Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion scripts/artifacts/AVG.py
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@
"notes": "",
"paths": ('*/com.antivirus/shared_prefs/PinSettingsImpl.xml', '*/Vault/*'),
"output_types": "standard",
"artifact_icon": "image",
"artifact_icon": "photo",
}
}

Expand Down
2 changes: 1 addition & 1 deletion scripts/artifacts/BadooChat.py
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@
"notes": "",
"paths": ('*com.badoo.mobile/databases/ChatComDatabase*',),
"output_types": "standard",
"artifact_icon": "message-square",
"artifact_icon": "message",
}
}

Expand Down
2 changes: 1 addition & 1 deletion scripts/artifacts/ChessComAccount.py
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
"notes": "",
"paths": ('*/com.chess/shared_prefs/com.chess.app.login_credentials.xml', '*/data/com.chess/shared_prefs/com.chess.app.session_preferences.xml'),
"output_types": ['html', 'tsv', 'lava'],
"artifact_icon": "grid",
"artifact_icon": "layout-grid",
}
}

Expand Down
2 changes: 1 addition & 1 deletion scripts/artifacts/ChessComFriends.py
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
"notes": "",
"paths": ('*/com.chess/databases/chess-database*',),
"output_types": ['html', 'tsv', 'lava'],
"artifact_icon": "grid",
"artifact_icon": "layout-grid",
}
}

Expand Down
2 changes: 1 addition & 1 deletion scripts/artifacts/ChessComGames.py
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
"notes": "",
"paths": ('*/com.chess/databases/chess-database*', '*/data/com.chess/shared_prefs/com.chess.app.session_preferences.xml'),
"output_types": ['html', 'tsv', 'lava'],
"artifact_icon": "grid",
"artifact_icon": "layout-grid",
}
}

Expand Down
2 changes: 1 addition & 1 deletion scripts/artifacts/ChessComMessages.py
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
"notes": "",
"paths": ('*/com.chess/databases/chess-database*',),
"output_types": ['html', 'tsv', 'lava'],
"artifact_icon": "message-square",
"artifact_icon": "message",
}
}

Expand Down
2 changes: 1 addition & 1 deletion scripts/artifacts/ChessWithFriends.py
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
"notes": "",
"paths": ('*/com.zynga.chess.googleplay/databases/wf_database.sqlite', '*/data/com.zynga.chess.googleplay/db/wf_database.sqlite'),
"output_types": ['html', 'tsv', 'lava'],
"artifact_icon": "grid",
"artifact_icon": "layout-grid",
}
}

Expand Down
53 changes: 26 additions & 27 deletions scripts/artifacts/Deepseek_ChatMessages.py
Original file line number Diff line number Diff line change
@@ -1,5 +1,4 @@
import json
import html
#import markdown

from datetime import datetime, timezone
Expand All @@ -21,7 +20,7 @@
"notes": "",
"paths": ('*/data/com.deepseek.chat/databases/deepseek_chat_*.db'),
"output_types": ["html", "lava", "tsv"],
"artifact_icon": "message-square",
"artifact_icon": "message",
"html_columns": ["Message Content"]
}
}
Expand All @@ -47,27 +46,27 @@ def extract_content_from_fragments(fragments):

#HTML conversion removed because LAVA will support markdown.
#HTML escape not allowed do to possible avenue for injection attacks
''''
full_text = html.unescape(full_text)

rendered_html = markdown.markdown(
full_text,
extensions=[
"extra",
"nl2br",
"sane_lists"
]
)
'''
# ''''
# full_text = html.unescape(full_text)

# rendered_html = markdown.markdown(
# full_text,
# extensions=[
# "extra",
# "nl2br",
# "sane_lists"
# ]
# )
# '''

return full_text

except Exception:
except Exception: # pylint: disable=broad-exception-caught
return (str(fragments))


@artifact_processor
def deepseek_chat_messages(files_found, report_folder, seeker, wrap_text):
def deepseek_chat_messages(files_found, _report_folder, _seeker, _wrap_text):

data_headers = (
('Timestamp', 'datetime'),
Expand Down Expand Up @@ -144,22 +143,22 @@ def deepseek_chat_messages(files_found, report_folder, seeker, wrap_text):
tz=timezone.utc
).strftime('%Y-%m-%d %H:%M:%S')

except Exception:
except Exception: # pylint: disable=broad-exception-caught

inserted_at_utc = str(inserted_at)

content = extract_content_from_fragments(
fragments
)

