Left: | ||
Right: |
LEFT | RIGHT |
---|---|
1 # -*- coding: utf-8 -*- | 1 # -*- coding: utf-8 -*- |
2 """This file contains a parser for the Android contacts2 Call History. | 2 """This file contains a parser for the Android contacts2 Call History. |
3 | 3 |
4 Android Call History is stored in SQLite database files named contacts2.db. | 4 Android Call History is stored in SQLite database files named contacts2.db. |
5 """ | 5 """ |
6 | 6 |
7 from dfdatetime import java_time as dfdatetime_java_time | 7 from dfdatetime import java_time as dfdatetime_java_time |
8 | 8 |
9 from plaso.containers import events | 9 from plaso.containers import events |
10 from plaso.containers import time_events | 10 from plaso.containers import time_events |
(...skipping 29 matching lines...) Expand all Loading... | |
40 NAME = u'android_calls' | 40 NAME = u'android_calls' |
41 DESCRIPTION = u'Parser for Android calls SQLite database files.' | 41 DESCRIPTION = u'Parser for Android calls SQLite database files.' |
42 | 42 |
43 REQUIRED_TABLES = frozenset([u'calls']) | 43 REQUIRED_TABLES = frozenset([u'calls']) |
44 | 44 |
45 # Define the needed queries. | 45 # Define the needed queries. |
46 QUERIES = [ | 46 QUERIES = [ |
47 (u'SELECT _id AS id, date, number, name, duration, type FROM calls', | 47 (u'SELECT _id AS id, date, number, name, duration, type FROM calls', |
48 u'ParseCallsRow')] | 48 u'ParseCallsRow')] |
49 | 49 |
50 SCHEMAS = [ | 50 SCHEMAS = [{ |
51 {u'_sync_state': | 51 u'_sync_state': ( |
onager
2017/04/12 19:42:02
This very hard to read - please clean up. Perhaps
Joachim Metz
2017/04/19 19:18:24
built a text formatter for this, see if you agree
|
onager
2017/04/24 06:36:24
This is much more readable - please go ahead and a
Joachim Metz
2017/05/07 14:27:10
Done.
|
52 u'CREATE TABLE _sync_state (_id INTEGER PRIMARY KEY,account_name TEXT ' | 52 u'CREATE TABLE _sync_state (_id INTEGER PRIMARY KEY, account_name ' |
53 u'NOT NULL,account_type TEXT NOT NULL,data TEXT,UNIQUE(account_name, ' | 53 u'TEXT NOT NULL, account_type TEXT NOT NULL, data TEXT, ' |
54 u'account_type))', | 54 u'UNIQUE(account_name, account_type))'), |
55 u'_sync_state_metadata': | 55 u'_sync_state_metadata': ( |
56 u'CREATE TABLE _sync_state_metadata (version INTEGER)', | 56 u'CREATE TABLE _sync_state_metadata (version INTEGER)'), |
57 u'accounts': | 57 u'accounts': ( |
58 u'CREATE TABLE accounts (_id INTEGER PRIMARY KEY ' | 58 u'CREATE TABLE accounts (_id INTEGER PRIMARY KEY AUTOINCREMENT, ' |
59 u'AUTOINCREMENT,account_name TEXT, account_type TEXT, data_set TEXT)', | 59 u'account_name TEXT, account_type TEXT, data_set TEXT)'), |
60 u'agg_exceptions': | 60 u'agg_exceptions': ( |
61 u'CREATE TABLE agg_exceptions (_id INTEGER PRIMARY KEY ' | 61 u'CREATE TABLE agg_exceptions (_id INTEGER PRIMARY KEY ' |
62 u'AUTOINCREMENT,type INTEGER NOT NULL, raw_contact_id1 INTEGER ' | 62 u'AUTOINCREMENT, type INTEGER NOT NULL, raw_contact_id1 INTEGER ' |
