LEFT | RIGHT |
1 # -*- coding: utf-8 -*- | 1 # -*- coding: utf-8 -*- |
2 """This file contains a parser for the Android SMS database. | 2 """This file contains a parser for the Android SMS database. |
3 | 3 |
4 Android SMS messages are stored in SQLite database files named mmssms.dbs. | 4 Android SMS messages are stored in SQLite database files named mmssms.dbs. |
5 """ | 5 """ |
6 | 6 |
7 from dfdatetime import java_time as dfdatetime_java_time | 7 from dfdatetime import java_time as dfdatetime_java_time |
8 | 8 |
9 from plaso.containers import events | 9 from plaso.containers import events |
10 from plaso.containers import time_events | 10 from plaso.containers import time_events |
(...skipping 30 matching lines...) Expand all Loading... |
41 DESCRIPTION = u'Parser for Android text messages SQLite database files.' | 41 DESCRIPTION = u'Parser for Android text messages SQLite database files.' |
42 | 42 |
43 # Define the needed queries. | 43 # Define the needed queries. |
44 QUERIES = [ | 44 QUERIES = [ |
45 (u'SELECT _id AS id, address, date, read, type, body FROM sms', | 45 (u'SELECT _id AS id, address, date, read, type, body FROM sms', |
46 u'ParseSmsRow')] | 46 u'ParseSmsRow')] |
47 | 47 |
48 # The required tables. | 48 # The required tables. |
49 REQUIRED_TABLES = frozenset([u'sms']) | 49 REQUIRED_TABLES = frozenset([u'sms']) |
50 | 50 |
51 SCHEMAS = [ | 51 SCHEMAS = [{ |
52 {u'addr': | 52 u'addr': ( |
53 u'CREATE TABLE addr (_id INTEGER PRIMARY KEY,msg_id ' | 53 u'CREATE TABLE addr (_id INTEGER PRIMARY KEY, msg_id INTEGER, ' |
54 u'INTEGER,contact_id INTEGER,address TEXT,type INTEGER,charset ' | 54 u'contact_id INTEGER, address TEXT, type INTEGER, charset INTEGER)'), |
55 u'INTEGER)', | 55 u'android_metadata': ( |
56 u'android_metadata': | 56 u'CREATE TABLE android_metadata (locale TEXT)'), |
57 u'CREATE TABLE android_metadata (locale TEXT)', | 57 u'attachments': ( |
58 u'attachments': | 58 u'CREATE TABLE attachments (sms_id INTEGER, content_url TEXT, offset ' |
59 u'CREATE TABLE attachments (sms_id INTEGER,content_url TEXT,offset ' | 59 u'INTEGER)'), |
60 u'INTEGER)', | 60 u'canonical_addresses': ( |
61 u'canonical_addresses': | 61 u'CREATE TABLE canonical_addresses (_id INTEGER PRIMARY KEY ' |
62 u'CREATE TABLE canonical_addresses (_id INTEGER PRIMARY KEY ' | 62 u'AUTOINCREMENT, address TEXT)'), |
63 u'AUTOINCREMENT,address TEXT)', | 63 u'drm': ( |
64 u'drm': | 64 u'CREATE TABLE drm (_id INTEGER PRIMARY KEY, _data TEXT)'), |
65 u'CREATE TABLE drm (_id INTEGER PRIMARY KEY,_data TEXT)', | 65 u'part': ( |
66 u'part': | 66 u'CREATE TABLE part (_id INTEGER PRIMARY KEY AUTOINCREMENT, mid ' |
67 u'CREATE TABLE part (_id INTEGER PRIMARY KEY AUTOINCREMENT,mid ' | 67 u'INTEGER, seq INTEGER DEFAULT 0, ct TEXT, name TEXT, chset INTEGER, ' |
68 u'INTEGER,seq INTEGER DEFAULT 0,ct TEXT,name TEXT,chset INTEGER,cd ' | 68 u'cd TEXT, fn TEXT, cid TEXT, cl TEXT, ctt_s INTEGER, ctt_t TEXT, ' |
69 u'TEXT,fn TEXT,cid TEXT,cl TEXT,ctt_s INTEGER,ctt_t TEXT,_data ' | 69 u'_data TEXT, text TEXT)'), |
70 u'TEXT,text TEXT)', | 70 u'pdu': ( |
71 u'pdu': | 71 u'CREATE TABLE pdu (_id INTEGER PRIMARY KEY AUTOINCREMENT, thread_id ' |
72 u'CREATE TABLE pdu (_id INTEGER PRIMARY KEY AUTOINCREMENT,thread_id ' | 72 u'INTEGER, date INTEGER, date_sent INTEGER DEFAULT 0, msg_box ' |