'''
chat_html = f
<div class="chat-message">
<div class="chat-content">
{content}
</div>
</div>
'''
# '''
# chat_html = f
# <div class="chat-message">
# <div class="chat-content">
# {content}
# </div>
# </div>
# '''

data_list.append((
lava_timestamp,
Expand All @@ -169,10 +168,10 @@ def deepseek_chat_messages(files_found, report_folder, seeker, wrap_text):
content
))

except Exception as e:
except Exception as e: # pylint: disable=broad-exception-caught
print(f"Error processing table {table_name}: {e}")

except Exception as e:
except Exception as e: # pylint: disable=broad-exception-caught
print(f"Error processing database {source_path}: {e}")

finally:
Expand Down
6 changes: 3 additions & 3 deletions scripts/artifacts/DuckDuckGo.py
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@
"notes": "Tested on version 5.255.0 (Oct, 31st 2025)",
"paths": ('*/com.duckduckgo.mobile.android/databases/app.db*','*/com.duckduckgo.mobile.android/cache/tabPreviews/*/*.jpg'),
"output_types": ["html", "tsv", "lava"],
"artifact_icon": "book-open"
"artifact_icon": "book"
},
"duckduckgo_fireproof": {
"name": "DuckDuckGo - FireProof Sites",
Expand Down Expand Up @@ -90,7 +90,7 @@
"notes": "",
"paths": ('*/com.duckduckgo.mobile.android/cache/tabPreviews/*/*.jpg','*/com.duckduckgo.mobile.android/databases/app.db*'),
"output_types": ["html", "tsv", "timeline", "lava"],
"artifact_icon": "image"
"artifact_icon": "photo"
},
"duckduckgo_duckai": {
"name": "DuckDuckGo - Duck AI",
Expand All @@ -103,7 +103,7 @@
"notes": "Tested on version 5.255.0 (Oct, 31st 2025)",
"paths": ('*com.duckduckgo.mobile.android/app_webview/Default/Local Storage/leveldb/*'),
"output_types": ["html", "tsv", "lava"],
"artifact_icon": "message-square"
"artifact_icon": "message"
},
"duckduckgo_cookies": {
"name": "DuckDuckGo - Cookies",
Expand Down
6 changes: 3 additions & 3 deletions scripts/artifacts/FCMQueuedMessagesDump.py
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@
"notes": "",
"paths": ('*/fcm_queued_messages.ldb/*',),
"output_types": "standard",
"artifact_icon": "message-square",
"artifact_icon": "message",
},
"get_fcm_dump_tiktok": {
"name": "FCM Decoded - TikTok",
Expand All @@ -37,7 +37,7 @@
"notes": "",
"paths": ('*/fcm_queued_messages.ldb/*',),
"output_types": "standard",
"artifact_icon": "message-square",
"artifact_icon": "message",
},
"get_fcm_dump_instagram": {
"name": "FCM Decoded - Instagram",
Expand All @@ -50,7 +50,7 @@
"notes": "",
"paths": ('*/fcm_queued_messages.ldb/*',),
"output_types": "standard",
"artifact_icon": "message-square",
"artifact_icon": "message",
},
"get_fcm_dump_gqsb": {
"name": "FCM Decoded - Geolocation",
Expand Down
2 changes: 1 addition & 1 deletion scripts/artifacts/FCMQueuedMessagesJungrammer.py
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@
"notes": "",
"paths": ('*/fcm_queued_messages.ldb/*',),
"output_types": "standard",
"artifact_icon": "message-square",
"artifact_icon": "message",
}
}

Expand Down
2 changes: 1 addition & 1 deletion scripts/artifacts/FCMQueuedMessagesSkype.py
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@
"notes": "",
"paths": ('*/fcm_queued_messages.ldb/*',),
"output_types": "standard",
"artifact_icon": "message-square",
"artifact_icon": "message",
},
"get_fcm_skype_notifications": {
"name": "FCM - Skype and Teams Notifications",
Expand Down
2 changes: 1 addition & 1 deletion scripts/artifacts/FCMQueuedMessagesTumblr.py
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@
"notes": "",
"paths": ('*/fcm_queued_messages.ldb/*',),
"output_types": "standard",
"artifact_icon": "message-square",
"artifact_icon": "message",
},
"get_fcm_tumblr_flagged": {
"name": "FCM - Tumblr Flagged Posts",
Expand Down
2 changes: 1 addition & 1 deletion scripts/artifacts/FCMQueuedMessagesTwitter.py
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@
"notes": "",
"paths": ('*/fcm_queued_messages.ldb/*',),
"output_types": "standard",
"artifact_icon": "message-square",
"artifact_icon": "message",
}
}

Expand Down
2 changes: 1 addition & 1 deletion scripts/artifacts/FCMQueuedMessagesXbox.py
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@
"notes": "",
"paths": ('*/fcm_queued_messages.ldb/*',),
"output_types": "standard",
"artifact_icon": "message-square",
"artifact_icon": "message",
},
"get_fcm_xbox_party": {
"name": "FCM - Xbox Party Invites",
Expand Down
4 changes: 2 additions & 2 deletions scripts/artifacts/FacebookMessenger.py
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@
"notes": "",
"paths": ('*/msys_database*',),
"output_types": "standard",
"artifact_icon": "message-square",
"artifact_icon": "message",
"data_views": {
"conversation": {
"conversationDiscriminatorColumn": "Thread Key",
Expand Down Expand Up @@ -73,7 +73,7 @@
"notes": "",
"paths": ('*/*threads_db2',),
"output_types": "standard",
"artifact_icon": "message-square",
"artifact_icon": "message",
},
"get_fb_threads_calls": {
"name": "Facebook Messenger - Calls (threads_db2)",
Expand Down
2 changes: 1 addition & 1 deletion scripts/artifacts/HideX.py
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
"notes": "",
"paths": ('*/com.flatfish.cal.privacy/databases/hidex.db*',),
"output_types": ['html', 'tsv', 'lava'],
"artifact_icon": "message-square",
"artifact_icon": "message",
}
}