63 u'REFERENCES raw_contacts(_id), raw_contact_id2 INTEGER REFERENCES ' | 63 u'REFERENCES raw_contacts(_id), raw_contact_id2 INTEGER REFERENCES ' |
64 u'raw_contacts(_id))', | 64 u'raw_contacts(_id))'), |
65 u'android_metadata': | 65 u'android_metadata': ( |
66 u'CREATE TABLE android_metadata (locale TEXT)', | 66 u'CREATE TABLE android_metadata (locale TEXT)'), |
67 u'calls': | 67 u'calls': ( |
68 u'CREATE TABLE calls (_id INTEGER PRIMARY KEY AUTOINCREMENT,number ' | 68 u'CREATE TABLE calls (_id INTEGER PRIMARY KEY AUTOINCREMENT, number ' |
69 u'TEXT,date INTEGER,duration INTEGER,type INTEGER,new INTEGER,name ' | 69 u'TEXT, date INTEGER, duration INTEGER, type INTEGER, new INTEGER, ' |
70 u'TEXT,numbertype INTEGER,numberlabel TEXT,countryiso ' | 70 u'name TEXT, numbertype INTEGER, numberlabel TEXT, countryiso TEXT, ' |
71 u'TEXT,voicemail_uri TEXT,is_read INTEGER,geocoded_location ' | 71 u'voicemail_uri TEXT, is_read INTEGER, geocoded_location TEXT, ' |
72 u'TEXT,lookup_uri TEXT,matched_number TEXT,normalized_number ' | 72 u'lookup_uri TEXT, matched_number TEXT, normalized_number TEXT, ' |
73 u'TEXT,photo_id INTEGER NOT NULL DEFAULT 0,formatted_number ' | 73 u'photo_id INTEGER NOT NULL DEFAULT 0, formatted_number TEXT, _data ' |
74 u'TEXT,_data TEXT,has_content INTEGER,mime_type TEXT,source_data ' | 74 u'TEXT, has_content INTEGER, mime_type TEXT, source_data TEXT, ' |
75 u'TEXT,source_package TEXT,state INTEGER)', | 75 u'source_package TEXT, state INTEGER)'), |
76 u'contacts': | 76 u'contacts': ( |
77 u'CREATE TABLE contacts (_id INTEGER PRIMARY KEY ' | 77 u'CREATE TABLE contacts (_id INTEGER PRIMARY KEY AUTOINCREMENT, ' |
78 u'AUTOINCREMENT,name_raw_contact_id INTEGER REFERENCES ' | 78 u'name_raw_contact_id INTEGER REFERENCES raw_contacts(_id), photo_id ' |
79 u'raw_contacts(_id),photo_id INTEGER REFERENCES ' | 79 u'INTEGER REFERENCES data(_id), photo_file_id INTEGER REFERENCES ' |
80 u'data(_id),photo_file_id INTEGER REFERENCES ' | 80 u'photo_files(_id), custom_ringtone TEXT, send_to_voicemail INTEGER ' |
81 u'photo_files(_id),custom_ringtone TEXT,send_to_voicemail INTEGER NOT ' | 81 u'NOT NULL DEFAULT 0, times_contacted INTEGER NOT NULL DEFAULT 0, ' |
82 u'NULL DEFAULT 0,times_contacted INTEGER NOT NULL DEFAULT ' | 82 u'last_time_contacted INTEGER, starred INTEGER NOT NULL DEFAULT 0, ' |
83 u'0,last_time_contacted INTEGER,starred INTEGER NOT NULL DEFAULT ' | 83 u'has_phone_number INTEGER NOT NULL DEFAULT 0, lookup TEXT, ' |
84 u'0,has_phone_number INTEGER NOT NULL DEFAULT 0,lookup ' | 84 u'status_update_id INTEGER REFERENCES data(_id), ' |
85 u'TEXT,status_update_id INTEGER REFERENCES data(_id), ' | 85 u'contact_last_updated_timestamp INTEGER)'), |
86 u'contact_last_updated_timestamp INTEGER)', | 86 u'data': ( |
87 u'data': | 87 u'CREATE TABLE data (_id INTEGER PRIMARY KEY AUTOINCREMENT, ' |
88 u'CREATE TABLE data (_id INTEGER PRIMARY KEY AUTOINCREMENT,package_id ' | 88 u'package_id INTEGER REFERENCES package(_id), mimetype_id INTEGER ' |
