class com_android_vending(IApp):
name = "com.android.vending"
cname = "Android Vending"
databases = {
"suggestions.db": [
KnownTable("suggestions", None, {"date": ConvertUtils.JsToUnix},
{"date": DataTypes.DATE})
],
"localappstate.db": [
KnownTable(
"appstate", None, {
"first_download_ms": ConvertUtils.JsToUnix,
"delivery_data_timestamp_ms": ConvertUtils.JsToUnix,
"last_update_timestamp_ms": ConvertUtils.JsToUnix
}, {
"first_download_ms": DataTypes.DATE,
"delivery_data_timestamp_ms": DataTypes.DATE,
"last_update_timestamp_ms": DataTypes.DATE
}),
],
"package_verification.db": [
KnownTable("verification_cache", None,
{"cache_fingerprint": ConvertUtils.JsToUnix},
{"cache_fingerprint": DataTypes.DATE})
],
}
def __init__(self):
self.known = True
class com_viber_voip(IApp):
name = "com.viber.voip"
cname = "Android Viber Voip"
databases = {
"webviewCookiesChromium.db": [
KnownTable(
"cookies", None, {
"creation_utc": ConvertUtils.WebkitToUnix,
"expires_utc": ConvertUtils.WebkitToUnix,
"last_access_utc": ConvertUtils.WebkitToUnix
}, {
"creation_utc": DataTypes.DATE,
"expires_utc": DataTypes.DATE,
"last_access_utc": DataTypes.DATE
})
],
"viber_messages": [
KnownTable(
"conversations", None, {
"smart_event_date": ConvertUtils.JsToUnix,
"date": ConvertUtils.JsToUnix
}, {
"smart_event_date": DataTypes.DATE,
"date": DataTypes.DATE
}),
KnownTable("messages", None, {
"date": ConvertUtils.JsToUnix,
"date_real": ConvertUtils.JsToUnix
}, {
"date": DataTypes.DATE,
"date_real": DataTypes.DATE
}),
KnownTable("messages_calls", None, {"date": ConvertUtils.JsToUnix},
{"date": DataTypes.DATE}),
KnownTable("purchase", None,
{"purchase_time": ConvertUtils.JsToUnix},
{"purchase_time": DataTypes.DATE})
],
"viber_data": [
KnownTable("blockednumbers", None,
{"blocked_date": ConvertUtils.JsToUnix},
{"blocked_date": DataTypes.DATE}),
KnownTable("calls", None, {"date": ConvertUtils.JsToUnix}, {
"date": DataTypes.DATE,
}),
KnownTable(
"phonebookcontact", None, {
"recently_joined_date": ConvertUtils.JsToUnix,
"joined_date": ConvertUtils.JsToUnix
}, {
"recently_joined_date": DataTypes.DATE,
"joined_date": DataTypes.DATE
})
],
}
def __init__(self):
self.known = True
class com_google_android_gm(IApp):
name = "com.google.android.gm"
cname = "Google Gmail"
databases = {
re.compile("mailstore\.[^@]+@[^@]+\.[^@]+\.db"): [
KnownTable("conversation_labels", None, {
"date": ConvertUtils.JsToUnix,
}, {
"date": DataTypes.DATE,
}),
KnownTable("conversations_to_fetch", None,
{"nextAttemptDateM": ConvertUtils.JsToUnix},
{"nextAttemptDateM": DataTypes.DATE}),
KnownTable(
"labels", None, {
"lastTouched": ConvertUtils.JsToUnix,
"lastMessageTimestamp": ConvertUtils.JsToUnix
}, {
"lastTouched": DataTypes.DATE,
"lastMessageTimestamp": DataTypes.DATE
}),
KnownTable(
"messages", None, {
"dateSentMs": ConvertUtils.JsToUnix,
"dateReceivedMs": ConvertUtils.JsToUnix
}, {
"dateSentMs": DataTypes.DATE,
"dateReceivedMs": DataTypes.DATE
}),
KnownTable("operations", None,
{"nextTimeToAttempt": ConvertUtils.JsToUnix},
{"nextTimeToAttempt": DataTypes.DATE}),
],
"webview.db": [
KnownTable(
"formdata", """
SELECT
formdata._id,
urlid,
formurl.url,
value
FROM formdata
INNER JOIN formurl on formdata.urlid = formurl._id""")
],
"webviewCookiesChromium.db": [
KnownTable(
"cookies", None, {
"creation_utc": ConvertUtils.WebkitToUnix,
"expires_utc": ConvertUtils.WebkitToUnix,
"last_access_utc": ConvertUtils.WebkitToUnix
}, {
"creation_utc": DataTypes.DATE,
"expires_utc": DataTypes.DATE,
"last_access_utc": DataTypes.DATE
})
],
}
def __init__(self):
self.known = True
class com_google_android_gallery3d(IApp):
name = "com.google.android.gallery3d"
cname = "Google android Gallery3d"
databases = {
"picasa.db": [
KnownTable(
"albums", None, {
"date_updated": ConvertUtils.JsToUnix,
"date_published": ConvertUtils.JsToUnix,
"date_edited": ConvertUtils.JsToUnix
}, {
"date_updated": DataTypes.DATE,
"date_published": DataTypes.DATE,
"date_edited": DataTypes.DATE
}),
KnownTable(
"photos", None, {
