.JsToUnix
                }, {
                    "timestamp_ms": DataTypes.DATE,
                    "timestamp_send_ms": DataTypes.DATE
                }),
        ],
        "analytics_db2": [
            KnownTable("events", None, {"timestamp": ConvertUtils.JsToUnix},
                       {"timestamp": DataTypes.DATE})
        ],
        "mds_cache_db": [
            KnownTable("cache", None, {"timestamp": ConvertUtils.JsToUnix},
                       {"timestamp": DataTypes.DATE})
        ],
        "timeline_prefetch_db": [
            KnownTable(
                "prefetch_candidates", None, {
                    "last_generate_timestamp": ConvertUtils.JsToUnix,
                    "last_fetch_timestamp": ConvertUtils.JsToUnix
                }, {
                    "last_generate_timestamp": DataTypes.DATE,
                    "last_fetch_timestamp": DataTypes.DATE
                })
        ],
        "timeline_db": [
            KnownTable("cache", None, {"timestamp": ConvertUtils.JsToUnix},
                       {"timestamp": DataTypes.DATE})
        ],
        "graphql_cache": [
            KnownTable("queries", None, {"timestamp": ConvertUtils.JsToUnix},
                       {"timestamp": DataTypes.DATE})
        ],
        "sticker_packs": [
            KnownTable("sticker_packs", None,
                       {"updated_time": ConvertUtils.UnixTimestamp},
                       {"updated_time": DataTypes.DATE})
        ],
        "webviewCookiesChromium.db": [
            KnownTable(
                "cookies", None, {
                    "creation_utc": ConvertUtils.WebkitToUnix,
                    "expires_utc": ConvertUtils.WebkitToUnix,
                    "last_access_utc": ConvertUtils.WebkitToUnix
                }, {
                    "creation_utc": DataTypes.DATE,
                    "expires_utc": DataTypes.DATE,
                    "last_access_utc": DataTypes.DATE
                })
        ],
        "webviewCookiesChromiumPrivate.db": [
            KnownTable(
                "cookies", None, {
                    "creation_utc": ConvertUtils.WebkitToUnix,
                    "expires_utc": ConvertUtils.WebkitToUnix,
                    "last_access_utc": ConvertUtils.WebkitToUnix
                }, {
                    "creation_utc": DataTypes.DATE,
                    "expires_utc": DataTypes.DATE,
                    "last_access_utc": DataTypes.DATE
                })
        ],
    }

    def __init__(self):
        self.known = True
Esempio n. 21
0
class com_twitter_android(IApp):
    name = "com.twitter.android"
    cname = "Android Twitter"
    databases = {
        re.compile("\d+-\d+\.db"): [
            KnownTable(
                "active_tailfeather", None, {
                    "start_time": ConvertUtils.JsToUnix,
                    "end_time": ConvertUtils.JsToUnix
                }, {
                    "start_time": DataTypes.DATE,
                    "end_time": DataTypes.DATE
                }),
            KnownTable("activities", None,
                       {"created_at": ConvertUtils.JsToUnix},
                       {"created_at": DataTypes.DATE}),
            KnownTable("clusters", None,
                       {"cl_timestamp": ConvertUtils.JsToUnix},
                       {"cl_timestamp": DataTypes.DATE}),
            KnownTable("conversation_entries", None,
                       {"created": ConvertUtils.JsToUnix},
                       {"created": DataTypes.DATE}),
            KnownTable("conversation_participants", None,
                       {"join_time": ConvertUtils.JsToUnix},
                       {"join_time": DataTypes.DATE}),
            KnownTable("message_drafts", None,
                       {"created": ConvertUtils.JsToUnix},
                       {"created": DataTypes.DATE}),
            KnownTable("messages", None, {"created": ConvertUtils.JsToUnix},
                       {"created": DataTypes.DATE}),
            KnownTable("peeks", None, {"timestamp": ConvertUtils.JsToUnix},
                       {"timestamp": DataTypes.DATE}),
            KnownTable("places", None, {"updated_at": ConvertUtils.JsToUnix},