73 u'INTEGER,date INTEGER,date_sent INTEGER DEFAULT 0,msg_box ' | 73 u'INTEGER, read INTEGER DEFAULT 0, m_id TEXT, sub TEXT, sub_cs ' |
74 u'INTEGER,read INTEGER DEFAULT 0,m_id TEXT,sub TEXT,sub_cs ' | 74 u'INTEGER, ct_t TEXT, ct_l TEXT, exp INTEGER, m_cls TEXT, m_type ' |
75 u'INTEGER,ct_t TEXT,ct_l TEXT,exp INTEGER,m_cls TEXT,m_type INTEGER,v ' | 75 u'INTEGER, v INTEGER, m_size INTEGER, pri INTEGER, rr INTEGER, rpt_a ' |
76 u'INTEGER,m_size INTEGER,pri INTEGER,rr INTEGER,rpt_a INTEGER,resp_st ' | 76 u'INTEGER, resp_st INTEGER, st INTEGER, tr_id TEXT, retr_st INTEGER, ' |
77 u'INTEGER,st INTEGER,tr_id TEXT,retr_st INTEGER,retr_txt ' | 77 u'retr_txt TEXT, retr_txt_cs INTEGER, read_status INTEGER, ct_cls ' |
78 u'TEXT,retr_txt_cs INTEGER,read_status INTEGER,ct_cls ' | 78 u'INTEGER, resp_txt TEXT, d_tm INTEGER, d_rpt INTEGER, locked ' |
79 u'INTEGER,resp_txt TEXT,d_tm INTEGER,d_rpt INTEGER,locked INTEGER ' | 79 u'INTEGER DEFAULT 0, seen INTEGER DEFAULT 0, text_only INTEGER ' |
80 u'DEFAULT 0,seen INTEGER DEFAULT 0,text_only INTEGER DEFAULT 0)', | 80 u'DEFAULT 0)'), |
81 u'pending_msgs': | 81 u'pending_msgs': ( |
82 u'CREATE TABLE pending_msgs (_id INTEGER PRIMARY KEY,proto_type ' | 82 u'CREATE TABLE pending_msgs (_id INTEGER PRIMARY KEY, proto_type ' |
83 u'INTEGER,msg_id INTEGER,msg_type INTEGER,err_type INTEGER,err_code ' | 83 u'INTEGER, msg_id INTEGER, msg_type INTEGER, err_type INTEGER, ' |
84 u'INTEGER,retry_index INTEGER NOT NULL DEFAULT 0,due_time ' | 84 u'err_code INTEGER, retry_index INTEGER NOT NULL DEFAULT 0, due_time ' |
85 u'INTEGER,last_try INTEGER)', | 85 u'INTEGER, last_try INTEGER)'), |
86 u'rate': | 86 u'rate': ( |
87 u'CREATE TABLE rate (sent_time INTEGER)', | 87 u'CREATE TABLE rate (sent_time INTEGER)'), |
88 u'raw': | 88 u'raw': ( |
89 u'CREATE TABLE raw (_id INTEGER PRIMARY KEY,date ' | 89 u'CREATE TABLE raw (_id INTEGER PRIMARY KEY, date INTEGER, ' |
90 u'INTEGER,reference_number INTEGER,count INTEGER,sequence ' | 90 u'reference_number INTEGER, count INTEGER, sequence INTEGER, ' |
91 u'INTEGER,destination_port INTEGER,address TEXT,pdu TEXT)', | 91 u'destination_port INTEGER, address TEXT, pdu TEXT)'), |
92 u'sms': | 92 u'sms': ( |
93 u'CREATE TABLE sms (_id INTEGER PRIMARY KEY,thread_id INTEGER,address ' | 93 u'CREATE TABLE sms (_id INTEGER PRIMARY KEY, thread_id INTEGER, ' |
94 u'TEXT,person INTEGER,date INTEGER,date_sent INTEGER DEFAULT ' | 94 u'address TEXT, person INTEGER, date INTEGER, date_sent INTEGER ' |
95 u'0,protocol INTEGER,read INTEGER DEFAULT 0,status INTEGER DEFAULT ' | 95 u'DEFAULT 0, protocol INTEGER, read INTEGER DEFAULT 0, status ' |
96 u'-1,type INTEGER,reply_path_present INTEGER,subject TEXT,body ' | 96 u'INTEGER DEFAULT -1, type INTEGER, reply_path_present INTEGER, ' |
97 u'TEXT,service_center TEXT,locked INTEGER DEFAULT 0,error_code ' | 97 u'subject TEXT, body TEXT, service_center TEXT, locked INTEGER ' |
98 u'INTEGER DEFAULT 0,seen INTEGER DEFAULT 0)', | 98 u'DEFAULT 0, error_code INTEGER DEFAULT 0, seen INTEGER DEFAULT 0)'), |
99 u'sr_pending': | 99 u'sr_pending': ( |
100 u'CREATE TABLE sr_pending (reference_number INTEGER,action TEXT,data ' | 100 u'CREATE TABLE sr_pending (reference_number INTEGER, action TEXT, ' |
101 u'TEXT)', | 101 u'data TEXT)'), |
102 u'threads': | 102 u'threads': ( |
103 u'CREATE TABLE threads (_id INTEGER PRIMARY KEY AUTOINCREMENT,date ' | 103 u'CREATE TABLE threads (_id INTEGER PRIMARY KEY AUTOINCREMENT, date ' |