89 u'INTEGER REFERENCES package(_id),mimetype_id INTEGER REFERENCES ' | 89 u'REFERENCES mimetype(_id) NOT NULL, raw_contact_id INTEGER ' |
90 u'mimetype(_id) NOT NULL,raw_contact_id INTEGER REFERENCES ' | 90 u'REFERENCES raw_contacts(_id) NOT NULL, is_read_only INTEGER NOT ' |
91 u'raw_contacts(_id) NOT NULL,is_read_only INTEGER NOT NULL DEFAULT ' | 91 u'NULL DEFAULT 0, is_primary INTEGER NOT NULL DEFAULT 0, ' |
92 u'0,is_primary INTEGER NOT NULL DEFAULT 0,is_super_primary INTEGER ' | 92 u'is_super_primary INTEGER NOT NULL DEFAULT 0, data_version INTEGER ' |
93 u'NOT NULL DEFAULT 0,data_version INTEGER NOT NULL DEFAULT 0,data1 ' | 93 u'NOT NULL DEFAULT 0, data1 TEXT, data2 TEXT, data3 TEXT, data4 ' |
94 u'TEXT,data2 TEXT,data3 TEXT,data4 TEXT,data5 TEXT,data6 TEXT,data7 ' | 94 u'TEXT, data5 TEXT, data6 TEXT, data7 TEXT, data8 TEXT, data9 TEXT, ' |
95 u'TEXT,data8 TEXT,data9 TEXT,data10 TEXT,data11 TEXT,data12 ' | 95 u'data10 TEXT, data11 TEXT, data12 TEXT, data13 TEXT, data14 TEXT, ' |
96 u'TEXT,data13 TEXT,data14 TEXT,data15 TEXT,data_sync1 TEXT, ' | 96 u'data15 TEXT, data_sync1 TEXT, data_sync2 TEXT, data_sync3 TEXT, ' |
97 u'data_sync2 TEXT, data_sync3 TEXT, data_sync4 TEXT )', | 97 u'data_sync4 TEXT )'), |
98 u'data_usage_stat': | 98 u'data_usage_stat': ( |
99 u'CREATE TABLE data_usage_stat(stat_id INTEGER PRIMARY KEY ' | 99 u'CREATE TABLE data_usage_stat(stat_id INTEGER PRIMARY KEY ' |
100 u'AUTOINCREMENT, data_id INTEGER NOT NULL, usage_type INTEGER NOT ' | 100 u'AUTOINCREMENT, data_id INTEGER NOT NULL, usage_type INTEGER NOT ' |
101 u'NULL DEFAULT 0, times_used INTEGER NOT NULL DEFAULT 0, ' | 101 u'NULL DEFAULT 0, times_used INTEGER NOT NULL DEFAULT 0, ' |
102 u'last_time_used INTERGER NOT NULL DEFAULT 0, FOREIGN KEY(data_id) ' | 102 u'last_time_used INTEGER NOT NULL DEFAULT 0, FOREIGN KEY(data_id) ' |
onager
2017/04/12 19:42:02
INTERGER?
Joachim Metz
2017/04/19 19:18:24
I'll double check but likely.
| |
103 u'REFERENCES data(_id))', | 103 u'REFERENCES data(_id))'), |
104 u'default_directory': | 104 u'default_directory': ( |
105 u'CREATE TABLE default_directory (_id INTEGER PRIMARY KEY)', | 105 u'CREATE TABLE default_directory (_id INTEGER PRIMARY KEY)'), |
106 u'deleted_contacts': | 106 u'deleted_contacts': ( |
107 u'CREATE TABLE deleted_contacts (contact_id INTEGER PRIMARY ' | 107 u'CREATE TABLE deleted_contacts (contact_id INTEGER PRIMARY KEY, ' |
108 u'KEY,contact_deleted_timestamp INTEGER NOT NULL default 0)', | 108 u'contact_deleted_timestamp INTEGER NOT NULL default 0)'), |
109 u'directories': | 109 u'directories': ( |
110 u'CREATE TABLE directories(_id INTEGER PRIMARY KEY ' | 110 u'CREATE TABLE directories(_id INTEGER PRIMARY KEY AUTOINCREMENT, ' |
111 u'AUTOINCREMENT,packageName TEXT NOT NULL,authority TEXT NOT ' | 111 u'packageName TEXT NOT NULL, authority TEXT NOT NULL, typeResourceId ' |
