OLD | NEW |
1 # -*- coding: utf-8 -*- | 1 # -*- coding: utf-8 -*- |
2 """This file contains a parser for the Android SMS database. | 2 """This file contains a parser for the Android SMS database. |
3 | 3 |
4 Android SMS messages are stored in SQLite database files named mmssms.dbs. | 4 Android SMS messages are stored in SQLite database files named mmssms.dbs. |
5 """ | 5 """ |
6 | 6 |
7 from dfdatetime import java_time as dfdatetime_java_time | 7 from dfdatetime import java_time as dfdatetime_java_time |
8 | 8 |
9 from plaso.containers import events | 9 from plaso.containers import events |
10 from plaso.containers import time_events | 10 from plaso.containers import time_events |
(...skipping 30 matching lines...) Expand all Loading... |
41 DESCRIPTION = u'Parser for Android text messages SQLite database files.' | 41 DESCRIPTION = u'Parser for Android text messages SQLite database files.' |
42 | 42 |
43 # Define the needed queries. | 43 # Define the needed queries. |
44 QUERIES = [ | 44 QUERIES = [ |
45 (u'SELECT _id AS id, address, date, read, type, body FROM sms', | 45 (u'SELECT _id AS id, address, date, read, type, body FROM sms', |
46 u'ParseSmsRow')] | 46 u'ParseSmsRow')] |
47 | 47 |
48 # The required tables. | 48 # The required tables. |
49 REQUIRED_TABLES = frozenset([u'sms']) | 49 REQUIRED_TABLES = frozenset([u'sms']) |
50 | 50 |
| 51 SCHEMAS = [{ |
| 52 u'addr': ( |
| 53 u'CREATE TABLE addr (_id INTEGER PRIMARY KEY, msg_id INTEGER, ' |
| 54 u'contact_id INTEGER, address TEXT, type INTEGER, charset INTEGER)'), |
| 55 u'android_metadata': ( |
| 56 u'CREATE TABLE android_metadata (locale TEXT)'), |
| 57 u'attachments': ( |
| 58 u'CREATE TABLE attachments (sms_id INTEGER, content_url TEXT, offset ' |
| 59 u'INTEGER)'), |
| 60 u'canonical_addresses': ( |
| 61 u'CREATE TABLE canonical_addresses (_id INTEGER PRIMARY KEY ' |
| 62 u'AUTOINCREMENT, address TEXT)'), |
| 63 u'drm': ( |
| 64 u'CREATE TABLE drm (_id INTEGER PRIMARY KEY, _data TEXT)'), |
| 65 u'part': ( |
| 66 u'CREATE TABLE part (_id INTEGER PRIMARY KEY AUTOINCREMENT, mid ' |
| 67 u'INTEGER, seq INTEGER DEFAULT 0, ct TEXT, name TEXT, chset INTEGER, ' |
| 68 u'cd TEXT, fn TEXT, cid TEXT, cl TEXT, ctt_s INTEGER, ctt_t TEXT, ' |
| 69 u'_data TEXT, text TEXT)'), |
| 70 u'pdu': ( |
| 71 u'CREATE TABLE pdu (_id INTEGER PRIMARY KEY AUTOINCREMENT, thread_id ' |
| 72 u'INTEGER, date INTEGER, date_sent INTEGER DEFAULT 0, msg_box ' |
| 73 u'INTEGER, read INTEGER DEFAULT 0, m_id TEXT, sub TEXT, sub_cs ' |
| 74 u'INTEGER, ct_t TEXT, ct_l TEXT, exp INTEGER, m_cls TEXT, m_type ' |
| 75 u'INTEGER, v INTEGER, m_size INTEGER, pri INTEGER, rr INTEGER, rpt_a ' |
| 76 u'INTEGER, resp_st INTEGER, st INTEGER, tr_id TEXT, retr_st INTEGER, ' |
| 77 u'retr_txt TEXT, retr_txt_cs INTEGER, read_status INTEGER, ct_cls ' |
| 78 u'INTEGER, resp_txt TEXT, d_tm INTEGER, d_rpt INTEGER, locked ' |
| 79 u'INTEGER DEFAULT 0, seen INTEGER DEFAULT 0, text_only INTEGER ' |
| 80 u'DEFAULT 0)'), |
| 81 u'pending_msgs': ( |
| 82 u'CREATE TABLE pending_msgs (_id INTEGER PRIMARY KEY, proto_type ' |
| 83 u'INTEGER, msg_id INTEGER, msg_type INTEGER, err_type INTEGER, ' |
| 84 u'err_code INTEGER, retry_index INTEGER NOT NULL DEFAULT 0, due_time ' |
| 85 u'INTEGER, last_try INTEGER)'), |
| 86 u'rate': ( |
| 87 u'CREATE TABLE rate (sent_time INTEGER)'), |
| 88 u'raw': ( |
