Repository navigation
Expand file tree
/
Copy pathcallHistory.py
More file actions
77 lines (65 loc) · 2.25 KB
/
Copy pathcallHistory.py
File metadata and controls
77 lines (65 loc) · 2.25 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
import sqlite3
from scripts.artifact_report import ArtifactHtmlReport
from scripts.ilapfuncs import logfunc, tsv, timeline, is_platform_windows, open_sqlite_db_readonly
def get_callHistory(files_found, report_folder, seeker, wrap_text):
for file_found in files_found:
file_found = str(file_found)
if file_found.endswith('.storedata'):
break
db = open_sqlite_db_readonly(file_found)
cursor = db.cursor()
cursor.execute('''
select
datetime(ZDATE+978307200,'unixepoch'),
ZADDRESS,
ZNAME,
case ZANSWERED
when 0 then 'No'
when 1 then 'Yes'
end,
case ZCALLTYPE
when 0 then 'Third-Party App'
when 1 then 'Phone'
when 8 then 'FaceTime Video'
when 16 then 'FaceTime Audio'
else ZCALLTYPE
end,
case ZORIGINATED
when 0 then 'Incoming'
when 1 then 'Outgoing'
end,
strftime('%H:%M:%S',ZDURATION, 'unixepoch'),
upper(ZISO_COUNTRY_CODE),
ZLOCATION,
ZSERVICE_PROVIDER
from ZCALLRECORD
''')
all_rows = cursor.fetchall()
usageentries = len(all_rows)
data_list = []
if usageentries > 0:
for row in all_rows:
an = str(row[1])
an = an.replace("b'", "")
an = an.replace("'", "")
data_list.append((row[0], an, row[2], row[3], row[4], row[5], row[6], row[7], row[8], row[9]))
report = ArtifactHtmlReport('Call History')
report.start_artifact_report(report_folder, 'Call History')
report.add_script()
data_headers = ('Timestamp', 'Phone Number', 'Name', 'Answered', 'Call Type', 'Call Direction', 'Call Duration', 'ISO Country Code', 'Location', 'Service Provider')
report.write_artifact_data_table(data_headers, data_list, file_found)
report.end_artifact_report()
tsvname = 'Call History'
tsv(report_folder, data_headers, data_list, tsvname)
tlactivity = 'Call History'
timeline(report_folder, tlactivity, data_list, data_headers)
else:
logfunc('No Call History data available')
db.close()
return
__artifacts__ = {
"callhistory": (
"Call History",
('**/CallHistory.storedata*'),
get_callHistory)
}