def ParseCFURLEntry(db, cfurl_cache_artifacts, username, app_bundle_id, cfurl_cache_db_path): db.row_factory = sqlite3.Row tables = CommonFunctions.GetTableNames(db) schema_version = 0 if 'cfurl_cache_schema_version' in tables: schema_version = CheckSchemaVersion(db) else: log.debug('There is no cfurl_cache_schema_version table.') if 'cfurl_cache_response' in tables: if schema_version in (0, 202): query = """SELECT entry_ID, time_stamp, request_key, request_object, response_object, isDataOnFS, receiver_data FROM cfurl_cache_response JOIN cfurl_cache_blob_data USING (entry_ID) JOIN cfurl_cache_receiver_data USING (entry_ID)""" cursor = db.execute(query) for row in cursor: http_req_method, req_headers = ParseRequestObject(row['request_object']) http_status, resp_headers = ParseResponseObject(row['response_object']) if type(row['receiver_data']) == bytes: received_data = row['receiver_data'] elif type(row['receiver_data']) == str: received_data = row['receiver_data'].encode() else: log.error('Unknown type of "receiver_data": {}'.format(type(row['receiver_data']))) continue item = CfurlCacheItem(row['time_stamp'], row['request_key'], http_req_method, req_headers, http_status, resp_headers, row['isDataOnFS'], received_data, username, app_bundle_id, cfurl_cache_db_path) cfurl_cache_artifacts.append(item)
def ReadTopSitesDb(chrome_artifacts, db, file_size, user, source): try: db.row_factory = sqlite3.Row tables = CommonFunctions.GetTableNames(db) if 'topsites' in tables: # meta.version == 4 cursor = db.cursor() query = "SELECT url, url_rank, title from top_sites ORDER BY url_rank ASC" cursor = db.execute(query) for row in cursor: item = ChromeItem(ChromeItemType.TOPSITE, row['url'], row['title'], None, None, None, None, f"URL_RANK={row['url_rank']}", user, source) chrome_artifacts.append(item) elif 'thumbnails' in tables: # meta.version == 3 cursor = db.cursor() query = "SELECT url, url_rank, title, last_updated from thumbnails ORDER BY url_rank ASC" cursor = db.execute(query) for row in cursor: item = ChromeItem(ChromeItemType.TOPSITE, row['url'], row['title'], CommonFunctions.ReadChromeTime(row['last_updated']), None, None, None, f"URL_RANK={row['url_rank']}", user, source) chrome_artifacts.append(item) except sqlite3.Error: log.exception('DB read error from ReadTopSitesDb()')