Expand Down
2 changes: 1 addition & 1 deletion scripts/artifacts/L360petprofile.py
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
'notes': '',
'paths': ('*/com.life360.android.safetymapd/databases/PetProfileRoomDatabase*',),
'output_types': 'standard',
'artifact_icon': 'smile'
'artifact_icon': 'mood-smile'
}
}

Expand Down
2 changes: 1 addition & 1 deletion scripts/artifacts/LinkedIn.py
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@
"conversationLabelColumn": "Conversation Label"
}
},
"artifact_icon": "message-square"
"artifact_icon": "message"
}
}

Expand Down
2 changes: 1 addition & 1 deletion scripts/artifacts/NQ_Vault.py
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@
"paths": ('*/emulated/0/Android/data/com.netqin.ps/files/Documents/SystemAndroid/Data/322w465ay423xy11',
'*/SystemAndroid/Data/**', '/media/0/SystemAndroid/Data/322w465ay423xy11'),
"output_types": "standard",
"artifact_icon": "image",
"artifact_icon": "photo",
}
}

Expand Down
6 changes: 3 additions & 3 deletions scripts/artifacts/OrnetBrowser.py
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@
"notes": "Tested on version 1.9.26 (Oct, 22nd 2025)",
"paths": ('*/com.ornet.torbrowser/databases/appDatabase','*/com.ornet.torbrowser/cache/tabPreviews/*/*.jpg'),
"output_types": ["html", "tsv", "lava"],
"artifact_icon": "book-open"
"artifact_icon": "book"
},
"ornetbrowser_frequents": {
"name": "Ornet Browser - Frequents",
Expand Down Expand Up @@ -90,7 +90,7 @@
"notes": "Tested on version 1.9.26 (Oct, 22nd 2025)",
"paths": ('*/com.ornet.torbrowser/cache/tabPreviews/*/*.jpg','*//comcom.ornet.torbrowser/databases/AppDatabase'),
"output_types": ["html", "tsv", "timeline", "lava"],
"artifact_icon": "image"
"artifact_icon": "photo"
},
"ornetbrowser_searchhistory": {
"name": "Ornet Browser - Search History",
Expand Down Expand Up @@ -129,7 +129,7 @@
"notes": "Tested on version 1.9.26 (Oct, 22nd 2025)",
"paths": ('*/com.ornet.torbrowser/shared_prefs/com.ornet.torbrowser_preferences.xml'),
"output_types": ["html", "tsv", "lava"],
"artifact_icon": "info"
"artifact_icon": "info-circle"
}
}

Expand Down
2 changes: 1 addition & 1 deletion scripts/artifacts/RandoChat.py
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@
'*/Android/data/com.random.chat.app/files/Music/RandoChat/*'
),
'output_types': 'standard',
'artifact_icon': 'message-square',
'artifact_icon': 'message',
"html_columns": ["Media File"]
},
'randochat_account': {
Expand Down
2 changes: 1 addition & 1 deletion scripts/artifacts/RomeoDatingApp.py
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@
'*/com.planetromeo.android.app/databases/planetromeo-room.db.*'
),
'output_types': 'standard',
'artifact_icon': 'message-square'
'artifact_icon': 'message'
},
'romeo_dating_contacts': {
'name': 'Romeo Dating App Contacts',
Expand Down
2 changes: 1 addition & 1 deletion scripts/artifacts/SamsungDeviceHealthManagement.py
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@
"notes": "",
"paths": ('*/com.sec.android.sdhms/databases/thermal_log*'),
"output_types": "all",
"artifact_icon": "bar-chart"
"artifact_icon": "chart-bar-popular"
},
"sdhms_temperature": {
"name": "SDHMS Temperature Logs",
Expand Down
2 changes: 1 addition & 1 deletion scripts/artifacts/SamsungTrash.py
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
"*/storage/*/Android/.Trash/*",
),
"output_types": "standard",
"artifact_icon": "trash-2",
"artifact_icon": "trash",
}
}

Expand Down
2 changes: 1 addition & 1 deletion scripts/artifacts/Todoist.py
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
"notes": "",
"paths": ('*/com.todoist/databases/database.db*',),
"output_types": "standard",
"artifact_icon": "check-square",
"artifact_icon": "square-check",
},
"get_Todoist_notes": {
"name": "Todoist - Notes",
Expand Down
Loading
Loading