                       {"updated_at": DataTypes.DATE}),
            KnownTable("search_queries", None, {"time": ConvertUtils.JsToUnix},
                       {"time": DataTypes.DATE}),
            KnownTable("status_groups", None,
                       {"updated_at": ConvertUtils.JsToUnix},
                       {"updated_at": DataTypes.DATE}),
            KnownTable("statuses", None, {"created": ConvertUtils.JsToUnix},
                       {"created": DataTypes.DATE}),
            KnownTable("timeline", None, {"updated_at": ConvertUtils.JsToUnix},
                       {"updated_at": DataTypes.DATE}),
            KnownTable("topics", None,
                       {"ev_start_time": ConvertUtils.JsToUnix},
                       {"ev_start_time": DataTypes.DATE}),
            KnownTable(
                "users", None, {
                    "profile_created": ConvertUtils.JsToUnix,
                    "updated": ConvertUtils.JsToUnix
                }, {
                    "profile_created": DataTypes.DATE,
                    "updated": DataTypes.DATE
                })
        ],
        "webviewCookiesChromium.db": [
            KnownTable(
                "cookies", None, {
                    "creation_utc": ConvertUtils.WebkitToUnix,
                    "expires_utc": ConvertUtils.WebkitToUnix,
                    "last_access_utc": ConvertUtils.WebkitToUnix
                }, {
                    "creation_utc": DataTypes.DATE,
                    "expires_utc": DataTypes.DATE,
                    "last_access_utc": DataTypes.DATE
                })
        ],
        re.compile("\d+-drafts.db"): [
            KnownTable("drafts", None, {"updated_at": ConvertUtils.JsToUnix},
                       {"updated_at": DataTypes.DATE})
        ],
        "webviewCookiesChromiumPrivate.db": [
            KnownTable(
                "cookies", None, {
                    "creation_utc": ConvertUtils.WebkitToUnix,
                    "expires_utc": ConvertUtils.WebkitToUnix,
                    "last_access_utc": ConvertUtils.WebkitToUnix
                }, {
                    "creation_utc": DataTypes.DATE,
                    "expires_utc": DataTypes.DATE,
                    "last_access_utc": DataTypes.DATE
                }),
        ],
    }

    def __init__(self):
        self.known = True
Esempio n. 22
0
class com_android_chrome(IApp):
    name = "com.android.chrome"
    cname = "Android Chrome Browser"
    databases = {
        "History": [
            KnownTable(
                "downloads", None, {
                    "start_time": ConvertUtils.WebkitToUnix,
                    "end_time": ConvertUtils.WebkitToUnix
                }, {
                    "start_time": DataTypes.DATE,
                    "end_time": DataTypes.DATE
                }),
            KnownTable("segment_usage", None,
                       {"time_slot": ConvertUtils.WebkitToUnix},
                       {"time_slot": DataTypes.DATE}),
            KnownTable("urls", None,
                       {"last_visit_time": ConvertUtils.WebkitToUnix},
                       {"last_visit_time": DataTypes.DATE}),
            KnownTable("visits", None,
                       {"visit_time": ConvertUtils.WebkitToUnix},
                       {"visit_time": DataTypes.DATE})
        ],
        "Cookies": [
            KnownTable(
                "cookies", None, {
                    "creation_utc": ConvertUtils.WebkitToUnix,
                    "expires_utc": ConvertUtils.WebkitToUnix,
                    "last_access_utc": ConvertUtils.WebkitToUnix
                }, {
                    "creation_utc": DataTypes.DATE,
                    "expires_utc": DataTypes.DATE,
                    "last_access_utc": DataTypes.DATE
                })
        ],
        "Favicons": [
            KnownTable("favicon_bitmaps", None,
                       {"last_updated": ConvertUtils.WebkitToUnix},
                       {"last_updated": DataTypes.DATE})
        ],
        "Shortcuts": [
            KnownTable("omni_box_shortcuts", None,
                       {"last_access_time": ConvertUtils.WebkitToUnix},