"date_edited": ConvertUtils.JsToUnix,
"date_updated": ConvertUtils.JsToUnix,
"date_taken": ConvertUtils.JsToUnix,
"date_published": ConvertUtils.JsToUnix
}, {
"date_edited": DataTypes.DATE,
"date_updated": DataTypes.DATE,
"date_taken": DataTypes.DATE,
"date_published": DataTypes.DATE
}),
],
"picasa.upload.db": [
KnownTable(
"upload_records", None, {
"uploaded_time": ConvertUtils.JsToUnix,
"timestamp": ConvertUtils.UnixTimestamp
}, {
"uploaded_time": DataTypes.DATE,
"timestamp": DataTypes.DATE
}),
KnownTable("upload_tasks", None,
{"uploaded_time": ConvertUtils.JsToUnix},
{"uploaded_time": DataTypes.DATE})
],
}
def __init__(self):
self.known = True
class com_linkedin_android(IApp):
name = "com.linkedin.android"
cname = "LinkedIn"
databases = {
"linkedin.db": [
KnownTable("messages", None,
{"timestamp":ConvertUtils.JsToUnix},
{"timestamp":DataTypes.DATE}),
],
"webviewCookiesChromium.db": [
KnownTable("cookies", None,
{"creation_utc":ConvertUtils.WebkitToUnix,
"expires_utc":ConvertUtils.WebkitToUnix,
"last_access_utc":ConvertUtils.WebkitToUnix},
{"creation_utc":DataTypes.DATE,
"expires_utc":DataTypes.DATE,
"last_access_utc":DataTypes.DATE})
],
"webviewCookiesChromiumPrivate.db": [
KnownTable("cookies", None,
{"creation_utc":ConvertUtils.WebkitToUnix,
"expires_utc":ConvertUtils.WebkitToUnix,
"last_access_utc":ConvertUtils.WebkitToUnix},
{"creation_utc":DataTypes.DATE,
"expires_utc":DataTypes.DATE,
"last_access_utc":DataTypes.DATE})
],
"webview.db": [
KnownTable("formdata",
"""
SELECT
formdata._id,
urlid,
formurl.url,
value
FROM formdata
INNER JOIN formurl on formdata.urlid = formurl._id""")
]
}
def __init__(self):
self.known = True
class com_whatsapp(IApp):
name = "com.whatsapp"
cname = "Android WhatsApp"
databases = {
"wa.db": [
KnownTable(
"wa_contacts", None, {
"status_timestamp": ConvertUtils.JsToUnix,
"photo_id_timestamp": ConvertUtils.JsToUnix
}, {
"status_timestamp": DataTypes.DATE,
"photo_id_timestamp": DataTypes.DATE
})
],
"msgstore.db": [
KnownTable(
"chat_list", None, {
"creation": ConvertUtils.JsToUnix,
"sort_timestamp": ConvertUtils.JsToUnix
}, {
"creation": DataTypes.DATE,
"sort_timestamp": DataTypes.DATE
}),
KnownTable(
"messages", None, {
"timestamp": ConvertUtils.JsToUnix,
"received_timestamp": ConvertUtils.JsToUnix,
"send_timestamp": ConvertUtils.JsToUnix,
"receipt_server_timestamp": ConvertUtils.JsToUnix,
"receipt_device_timestamp": ConvertUtils.JsToUnix
}, {
"timestamp": DataTypes.DATE,
"received_timestamp": DataTypes.DATE,
"send_timestamp": DataTypes.DATE,
"receipt_server_timestamp": DataTypes.DATE,
"receipt_device_timestamp": DataTypes.DATE
}),
],
}
def __init__(self):
self.known = True
class com_google_android_gsf(IApp):
name = "com.google.android.gsf"
cname = "Google Services Framework"
databases = {
"subscribedfeeds.db": [
KnownTable("_sync_state", None, None, {"data": DataTypes.DATA}),
]
}
def __init__(self):
self.known = True
class com_android_settings(IApp):
name = "com.android.settings"
cname = "Android Settings"
databases = {
"superuser.sqlite": [
KnownTable("log", None, {"date": ConvertUtils.UnixTimestamp},
{"date": DataTypes.DATE})
],
}
def __init__(self):
self.known = True
class com_android_deskclock(IApp):
name = "com.android.deskclock"
cname = "Android deskclock"
databases = {
"alarms.db": [
KnownTable("alarms", None, {"alarmtime": ConvertUtils.JsToUnix},
{"alarmtime": DataTypes.DATE})
]
}
def __init__(self):
self.known = True
class com_android_email(IApp):
name = "com.android.email"
cname = "Android Email"
databases = {
"EmailProviderBackup.db": [
KnownTable("Mailbox", None,
{"syncTime":ConvertUtils.JsToUnix,
"lastTouchedTime":ConvertUtils.JsToUnix},
{"syncTime":DataTypes.DATE, "lastTouchedTime":DataTypes.DATE}),
KnownTable("Message", None,
{"syncServerTimeStamp":ConvertUtils.UnixTimestamp,
"timeStamp":ConvertUtils.UnixTimestamp},
{"syncServerTimeStamp": DataTypes.DATE,
"timeStamp": DataTypes.DATE}),
KnownTable("Message_Deletes", None,
{"syncServerTimeStamp":ConvertUtils.UnixTimestamp,
