Added messaging and email client artifact definitions (#520)

ForensicArtifacts · Jul 25, 2022 · 340ab15 · 340ab15
1 parent 1d27053
commit 340ab15
Show file tree

Hide file tree

Showing 2 changed files with 39 additions and 0 deletions.
diff --git a/data/applications.yaml b/data/applications.yaml
@@ -115,3 +115,21 @@ sources:
     - '%%environ_programfilesx86%%\Microsoft SQL Server\*\MSSQL\LOG\ERRORLOG*'
     separator: '\'
 supported_os: [Windows]
+---
+name: MozillaThunderbird
+doc: Mozilla Thunderbird files.
+sources:
+- type: FILE
+  attributes: {paths: ['%%users.homedir%%/.thunderbird/**']}
+supported_os: [Linux]
+---
+name: GnomeEvolution
+doc: Gnome Evolution files.
+sources:
+- type: FILE
+  attributes:
+    paths:
+    - '%%users.homedir%%/.cache/evolution/**'
+    - '%%users.homedir%%/.config/evolution/**'
+    - '%%users.homedir%%/.local/share/evolution/**'
+supported_os: [Linux]
diff --git a/data/instant_messaging.yaml b/data/instant_messaging.yaml
@@ -48,3 +48,24 @@ sources:
   supported_os: [Darwin]
 supported_os: [Darwin]
 urls: ['https://forensicswiki.xyz/wiki/index.php?title=Mac_OS_X_10.9_-_Artifacts_Location#Skype']
+---
+name: SignalApplicationContent
+doc: Signal Application Content and Configuration
+sources:
+- type: FILE
+  attributes:
+    paths:
+    - '%%users.homedir%%/.var/app/org.signal.Signal/*/attachments.noindex/*'
+    - '%%users.homedir%%/.var/app/org.signal.Signal/*/Cache/*'
+    - '%%users.homedir%%/.var/app/org.signal.Signal/*/logs/*'
+    - '%%users.homedir%%/.var/app/org.signal.Signal/config.json'
+  supported_os: [Linux]
+supported_os: [Linux]
+---
+name: SignalDatabase
+doc: Signal Database file.
+sources:
+- type: FILE
+  attributes: {paths: ['%%users.homedir%%/.var/app/org.signal.Signal/db.sqlite']}
+  supported_os: [Linux]
+supported_os: [Linux]