Repository navigation
Expand file tree
/
Copy pathGmail.py
More file actions
126 lines (98 loc) · 4.16 KB
/
Copy pathGmail.py
File metadata and controls
126 lines (98 loc) · 4.16 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
# Module Description: Parses Gmail label details and offline search content
# Author: @KevinPagano3
# Date: 2022-04-21
# Artifact version: 0.0.1
# Requirements: none
import scripts.artifacts.artGlobals
from packaging import version
from scripts.artifact_report import ArtifactHtmlReport
from scripts.ilapfuncs import logfunc, logdevinfo, timeline, kmlgen, tsv, is_platform_windows, open_sqlite_db_readonly
def get_Gmail(files_found, report_folder, seeker, wrap_text):
for file_found in files_found:
file_found = str(file_found)
if file_found.endswith('searchsqlitedb'):
search_db = file_found
if file_found.endswith('sqlitedb'):
main_db = file_found
db = open_sqlite_db_readonly(search_db)
cursor = db.cursor()
cursor.execute('''
select
datetime(c0/1000,'unixepoch'),
c3 as 'Sender',
c4 as 'Receiver',
c5 as 'CC',
c6 as 'BCC',
c7 as 'Subject',
c8 as 'Body',
c1 as 'Thread ID',
c2 as 'Message ID'
from offline_search_content
''')
all_rows = cursor.fetchall()
usageentries = len(all_rows)
data_list = []
if usageentries > 0:
for row in all_rows:
sender = row[1]
sender_split = [sender_split.strip() for sender_split in sender.split(',')]
if len(sender_split) < 2:
sender_title = sender_split[0]
sender_email = ''
else:
sender_title = sender_split[0]
sender_email = sender_split[1]
data_list.append((row[0], sender_title, sender_email, row[2], row[3], row[4], row[5], row[6], row[7], row[8]))
description = 'Gmail - Offline Search'
report = ArtifactHtmlReport('Gmail - Offline Search')
report.start_artifact_report(report_folder, 'Gmail - Offline Search')
report.add_script()
data_headers = (
'Timestamp','Sender Name','Sender Email','Receiver','CC','BCC','Subject','Body','Thread ID','Message ID') # Don't remove the comma, that is required to make this a tuple as there is only 1 element
report.write_artifact_data_table(data_headers, data_list, file_found)
report.end_artifact_report()
tsvname = f'Gmail - Offline Search'
tsv(report_folder, data_headers, data_list, tsvname)
tlactivity = f'Gmail - Offline Search'
timeline(report_folder, tlactivity, data_list, data_headers)
else:
logfunc('Gmail - Offline Search data available')
db.close()
db = open_sqlite_db_readonly(main_db)
cursor = db.cursor()
cursor.execute('''
select
label_server_perm_id,
unread_count,
total_count,
unseen_count
from label_counts
order by label_server_perm_id
''')
all_rows = cursor.fetchall()
usageentries = len(all_rows)
data_list = []
if usageentries > 0:
for row in all_rows:
data_list.append((row[0], row[1], row[2], row[3]))
description = 'Gmail - Label Details'
report = ArtifactHtmlReport('Gmail - Label Details')
report.start_artifact_report(report_folder, 'Gmail - Label Details')
report.add_script()
data_headers = (
'Label','Unread Count','Total Count','Unseen Count') # Don't remove the comma, that is required to make this a tuple as there is only 1 element
report.write_artifact_data_table(data_headers, data_list, file_found)
report.end_artifact_report()
tsvname = f'Gmail - Label Details'
tsv(report_folder, data_headers, data_list, tsvname)
tlactivity = f'Gmail - Label Details'
timeline(report_folder, tlactivity, data_list, data_headers)
else:
logfunc('Gmail - Label Details data available')
db.close()
__artifacts__ = {
"gmail": (
"gmail",
('**/private/var/mobile/Containers/Data/Application/*/Library/Application Support/data/*/searchsqlitedb*','**/private/var/mobile/Containers/Data/Application/*/Library/Application Support/data/*/sqlitedb*'),
get_Gmail)
}