"timeStamp":ConvertUtils.UnixTimestamp},
{"syncServerTimeStamp":DataTypes.DATE,
"timeStamp":DataTypes.DATE}),
KnownTable("Message_Updates", None,
{"syncServerTimeStamp":ConvertUtils.UnixTimestamp,
"timeStamp":ConvertUtils.UnixTimestamp},
{"syncServerTimeStamp":DataTypes.DATE,
"timeStamp":DataTypes.DATE}),
],
"EmailProvider.db": [
KnownTable("Mailbox", None,
{"syncTime":ConvertUtils.JsToUnix,
"lastTouchedTime":ConvertUtils.JsToUnix},
{"syncTime":DataTypes.DATE, "lastTouchedTime":DataTypes.DATE}),
KnownTable("Message", None,
{"syncServerTimeStamp":ConvertUtils.UnixTimestamp,
"timeStamp":ConvertUtils.UnixTimestamp},
{"syncServerTimeStamp": DataTypes.DATE,
"timeStamp": DataTypes.DATE}),
KnownTable("Message_Deletes", None,
{"syncServerTimeStamp":ConvertUtils.UnixTimestamp,
"timeStamp":ConvertUtils.UnixTimestamp},
{"syncServerTimeStamp":DataTypes.DATE,
"timeStamp":DataTypes.DATE}),
KnownTable("Message_Updates", None,
{"syncServerTimeStamp":ConvertUtils.UnixTimestamp,
"timeStamp":ConvertUtils.UnixTimestamp},
{"syncServerTimeStamp":DataTypes.DATE,
"timeStamp":DataTypes.DATE}),
],
}
def __init__(self):
self.known = True
class com_android_providers_calendar(IApp):
name = "com.android.providers.calendar"
cname = "Calendar Provider"
databases = {
"calendar.db": [
KnownTable("_sync_state", None, None, {"data": DataTypes.DATA}),
KnownTable(
"Events", None, {
"dtend": ConvertUtils.JsToUnix,
"lastDate": ConvertUtils.JsToUnix,
"dtstart": ConvertUtils.JsToUnix
}, {
"dtend": DataTypes.DATE,
"lastDate": DataTypes.DATE,
"dtstart": DataTypes.DATE
}),
KnownTable("Instances", None, {
"begin": ConvertUtils.JsToUnix,
"end": ConvertUtils.JsToUnix
}, {
"begin": DataTypes.DATE,
"end": DataTypes.DATE
}),
KnownTable(
"view_events", None, {
"lastDate": ConvertUtils.JsToUnix,
"dtend": ConvertUtils.JsToUnix,
"dtstart": ConvertUtils.JsToUnix,
"dtend": ConvertUtils.JsToUnix
}, {
"lastDate": DataTypes.DATE,
"dtend": DataTypes.DATE,
"dtstart": DataTypes.DATE,
"dtend": DataTypes.DATE
})
]
}
def __init__(self):
self.known = True
class com_android_providers_telephony(IApp):
name = "com.android.providers.telephony"
cname = "Android Providers Telephony"
databases = {
"mmssms.db": [
KnownTable("pdu", None,
{"date":ConvertUtils.UnixTimestamp,
"date_sent":ConvertUtils.UnixTimestamp },
{"date":DataTypes.DATE, "date_sent":DataTypes.DATE }),
KnownTable("pending_msgs", None,
{"due_time":ConvertUtils.UnixTimestamp,
"last_try":ConvertUtils.UnixTimestamp },
{"due_time": DataTypes.DATE,
"last_try":DataTypes.DATE }),
KnownTable("rate", None,
{"sent_time":ConvertUtils.UnixTimestamp },
{"sent_time": DataTypes.DATE }),
KnownTable("raw", None,
{"date":ConvertUtils.UnixTimestamp },
{"date": DataTypes.DATE }),
KnownTable("sms", None,
{"date":ConvertUtils.JsToUnix,
"date_sent":ConvertUtils.JsToUnix },
{"date": DataTypes.DATE,"date_sent":DataTypes.DATE }),
KnownTable("threads", None,
{"date":ConvertUtils.JsToUnix },
{"date": DataTypes.DATE })
],
}
def __init__(self):
self.known = True
class com_android_inputmethod_latin(IApp):
name = "com.android.inputmethod.latin"
cname = "Android Inputmethod"
databases = {
"pendingUpdates": [
KnownTable("pendingupdates", None,
{"date":ConvertUtils.UnixTimestamp },
{"date":DataTypes.DATE })
],
}
def __init__(self):
self.known = True
class com_andrew_apollo(IApp):
name = "com.andrew.apollo"
cname = "Andrew Apollo"
databases = {
"albumhistory.db": [
KnownTable("albumhistory", None,
{"timeplayed": ConvertUtils.JsToUnix},
{"timeplayed": DataTypes.DATE}),
]
}
def __init__(self):
self.known = True
class com_opera_browser(IApp):
name = "com.opera.browser"
cname = "Android Opera Browser"
databases = {
re.compile(".*\.localstore"): [
KnownTable("cookies", None,
{"creation_utc":ConvertUtils.WebkitToUnix,
"expires_utc":ConvertUtils.WebkitToUnix,
"last_access_utc":ConvertUtils.WebkitToUnix },
{"creation_utc":DataTypes.DATE,
"expires_utc":DataTypes.DATE,
"last_access_utc":DataTypes.DATE })
],
}
def __init__(self):
self.known = True