                       {"last_access_time": DataTypes.DATE})
        ],
        "snapshots.db": [
            KnownTable("snapshots", None,
                       {"createTime": ConvertUtils.WebkitToUnix},
                       {"createTime": DataTypes.DATE})
        ],
        "Web Data": [
            KnownTable(
                "autofill", None, {
                    "date_created": ConvertUtils.WebkitToUnix,
                    "date_last_used": ConvertUtils.WebkitToUnix
                }, {
                    "date_created": DataTypes.DATE,
                    "date_last_used": DataTypes.DATE
                }),
            KnownTable("autofill_profiles", None,
                       {"date_modified": ConvertUtils.WebkitToUnix},
                       {"date_modified": DataTypes.DATE}),
            KnownTable("credit_cards", None,
                       {"date_modified": ConvertUtils.WebkitToUnix},
                       {"date_modified": DataTypes.DATE}),
            KnownTable(
                "keywords", None, {
                    "date_created": ConvertUtils.WebkitToUnix,
                    "last_modified": ConvertUtils.WebkitToUnix
                }, {
                    "date_created": DataTypes.DATE,
                    "last_modified": DataTypes.DATE
                }),
            KnownTable("web_intents_defaults", None,
                       {"user_date": ConvertUtils.WebkitToUnix},
                       {"user_date": DataTypes.DATE})
        ],
        "SyncData.sqlite3": [
            KnownTable(
                "deleted_metas", None, {
                    "mtime": ConvertUtils.JsToUnix,
                    "server_mtime": ConvertUtils.JsToUnix,
                    "ctime": ConvertUtils.JsToUnix,
                    "server_ctime": ConvertUtils.JsToUnix
                }, {
                    "mtime": DataTypes.DATE,
                    "server_mtime": DataTypes.DATE,
                    "ctime": DataTypes.DATE,
                    "server_ctime": DataTypes.DATE
                }),
            KnownTable(
                "metas", None, {
                    "mtime": ConvertUtils.JsToUnix,
                    "server_mtime": ConvertUtils.JsToUnix,
                    "ctime": ConvertUtils.JsToUnix,
                    "server_ctime": ConvertUtils.JsToUnix
                }, {
                    "mtime": DataTypes.DATE,
                    "server_mtime": DataTypes.DATE,
                    "ctime": DataTypes.DATE,
                    "server_ctime": DataTypes.DATE
                }),
            KnownTable(
                "share_info", None, {
                    "store_birthday": ConvertUtils.JsToUnix,
                    "db_create_time": ConvertUtils.WebkitToUnix
                }, {
                    "store_birthday": DataTypes.DATE,
                    "db_create_time": DataTypes.DATE
                })
        ],
        "Archived History": [
            KnownTable("urls", None,
                       {"last_visit_time": ConvertUtils.WebkitToUnix},
                       {"last_visit_time": DataTypes.DATE}),
            KnownTable("visits", None,
                       {"visit_time": ConvertUtils.WebkitToUnix},
                       {"visit_time": DataTypes.DATE})
        ],
        "Network Action Predictor": [
            KnownTable("logged_in_predictor", None,
                       {"time": ConvertUtils.WebkitToUnix},
                       {"time": DataTypes.DATE})
        ],
        "Origin Bound Certs": [
            KnownTable(
                "origin_bound_certs", None, {
                    "expiration_time": ConvertUtils.WebkitToUnix,
                    "creation_time": ConvertUtils.WebkitToUnix
                }, {
                    "expiration_time": DataTypes.DATE,
                    "creation_time": DataTypes.DATE
                })
        ],
        "snapshots.db": [
            KnownTable("snapshots", None,
                       {"createTime": ConvertUtils.WebkitToUnix},
                       {"createTime": DataTypes.DATE})
        ],
    }

    def __init__(self):
        self.known = True