112 u'NULL,typeResourceId INTEGER,typeResourceName TEXT,accountType ' | 112 u'INTEGER, typeResourceName TEXT, accountType TEXT, accountName ' |
113 u'TEXT,accountName TEXT,displayName TEXT, exportSupport INTEGER NOT ' | 113 u'TEXT, displayName TEXT, exportSupport INTEGER NOT NULL DEFAULT 0, ' |
114 u'NULL DEFAULT 0,shortcutSupport INTEGER NOT NULL DEFAULT ' | 114 u'shortcutSupport INTEGER NOT NULL DEFAULT 0, photoSupport INTEGER ' |
115 u'0,photoSupport INTEGER NOT NULL DEFAULT 0)', | 115 u'NOT NULL DEFAULT 0)'), |
116 u'groups': | 116 u'groups': ( |
117 u'CREATE TABLE groups (_id INTEGER PRIMARY KEY ' | 117 u'CREATE TABLE groups (_id INTEGER PRIMARY KEY AUTOINCREMENT, ' |
118 u'AUTOINCREMENT,package_id INTEGER REFERENCES ' | 118 u'package_id INTEGER REFERENCES package(_id), account_name STRING ' |
119 u'package(_id),account_name STRING DEFAULT NULL, account_type STRING ' | 119 u'DEFAULT NULL, account_type STRING DEFAULT NULL, data_set STRING ' |
120 u'DEFAULT NULL, data_set STRING DEFAULT NULL, sourceid TEXT,version ' | 120 u'DEFAULT NULL, sourceid TEXT, version INTEGER NOT NULL DEFAULT 1, ' |
121 u'INTEGER NOT NULL DEFAULT 1,dirty INTEGER NOT NULL DEFAULT 0,title ' | 121 u'dirty INTEGER NOT NULL DEFAULT 0, title TEXT, title_res INTEGER, ' |
122 u'TEXT,title_res INTEGER,notes TEXT,system_id TEXT,deleted INTEGER ' | 122 u'notes TEXT, system_id TEXT, deleted INTEGER NOT NULL DEFAULT 0, ' |
123 u'NOT NULL DEFAULT 0,group_visible INTEGER NOT NULL DEFAULT ' | 123 u'group_visible INTEGER NOT NULL DEFAULT 0, should_sync INTEGER NOT ' |
124 u'0,should_sync INTEGER NOT NULL DEFAULT 1,auto_add INTEGER NOT NULL ' | 124 u'NULL DEFAULT 1, auto_add INTEGER NOT NULL DEFAULT 0, favorites ' |
125 u'DEFAULT 0,favorites INTEGER NOT NULL DEFAULT 0,group_is_read_only ' | 125 u'INTEGER NOT NULL DEFAULT 0, group_is_read_only INTEGER NOT NULL ' |
126 u'INTEGER NOT NULL DEFAULT 0,sync1 TEXT, sync2 TEXT, sync3 TEXT, ' | 126 u'DEFAULT 0, sync1 TEXT, sync2 TEXT, sync3 TEXT, sync4 TEXT , ' |
127 u'sync4 TEXT , account_id INTEGER REFERENCES accounts(_id))', | 127 u'account_id INTEGER REFERENCES accounts(_id))'), |
128 u'mimetypes': | 128 u'mimetypes': ( |
129 u'CREATE TABLE mimetypes (_id INTEGER PRIMARY KEY ' | 129 u'CREATE TABLE mimetypes (_id INTEGER PRIMARY KEY AUTOINCREMENT, ' |
130 u'AUTOINCREMENT,mimetype TEXT NOT NULL)', | 130 u'mimetype TEXT NOT NULL)'), |
131 u'name_lookup': | 131 u'name_lookup': ( |
132 u'CREATE TABLE name_lookup (data_id INTEGER REFERENCES data(_id) NOT ' | 132 u'CREATE TABLE name_lookup (data_id INTEGER REFERENCES data(_id) NOT ' |
133 u'NULL,raw_contact_id INTEGER REFERENCES raw_contacts(_id) NOT ' | 133 u'NULL, raw_contact_id INTEGER REFERENCES raw_contacts(_id) NOT ' |
134 u'NULL,normalized_name TEXT NOT NULL,name_type INTEGER NOT ' | 134 u'NULL, normalized_name TEXT NOT NULL, name_type INTEGER NOT NULL, ' |
135 u'NULL,PRIMARY KEY (data_id, normalized_name, name_type))', | 135 u'PRIMARY KEY (data_id, normalized_name, name_type))'), |