class com_android_browser(IApp):
name = "com.android.browser"
cname = "Android Browser"
databases = {
"browser2.db": [
KnownTable("history", None, {"date": ConvertUtils.JsToUnix},
{"date": DataTypes.DATE}),
KnownTable(
"bookmarks", None, {
"created": ConvertUtils.JsToUnix,
"modified": ConvertUtils.JsToUnix
}, {
"created": DataTypes.DATE,
"modified": DataTypes.DATE
}),
KnownTable("searches", None, {"date": ConvertUtils.JsToUnix},
{"date": DataTypes.DATE}),
KnownTable("_sync_state", None, None, {"data": DataTypes.DATA})
],
"webviewCookiesChromium.db": [
KnownTable(
"cookies", None, {
"creation_utc": ConvertUtils.WebkitToUnix,
"expires_utc": ConvertUtils.WebkitToUnix,
"last_access_utc": ConvertUtils.WebkitToUnix
}, {
"creation_utc": DataTypes.DATE,
"expires_utc": DataTypes.DATE,
"last_access_utc": DataTypes.DATE
})
],
"webview.db": [
KnownTable(
"formdata", """
SELECT
formdata._id,
urlid,
formurl.url,
value
FROM formdata
INNER JOIN formurl on formdata.urlid = formurl._id""")
]
}
def __init__(self):
self.known = True
class com_android_providers_contacts(IApp):
name = "com.android.providers.contacts"
cname = "Contacts Provider"
databases = {
"contacts2.db": [
KnownTable("_sync_state", None, None, {"data": DataTypes.DATA}),
KnownTable("data", None, None, {"data15": DataTypes.DATA}),
KnownTable(
"contacts",
None,
{
"contact_last_updated_timestamp":
ConvertUtils.JsToUnix, #18
"last_time_contacted": ConvertUtils.JsToUnix
}, #15
{
"contact_last_updated_timestamp": DataTypes.DATE,
"last_time_contacted": DataTypes.DATE
}),
KnownTable(
"deleted_contacts",
None, #18
{"contact_deleted_timestamp": ConvertUtils.JsToUnix},
{"contact_deleted_timestamp": DataTypes.DATE}),
KnownTable(
"raw_contacts",
None,
{"last_time_contacted": ConvertUtils.JsToUnix}, #15
{"last_time_contacted": DataTypes.DATE}),
KnownTable("calls", None, {"date": ConvertUtils.JsToUnix},
{"date": DataTypes.DATE}),
KnownTable("data_usage_stat", None,
{"last_time_used": ConvertUtils.JsToUnix},
{"last_time_contacted": DataTypes.DATE}),
KnownTable("view_raw_contacts", None,
{"last_time_contacted": ConvertUtils.JsToUnix},
{"last_time_contacted": DataTypes.DATE}),
KnownTable("view_contacts", None,
{"last_time_contacted": ConvertUtils.JsToUnix},
{"last_time_contacted": DataTypes.DATE}),
KnownTable(
"view_entities", None,
{"contact_last_updated_timestamp": ConvertUtils.JsToUnix},
{"contact_last_updated_timestamp": DataTypes.DATE}),
KnownTable("view_data_usage_stat", None,
{"last_time_used": ConvertUtils.JsToUnix},
{"last_time_used": DataTypes.DATE}),
KnownTable("view_v1_people", None,
{"last_time_contacted": ConvertUtils.JsToUnix},
{"last_time_contacted": DataTypes.DATE}),
KnownTable("view_v1_contact_methods", None,
{"last_time_contacted": ConvertUtils.JsToUnix},
{"last_time_contacted": DataTypes.DATE}),
KnownTable("view_v1_phones", None,
{"last_time_contacted": ConvertUtils.JsToUnix},
{"last_time_contacted": DataTypes.DATE})
],
"profile.db": [
KnownTable("_sync_state", None, None, {"data": DataTypes.DATA}),
KnownTable("data", None, None, {"data15": DataTypes.DATA}),
KnownTable(
"contacts",
None,
{
"contact_last_updated_timestamp":
ConvertUtils.JsToUnix, #18
"last_time_contacted": ConvertUtils.JsToUnix
}, #15
{
"contact_last_updated_timestamp": DataTypes.DATE,
"last_time_contacted": DataTypes.DATE
}),
KnownTable(
"deleted_contacts",
None, #18
{"contact_deleted_timestamp": ConvertUtils.JsToUnix},
{"contact_deleted_timestamp": DataTypes.DATE}),
KnownTable(
"raw_contacts",
None,
{"last_time_contacted": ConvertUtils.JsToUnix}, #15
{"last_time_contacted": DataTypes.DATE}),
KnownTable("calls", None, {"date": ConvertUtils.JsToUnix},
{"date": DataTypes.DATE}),
KnownTable("data_usage_stat", None,
{"last_time_used": ConvertUtils.JsToUnix},
{"last_time_contacted": DataTypes.DATE}),
KnownTable("view_raw_contacts", None,
{"last_time_contacted": ConvertUtils.JsToUnix},
{"last_time_contacted": DataTypes.DATE}),
KnownTable("view_contacts", None,
{"last_time_contacted": ConvertUtils.JsToUnix},