104 u'INTEGER DEFAULT 0,message_count INTEGER DEFAULT 0,recipient_ids ' | 104 u'INTEGER DEFAULT 0, message_count INTEGER DEFAULT 0, recipient_ids ' |
105 u'TEXT,snippet TEXT,snippet_cs INTEGER DEFAULT 0,read INTEGER DEFAULT ' | 105 u'TEXT, snippet TEXT, snippet_cs INTEGER DEFAULT 0, read INTEGER ' |
106 u'1,type INTEGER DEFAULT 0,error INTEGER DEFAULT 0,has_attachment ' | 106 u'DEFAULT 1, type INTEGER DEFAULT 0, error INTEGER DEFAULT 0, ' |
107 u'INTEGER DEFAULT 0)', | 107 u'has_attachment INTEGER DEFAULT 0)'), |
108 u'words': | 108 u'words': ( |
109 u'CREATE VIRTUAL TABLE words USING FTS3 (_id INTEGER PRIMARY KEY, ' | 109 u'CREATE VIRTUAL TABLE words USING FTS3 (_id INTEGER PRIMARY KEY, ' |
110 u'index_text TEXT, source_id INTEGER, table_to_use INTEGER)', | 110 u'index_text TEXT, source_id INTEGER, table_to_use INTEGER)'), |
111 u'words_content': | 111 u'words_content': ( |
112 u'CREATE TABLE \'words_content\'(docid INTEGER PRIMARY KEY, ' | 112 u'CREATE TABLE \'words_content\'(docid INTEGER PRIMARY KEY, ' |
113 u'\'c0_id\', \'c1index_text\', \'c2source_id\', \'c3table_to_use\')', | 113 u'\'c0_id\', \'c1index_text\', \'c2source_id\', \'c3table_to_use\')'), |
114 u'words_segdir': | 114 u'words_segdir': ( |
115 u'CREATE TABLE \'words_segdir\'(level INTEGER,idx INTEGER,start_block ' | 115 u'CREATE TABLE \'words_segdir\'(level INTEGER, idx INTEGER, ' |
116 u'INTEGER,leaves_end_block INTEGER,end_block INTEGER,root ' | 116 u'start_block INTEGER, leaves_end_block INTEGER, end_block INTEGER, ' |
117 u'BLOB,PRIMARY KEY(level, idx))', | 117 u'root BLOB, PRIMARY KEY(level, idx))'), |
118 u'words_segments': | 118 u'words_segments': ( |
119 u'CREATE TABLE \'words_segments\'(blockid INTEGER PRIMARY KEY, block ' | 119 u'CREATE TABLE \'words_segments\'(blockid INTEGER PRIMARY KEY, block ' |
120 u'BLOB)'}] | 120 u'BLOB)')}] |
121 | 121 |
122 # TODO: Move this functionality to the formatter. | 122 # TODO: Move this functionality to the formatter. |
123 SMS_TYPE = { | 123 SMS_TYPE = { |
124 1: u'RECEIVED', | 124 1: u'RECEIVED', |
125 2: u'SENT'} | 125 2: u'SENT'} |
126 SMS_READ = { | 126 SMS_READ = { |
127 0: u'UNREAD', | 127 0: u'UNREAD', |
128 1: u'READ'} | 128 1: u'READ'} |
129 | 129 |
130 def ParseSmsRow(self, parser_mediator, row, query=None, **unused_kwargs): | 130 def ParseSmsRow(self, parser_mediator, row, query=None, **unused_kwargs): |
(...skipping 16 matching lines...) Expand all Loading... |
147 event_data.sms_read = self.SMS_READ.get(row['read'], u'UNKNOWN') | 147 event_data.sms_read = self.SMS_READ.get(row['read'], u'UNKNOWN') |
148 event_data.sms_type = self.SMS_TYPE.get(row['type'], u'UNKNOWN') | 148 event_data.sms_type = self.SMS_TYPE.get(row['type'], u'UNKNOWN') |
149 | 149 |
150 date_time = dfdatetime_java_time.JavaTime(timestamp=row['date']) | 150 date_time = dfdatetime_java_time.JavaTime(timestamp=row['date']) |
151 event = time_events.DateTimeValuesEvent( | 151 event = time_events.DateTimeValuesEvent( |
152 date_time, eventdata.EventTimestamp.CREATION_TIME) | 152 date_time, eventdata.EventTimestamp.CREATION_TIME) |
153 parser_mediator.ProduceEventWithEventData(event, event_data) | 153 parser_mediator.ProduceEventWithEventData(event, event_data) |
154 | 154 |
155 | 155 |
156 sqlite.SQLiteParser.RegisterPlugin(AndroidSMSPlugin) | 156 sqlite.SQLiteParser.RegisterPlugin(AndroidSMSPlugin) |
LEFT | RIGHT |