| 89 u'CREATE TABLE raw (_id INTEGER PRIMARY KEY, date INTEGER, ' |
| 90 u'reference_number INTEGER, count INTEGER, sequence INTEGER, ' |
| 91 u'destination_port INTEGER, address TEXT, pdu TEXT)'), |
| 92 u'sms': ( |
| 93 u'CREATE TABLE sms (_id INTEGER PRIMARY KEY, thread_id INTEGER, ' |
| 94 u'address TEXT, person INTEGER, date INTEGER, date_sent INTEGER ' |
| 95 u'DEFAULT 0, protocol INTEGER, read INTEGER DEFAULT 0, status ' |
| 96 u'INTEGER DEFAULT -1, type INTEGER, reply_path_present INTEGER, ' |
| 97 u'subject TEXT, body TEXT, service_center TEXT, locked INTEGER ' |
| 98 u'DEFAULT 0, error_code INTEGER DEFAULT 0, seen INTEGER DEFAULT 0)'), |
| 99 u'sr_pending': ( |
| 100 u'CREATE TABLE sr_pending (reference_number INTEGER, action TEXT, ' |
| 101 u'data TEXT)'), |
| 102 u'threads': ( |
| 103 u'CREATE TABLE threads (_id INTEGER PRIMARY KEY AUTOINCREMENT, date ' |
| 104 u'INTEGER DEFAULT 0, message_count INTEGER DEFAULT 0, recipient_ids ' |
| 105 u'TEXT, snippet TEXT, snippet_cs INTEGER DEFAULT 0, read INTEGER ' |
| 106 u'DEFAULT 1, type INTEGER DEFAULT 0, error INTEGER DEFAULT 0, ' |
| 107 u'has_attachment INTEGER DEFAULT 0)'), |
| 108 u'words': ( |
| 109 u'CREATE VIRTUAL TABLE words USING FTS3 (_id INTEGER PRIMARY KEY, ' |
| 110 u'index_text TEXT, source_id INTEGER, table_to_use INTEGER)'), |
| 111 u'words_content': ( |
| 112 u'CREATE TABLE \'words_content\'(docid INTEGER PRIMARY KEY, ' |
| 113 u'\'c0_id\', \'c1index_text\', \'c2source_id\', \'c3table_to_use\')'), |
| 114 u'words_segdir': ( |
| 115 u'CREATE TABLE \'words_segdir\'(level INTEGER, idx INTEGER, ' |
| 116 u'start_block INTEGER, leaves_end_block INTEGER, end_block INTEGER, ' |
| 117 u'root BLOB, PRIMARY KEY(level, idx))'), |
| 118 u'words_segments': ( |
| 119 u'CREATE TABLE \'words_segments\'(blockid INTEGER PRIMARY KEY, block ' |
| 120 u'BLOB)')}] |
| 121 |
51 # TODO: Move this functionality to the formatter. | 122 # TODO: Move this functionality to the formatter. |
52 SMS_TYPE = { | 123 SMS_TYPE = { |
53 1: u'RECEIVED', | 124 1: u'RECEIVED', |
54 2: u'SENT'} | 125 2: u'SENT'} |
55 SMS_READ = { | 126 SMS_READ = { |
56 0: u'UNREAD', | 127 0: u'UNREAD', |
57 1: u'READ'} | 128 1: u'READ'} |
58 | 129 |
59 def ParseSmsRow(self, parser_mediator, row, query=None, **unused_kwargs): | 130 def ParseSmsRow(self, parser_mediator, row, query=None, **unused_kwargs): |
60 """Parses an SMS row. | 131 """Parses an SMS row. |
(...skipping 15 matching lines...) Expand all Loading... |
76 event_data.sms_read = self.SMS_READ.get(row['read'], u'UNKNOWN') | 147 event_data.sms_read = self.SMS_READ.get(row['read'], u'UNKNOWN') |
77 event_data.sms_type = self.SMS_TYPE.get(row['type'], u'UNKNOWN') | 148 event_data.sms_type = self.SMS_TYPE.get(row['type'], u'UNKNOWN') |
78 | 149 |
79 date_time = dfdatetime_java_time.JavaTime(timestamp=row['date']) | 150 date_time = dfdatetime_java_time.JavaTime(timestamp=row['date']) |
80 event = time_events.DateTimeValuesEvent( | 151 event = time_events.DateTimeValuesEvent( |
81 date_time, eventdata.EventTimestamp.CREATION_TIME) | 152 date_time, eventdata.EventTimestamp.CREATION_TIME) |
82 parser_mediator.ProduceEventWithEventData(event, event_data) | 153 parser_mediator.ProduceEventWithEventData(event, event_data) |
83 | 154 |
84 | 155 |
85 sqlite.SQLiteParser.RegisterPlugin(AndroidSMSPlugin) | 156 sqlite.SQLiteParser.RegisterPlugin(AndroidSMSPlugin) |
OLD | NEW |