{"last_time_contacted": DataTypes.DATE}),
KnownTable(
"view_entities", None,
{"contact_last_updated_timestamp": ConvertUtils.JsToUnix},
{"contact_last_updated_timestamp": DataTypes.DATE}),
KnownTable("view_data_usage_stat", None,
{"last_time_used": ConvertUtils.JsToUnix},
{"last_time_used": DataTypes.DATE}),
KnownTable("view_v1_people", None,
{"last_time_contacted": ConvertUtils.JsToUnix},
{"last_time_contacted": DataTypes.DATE}),
KnownTable("view_v1_contact_methods", None,
{"last_time_contacted": ConvertUtils.JsToUnix},
{"last_time_contacted": DataTypes.DATE}),
KnownTable("view_v1_phones", None,
{"last_time_contacted": ConvertUtils.JsToUnix},
{"last_time_contacted": DataTypes.DATE})
]
}
def __init__(self):
self.known = True
class org_mozilla_firefox(IApp):
name = "org.mozilla.firefox"
cname = "Android mozillafirefox Browser"
databases = {
"signons.sqlite": [
KnownTable("moz_deleted_logins", None,
{"timeDeleted":ConvertUtils.JsToUnix },
{"timeDeleted":DataTypes.DATE }),
KnownTable("moz_logins", None,
{"timeCreated":ConvertUtils.JsToUnix,
"timeLastUsed":ConvertUtils.JsToUnix,
"timePasswordChanged":ConvertUtils.JsToUnix },
{"timeCreated": DataTypes.DATE,
"timeLastUsed":DataTypes.DATE,
"timePasswordChanged":DataTypes.DATE }),
],
"downloads.sqlite": [
KnownTable("moz_downloads", None,
{"startTime":ConvertUtils.JsToUnix,"endTime":ConvertUtils.JsToUnix },
{"endTime":DataTypes.DATE, "endTime":DataTypes.DATE })
],
"browser.db": [
KnownTable("bookmarks", None,
{"created":ConvertUtils.JsToUnix, "modified":ConvertUtils.JsToUnix, "deleted":ConvertUtils.JsToUnix },
{"created":DataTypes.DATE, "modified":DataTypes.DATE, "deleted":DataTypes.DATE }),
KnownTable("favicons", None,
{"created":ConvertUtils.JsToUnix, "modified":ConvertUtils.JsToUnix },
{"created":DataTypes.DATE, "modified":DataTypes.DATE }),
KnownTable("history", None,
{"date":ConvertUtils.JsToUnix, "created":ConvertUtils.JsToUnix, "modified":ConvertUtils.JsToUnix,"deleted":ConvertUtils.JsToUnix },
{"date":DataTypes.DATE, "created":DataTypes.DATE, "modified":DataTypes.DATE, "deleted":DataTypes.DATE }),
KnownTable("reading_list", None,
{"read":ConvertUtils.JsToUnix, "deleted":ConvertUtils.JsToUnix, "modified":ConvertUtils.JsToUnix,"created":ConvertUtils.JsToUnix },
{"read":DataTypes.DATE, "deleted":DataTypes.DATE, "modified":DataTypes.DATE, "created":DataTypes.DATE })
],
"health.db": [
KnownTable("android_metadata", None,
{"platformVersion":ConvertUtils.JsToUnix, "platformBuildID":ConvertUtils.JsToUnix },
{"platformVersion":DataTypes.DATE, "platformBuildID":DataTypes.DATE }),
KnownTable("environments", None,
{"profileCreation":ConvertUtils.JsToUnix, "appBuildID":ConvertUtils.JsToUnix, "platformBuildID":ConvertUtils.JsToUnix },
{"profileCreation":DataTypes.DATE, "appBuildID":DataTypes.DATE, "platformBuildID":DataTypes.DATE }),
KnownTable("events_integer", None,
{"date":ConvertUtils.JsToUnix },
{"date":DataTypes.DATE })
],
"cookies.sqlite": [
KnownTable("moz_cookies", None,
{"expiry":ConvertUtils.JsToUnix,"lastAccessed":ConvertUtils.JsToUnix, "creationTime":ConvertUtils.JsToUnix },
{"expiry":DataTypes.DATE, "lastAccessed":DataTypes.DATE,"creationTime":DataTypes.DATE })
],
"permissions.sqlite": [
KnownTable("moz_hosts", None,
{"expireTime":ConvertUtils.JsToUnix },
{"expireTime":DataTypes.DATE })
],
}
def __init__(self):
self.known = True
class com_android_providers_media(IApp):
name = "com.android.providers.media"
cname = "Android Providers Media"
databases = {
"external.db": [
KnownTable(
"files", None, {
"date_added": ConvertUtils.UnixTimestamp,
"date_modified": ConvertUtils.UnixTimestamp,
"datetaken": ConvertUtils.JsToUnix,
"duration": ConvertUtils.UnixTimestamp
}, {
"date_added": DataTypes.DATE,
"date_modified": DataTypes.DATE,
"datetaken": DataTypes.DATE,
"duration": DataTypes.DATE
}),
KnownTable(
"searchhelpertitle", None, {
"date_added": ConvertUtils.UnixTimestamp,
"date_modified": ConvertUtils.UnixTimestamp
}, {
"date_added": DataTypes.DATE,
