Convert mailprotect (Apple Email) to LAVA @artifact_processor (iOS 13+)#1600
Merged
Conversation
Convert the legacy 'function'-key life360 parser into four @artifact_processor artifacts: Locations (KML), Device Battery, Chat Messages, Members. - Store UTC: drop convert_utc_human_to_timezone (examiner-local); location time comes straight from the geolocation timestamp as aware UTC, chat times via the SQL unixepoch + convert_ts_human_to_utc. - Members: keep the avatar URL as plain text (was wrapped in an inline <img>); tag the Phone column with the 'phonenumber' LAVA type; fix the 'Cirle Name' -> 'Circle Name' header typo. - Replace the 'from datetime import *' wildcard with explicit imports. - creation_date/last_update_date; keys match function names. Author preserved (@KevinPagano3). Validation: pylint 10.00; log parsing produces UTC location/battery rows on sample data; reserved-word/CREATE TABLE clean; names unique; PluginLoader loads all 577.
Convert the legacy 'function'-key Apple Mail parser to @artifact_processor/context. - Drop the broken legacy iOS <13 path (per maintainer decision): it reused a cursor from an already-closed temp DB and INSERTed into a read-only-attached database, so it could not run; iOS <13 is no longer supported. - iOS 13+ path: attach Protected Index to Envelope Index via get_sqlite_db_records' attach_query; both opened read-only (evidence is never modified). - Store UTC: drop the convert_utc_human_to_timezone examiner-local shift (SQL emits UTC); remove the manual lava_process_artifact/lava_insert in favor of the pipeline. - Remove the deprecated version field and the redundant function key; keep the existing creation_date/last_update_date. Author preserved (@abrignoni - @stark4n6). Validation: pylint 10.00; runtime-tested the Protected Index attach + join (correct UTC timestamps and column alignment); reserved-word/CREATE TABLE clean; PluginLoader loads.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Converts the legacy
"function"-key Apple Mail parser to@artifact_processor/context.Changes
close()d temp DB andINSERTed into a read-only-attached database — it could not actually run. iOS <13 is no longer supported.get_sqlite_db_records'attach_query; both opened read-only (evidence is never modified).convert_utc_human_to_timezoneexaminer-local shift (SQL emits UTC); removed the manuallava_process_artifact/lava_insertfor the@appipeline.versionfield and the redundantfunctionkey; kept the existingcreation_date/last_update_date. Author preserved (@abrignoni - @stark4n6).Validation