136 u'nickname_lookup': | 136 u'nickname_lookup': ( |
137 u'CREATE TABLE nickname_lookup (name TEXT,cluster TEXT)', | 137 u'CREATE TABLE nickname_lookup (name TEXT, cluster TEXT)'), |
138 u'packages': | 138 u'packages': ( |
139 u'CREATE TABLE packages (_id INTEGER PRIMARY KEY ' | 139 u'CREATE TABLE packages (_id INTEGER PRIMARY KEY AUTOINCREMENT, ' |
140 u'AUTOINCREMENT,package TEXT NOT NULL)', | 140 u'package TEXT NOT NULL)'), |
141 u'phone_lookup': | 141 u'phone_lookup': ( |
142 u'CREATE TABLE phone_lookup (data_id INTEGER REFERENCES data(_id) NOT ' | 142 u'CREATE TABLE phone_lookup (data_id INTEGER REFERENCES data(_id) ' |
143 u'NULL,raw_contact_id INTEGER REFERENCES raw_contacts(_id) NOT ' | 143 u'NOT NULL, raw_contact_id INTEGER REFERENCES raw_contacts(_id) NOT ' |
144 u'NULL,normalized_number TEXT NOT NULL,min_match TEXT NOT NULL)', | 144 u'NULL, normalized_number TEXT NOT NULL, min_match TEXT NOT NULL)'), |
145 u'photo_files': | 145 u'photo_files': ( |
146 u'CREATE TABLE photo_files (_id INTEGER PRIMARY KEY AUTOINCREMENT, ' | 146 u'CREATE TABLE photo_files (_id INTEGER PRIMARY KEY AUTOINCREMENT, ' |
147 u'height INTEGER NOT NULL, width INTEGER NOT NULL, filesize INTEGER ' | 147 u'height INTEGER NOT NULL, width INTEGER NOT NULL, filesize INTEGER ' |
148 u'NOT NULL)', | 148 u'NOT NULL)'), |
149 u'properties': | 149 u'properties': ( |
150 u'CREATE TABLE properties (property_key TEXT PRIMARY KEY, ' | 150 u'CREATE TABLE properties (property_key TEXT PRIMARY KEY, ' |
151 u'property_value TEXT )'}] | 151 u'property_value TEXT )')}] |
152 | 152 |
153 CALL_TYPE = { | 153 CALL_TYPE = { |
154 1: u'INCOMING', | 154 1: u'INCOMING', |
155 2: u'OUTGOING', | 155 2: u'OUTGOING', |
156 3: u'MISSED'} | 156 3: u'MISSED'} |
157 | 157 |
158 def ParseCallsRow(self, parser_mediator, row, query=None, **unused_kwargs): | 158 def ParseCallsRow(self, parser_mediator, row, query=None, **unused_kwargs): |
159 """Parses a Call record row. | 159 """Parses a Call record row. |
160 | 160 |
161 Args: | 161 Args: |
(...skipping 30 matching lines...) Expand all Loading... | |
192 | 192 |
193 # The duration is in seconds and the date value in milliseconds. | 193 # The duration is in seconds and the date value in milliseconds. |
194 timestamp += duration * 1000 | 194 timestamp += duration * 1000 |
195 | 195 |
196 date_time = dfdatetime_java_time.JavaTime(timestamp=timestamp) | 196 date_time = dfdatetime_java_time.JavaTime(timestamp=timestamp) |
197 event = time_events.DateTimeValuesEvent(date_time, u'Call Ended') | 197 event = time_events.DateTimeValuesEvent(date_time, u'Call Ended') |
198 parser_mediator.ProduceEventWithEventData(event, event_data) | 198 parser_mediator.ProduceEventWithEventData(event, event_data) |
199 | 199 |
200 | 200 |
201 sqlite.SQLiteParser.RegisterPlugin(AndroidCallPlugin) | 201 sqlite.SQLiteParser.RegisterPlugin(AndroidCallPlugin) |
LEFT | RIGHT |