"date_modified": DataTypes.DATE
}),
KnownTable(
"audio_meta", None, {
"date_added": ConvertUtils.UnixTimestamp,
"date_modified": ConvertUtils.UnixTimestamp
}, {
"date_added": DataTypes.DATE,
"date_modified": DataTypes.DATE
}),
KnownTable(
"audio", None, {
"date_added": ConvertUtils.UnixTimestamp,
"date_modified": ConvertUtils.UnixTimestamp
}, {
"date_added": DataTypes.DATE,
"date_modified": DataTypes.DATE
}),
KnownTable(
"images", None, {
"date_added": ConvertUtils.UnixTimestamp,
"date_modified": ConvertUtils.UnixTimestamp,
"datetaken": ConvertUtils.JsToUnix
}, {
"date_added": DataTypes.DATE,
"date_modified": DataTypes.DATE,
"datetaken": DataTypes.DATE
}),
KnownTable(
"video", None, {
"date_added": ConvertUtils.UnixTimestamp,
"date_modified": ConvertUtils.UnixTimestamp,
"datetaken": ConvertUtils.JsToUnix
}, {
"date_added": DataTypes.DATE,
"date_modified": DataTypes.DATE,
"datetaken": DataTypes.DATE
}),
#KnownTable("log", None, #XXX need to fix this somehow
# {"time":ConvertUtils.UnixTimestamp },
# {"time": DataTypes.DATE })
],
"internal.db": [
KnownTable(
"searchhelpertitle", None, {
"date_added": ConvertUtils.UnixTimestamp,
"date_modified": ConvertUtils.UnixTimestamp
}, {
"date_added": DataTypes.DATE,
"date_modified": DataTypes.DATE
}),
KnownTable(
"audio_meta", None, {
"date_added": ConvertUtils.UnixTimestamp,
"date_modified": ConvertUtils.UnixTimestamp
}, {
"date_added": DataTypes.DATE,
"date_modified": DataTypes.DATE
}),
KnownTable(
"audio", None, {
"date_added": ConvertUtils.UnixTimestamp,
"date_modified": ConvertUtils.UnixTimestamp
}, {
"date_added": DataTypes.DATE,
"date_modified": DataTypes.DATE
}),
KnownTable(
"images", None, {
"date_added": ConvertUtils.UnixTimestamp,
"date_modified": ConvertUtils.UnixTimestamp,
"datetaken": ConvertUtils.JsToUnix
}, {
"date_added": DataTypes.DATE,
"date_modified": DataTypes.DATE,
"datetaken": DataTypes.DATE
}),
KnownTable(
"video", None, {
"date_added": ConvertUtils.UnixTimestamp,
"date_modified": ConvertUtils.UnixTimestamp,
"datetaken": ConvertUtils.JsToUnix
}, {
"date_added": DataTypes.DATE,
"date_modified": DataTypes.DATE,
"datetaken": DataTypes.DATE
}),
KnownTable(
"files", None, {
"date_added": ConvertUtils.UnixTimestamp,
"date_modified": ConvertUtils.UnixTimestamp,
"datetaken": ConvertUtils.JsToUnix,
"duration": ConvertUtils.UnixTimestamp
}, {
"date_added": DataTypes.DATE,
"date_modified": DataTypes.DATE,
"datetaken": DataTypes.DATE,
"duration": DataTypes.DATE
}),
],
}
def __init__(self):
self.known = True
class com_facebook_orca(IApp):
name = "com.facebook.orca"
cname = "Android Facebook Orca"
databases = {
"newsfeed_db": [
KnownTable("home_stories", None,
{"fetched_at": ConvertUtils.JsToUnix},
{"fetched_at": DataTypes.DATE}),
KnownTable("feed_unit_impression", None,
{"timestamp": ConvertUtils.JsToUnix},
{"timestamp": DataTypes.DATE}),
],
"offline_mode_db": [
KnownTable(
"pending_request", None, {
"created_time": ConvertUtils.JsToUnix,
"expire_duration_ms": ConvertUtils.JsToUnix
}, {
"created_time": DataTypes.DATE,
"expire_duration_ms": DataTypes.DATE
})
],
"contacts_db2": [
KnownTable("contacts", None,
{"added_time_ms": ConvertUtils.JsToUnix},
{"added_time_ms": DataTypes.DATE}),
KnownTable("contact_summaries", None,
{"added_time_ms": ConvertUtils.JsToUnix},
{"added_time_ms": DataTypes.DATE}),
],
"videocache_db": [
KnownTable(
"videoads", None, {
"time_start": ConvertUtils.JsToUnix,
"time_end": ConvertUtils.JsToUnix,
"fetch_time": ConvertUtils.JsToUnix
}, {
"time_start": DataTypes.DATE,
"time_end": DataTypes.DATE,
"fetch_time": DataTypes.DATE
})
],
"threads_db2": [
KnownTable("folder_counts", None,
{"last_seen_time": ConvertUtils.JsToUnix},
{"last_seen_time": DataTypes.DATE}),
KnownTable("folders", None,
{"timestamp_ms": ConvertUtils.JsToUnix},
{"timestamp_ms": DataTypes.DATE}),
KnownTable(
"threads", None, {
"timestamp_ms": ConvertUtils.JsToUnix,
"last_fetch_time_ms": ConvertUtils.JsToUnix
}, {
"timestamp_ms": DataTypes.DATE,
"last_fetch_time_ms": DataTypes.DATE
}),
KnownTable(
"messages", None, {
"timestamp_ms": ConvertUtils.JsToUnix,
"timestamp_send_ms": ConvertUtils.JsToUnix
}, {
"timestamp_ms": DataTypes.DATE,
"timestamp_send_ms": DataTypes.DATE
}),
],
"analytics_db2": [
KnownTable("events", None, {"timestamp": ConvertUtils.JsToUnix},
{"timestamp": DataTypes.DATE})
],
"mds_cache_db": [
KnownTable("cache", None, {"timestamp": ConvertUtils.JsToUnix},
{"timestamp": DataTypes.DATE})
],
"timeline_prefetch_db": [
KnownTable(
"prefetch_candidates", None, {
"last_generate_timestamp": ConvertUtils.JsToUnix,
"last_fetch_timestamp": ConvertUtils.JsToUnix
}, {
"last_generate_timestamp": DataTypes.DATE,
"last_fetch_timestamp": DataTypes.DATE
})
],
"timeline_db": [
KnownTable("cache", None, {"timestamp": ConvertUtils.JsToUnix},
{"timestamp": DataTypes.DATE})
],
"graphql_cache": [
KnownTable("queries", None, {"timestamp": ConvertUtils.JsToUnix},
{"timestamp": DataTypes.DATE})
],
"sticker_packs": [
KnownTable("sticker_packs", None,
{"updated_time": ConvertUtils.UnixTimestamp},
{"updated_time": DataTypes.DATE})
],
"webviewCookiesChromium.db": [
KnownTable(
"cookies", None, {
"creation_utc": ConvertUtils.WebkitToUnix,
"expires_utc": ConvertUtils.WebkitToUnix,
"last_access_utc": ConvertUtils.WebkitToUnix
}, {
"creation_utc": DataTypes.DATE,
"expires_utc": DataTypes.DATE,
"last_access_utc": DataTypes.DATE
})
],
"webviewCookiesChromiumPrivate.db": [
KnownTable(
"cookies", None, {
"creation_utc": ConvertUtils.WebkitToUnix,
"expires_utc": ConvertUtils.WebkitToUnix,
"last_access_utc": ConvertUtils.WebkitToUnix
}, {
"creation_utc": DataTypes.DATE,
"expires_utc": DataTypes.DATE,
"last_access_utc": DataTypes.DATE
})
],
}
def __init__(self):
self.known = True
class com_twitter_android(IApp):
name = "com.twitter.android"
cname = "Android Twitter"
databases = {
re.compile("\d+-\d+\.db"): [
KnownTable(
"active_tailfeather", None, {
"start_time": ConvertUtils.JsToUnix,
"end_time": ConvertUtils.JsToUnix
}, {
"start_time": DataTypes.DATE,
"end_time": DataTypes.DATE
}),
KnownTable("activities", None,
{"created_at": ConvertUtils.JsToUnix},
{"created_at": DataTypes.DATE}),
KnownTable("clusters", None,
{"cl_timestamp": ConvertUtils.JsToUnix},
{"cl_timestamp": DataTypes.DATE}),
KnownTable("conversation_entries", None,
{"created": ConvertUtils.JsToUnix},
{"created": DataTypes.DATE}),
KnownTable("conversation_participants", None,
{"join_time": ConvertUtils.JsToUnix},
{"join_time": DataTypes.DATE}),
KnownTable("message_drafts", None,
{"created": ConvertUtils.JsToUnix},
{"created": DataTypes.DATE}),
KnownTable("messages", None, {"created": ConvertUtils.JsToUnix},
{"created": DataTypes.DATE}),
KnownTable("peeks", None, {"timestamp": ConvertUtils.JsToUnix},
{"timestamp": DataTypes.DATE}),
KnownTable("places", None, {"updated_at": ConvertUtils.JsToUnix},
{"updated_at": DataTypes.DATE}),
KnownTable("search_queries", None, {"time": ConvertUtils.JsToUnix},
{"time": DataTypes.DATE}),
KnownTable("status_groups", None,
{"updated_at": ConvertUtils.JsToUnix},
{"updated_at": DataTypes.DATE}),
KnownTable("statuses", None, {"created": ConvertUtils.JsToUnix},
{"created": DataTypes.DATE}),
KnownTable("timeline", None, {"updated_at": ConvertUtils.JsToUnix},
{"updated_at": DataTypes.DATE}),
KnownTable("topics", None,
{"ev_start_time": ConvertUtils.JsToUnix},
{"ev_start_time": DataTypes.DATE}),
KnownTable(
"users", None, {
"profile_created": ConvertUtils.JsToUnix,
"updated": ConvertUtils.JsToUnix
}, {
"profile_created": DataTypes.DATE,
"updated": DataTypes.DATE
})
],
"webviewCookiesChromium.db": [
KnownTable(
"cookies", None, {
"creation_utc": ConvertUtils.WebkitToUnix,
"expires_utc": ConvertUtils.WebkitToUnix,
"last_access_utc": ConvertUtils.WebkitToUnix
}, {
"creation_utc": DataTypes.DATE,
"expires_utc": DataTypes.DATE,
"last_access_utc": DataTypes.DATE
})
],
re.compile("\d+-drafts.db"): [
KnownTable("drafts", None, {"updated_at": ConvertUtils.JsToUnix},
{"updated_at": DataTypes.DATE})
],
"webviewCookiesChromiumPrivate.db": [
KnownTable(
"cookies", None, {
"creation_utc": ConvertUtils.WebkitToUnix,
"expires_utc": ConvertUtils.WebkitToUnix,
"last_access_utc": ConvertUtils.WebkitToUnix
}, {
"creation_utc": DataTypes.DATE,
"expires_utc": DataTypes.DATE,
"last_access_utc": DataTypes.DATE
}),
],
}
def __init__(self):
self.known = True
class com_android_chrome(IApp):
name = "com.android.chrome"
cname = "Android Chrome Browser"
databases = {
"History": [
KnownTable(
"downloads", None, {
"start_time": ConvertUtils.WebkitToUnix,
"end_time": ConvertUtils.WebkitToUnix
}, {
"start_time": DataTypes.DATE,
"end_time": DataTypes.DATE
}),
KnownTable("segment_usage", None,
{"time_slot": ConvertUtils.WebkitToUnix},
{"time_slot": DataTypes.DATE}),
KnownTable("urls", None,
{"last_visit_time": ConvertUtils.WebkitToUnix},
{"last_visit_time": DataTypes.DATE}),
KnownTable("visits", None,
{"visit_time": ConvertUtils.WebkitToUnix},
{"visit_time": DataTypes.DATE})
],
"Cookies": [
KnownTable(
"cookies", None, {
"creation_utc": ConvertUtils.WebkitToUnix,
"expires_utc": ConvertUtils.WebkitToUnix,
"last_access_utc": ConvertUtils.WebkitToUnix
}, {
"creation_utc": DataTypes.DATE,
"expires_utc": DataTypes.DATE,
"last_access_utc": DataTypes.DATE
})
],
"Favicons": [
KnownTable("favicon_bitmaps", None,
{"last_updated": ConvertUtils.WebkitToUnix},
{"last_updated": DataTypes.DATE})
],
"Shortcuts": [
KnownTable("omni_box_shortcuts", None,
{"last_access_time": ConvertUtils.WebkitToUnix},
{"last_access_time": DataTypes.DATE})
],
"snapshots.db": [
KnownTable("snapshots", None,
{"createTime": ConvertUtils.WebkitToUnix},
{"createTime": DataTypes.DATE})
],
"Web Data": [
KnownTable(
"autofill", None, {
"date_created": ConvertUtils.WebkitToUnix,
"date_last_used": ConvertUtils.WebkitToUnix
}, {
"date_created": DataTypes.DATE,
"date_last_used": DataTypes.DATE
}),
KnownTable("autofill_profiles", None,
{"date_modified": ConvertUtils.WebkitToUnix},
{"date_modified": DataTypes.DATE}),
KnownTable("credit_cards", None,
{"date_modified": ConvertUtils.WebkitToUnix},
{"date_modified": DataTypes.DATE}),
KnownTable(
"keywords", None, {
"date_created": ConvertUtils.WebkitToUnix,
"last_modified": ConvertUtils.WebkitToUnix
}, {
"date_created": DataTypes.DATE,
"last_modified": DataTypes.DATE
}),
KnownTable("web_intents_defaults", None,
{"user_date": ConvertUtils.WebkitToUnix},
{"user_date": DataTypes.DATE})
],
"SyncData.sqlite3": [
KnownTable(
"deleted_metas", None, {
"mtime": ConvertUtils.JsToUnix,
"server_mtime": ConvertUtils.JsToUnix,
"ctime": ConvertUtils.JsToUnix,
"server_ctime": ConvertUtils.JsToUnix
}, {
"mtime": DataTypes.DATE,
"server_mtime": DataTypes.DATE,
"ctime": DataTypes.DATE,
"server_ctime": DataTypes.DATE
}),
KnownTable(
"metas", None, {
"mtime": ConvertUtils.JsToUnix,
"server_mtime": ConvertUtils.JsToUnix,
"ctime": ConvertUtils.JsToUnix,
"server_ctime": ConvertUtils.JsToUnix
}, {
"mtime": DataTypes.DATE,
"server_mtime": DataTypes.DATE,
"ctime": DataTypes.DATE,
"server_ctime": DataTypes.DATE
}),
KnownTable(
"share_info", None, {
"store_birthday": ConvertUtils.JsToUnix,
"db_create_time": ConvertUtils.WebkitToUnix
}, {
"store_birthday": DataTypes.DATE,
"db_create_time": DataTypes.DATE
})
],
"Archived History": [
KnownTable("urls", None,
{"last_visit_time": ConvertUtils.WebkitToUnix},
{"last_visit_time": DataTypes.DATE}),
KnownTable("visits", None,
{"visit_time": ConvertUtils.WebkitToUnix},
{"visit_time": DataTypes.DATE})
],
"Network Action Predictor": [
KnownTable("logged_in_predictor", None,
{"time": ConvertUtils.WebkitToUnix},
{"time": DataTypes.DATE})
],
"Origin Bound Certs": [
KnownTable(
"origin_bound_certs", None, {
"expiration_time": ConvertUtils.WebkitToUnix,
"creation_time": ConvertUtils.WebkitToUnix
}, {
"expiration_time": DataTypes.DATE,
"creation_time": DataTypes.DATE
})
],
"snapshots.db": [
KnownTable("snapshots", None,
{"createTime": ConvertUtils.WebkitToUnix},
{"createTime": DataTypes.DATE})
],
}
def __init__(self):
self.known = True