Using Python to extract IPED case data

[joao-fernando]

Hello everyone!
I'm trying to extract item information using a python script based on #42 and #701.
It's the first time I use jnius and my coding and java skills are far from good.

When I try to get the name of any item using item.getName() , I get the error 'iped3.IItem' object has no attribute 'getName'.
So I read the code and of course IItem doesn't have the getName method.
I know I can use item.toString(), but the result is not exactly what I need.

My code is something like this, and it is working fine:

from jnius import autoclass

File = autoclass('java.io.File')
IPEDSource = autoclass("dpf.sp.gpinf.indexer.search.IPEDSource")
iped = IPEDSource(File('PATH_TO_EVIDENCE'))

IPEDSearcher = autoclass("dpf.sp.gpinf.indexer.search.IPEDSearcher")
searcher = IPEDSearcher(iped)

# Search
searcher.setQuery("md5:6314A160D053939B7203125D76EDF267")
ids = searcher.search().getIds()
if ids.empty:
    print('Query returned empty.')
else:
    print(f'\n Query returned {ids.size()} ids')
    for i in range(ids.size()):
        id = ids.get(i)
        item = iped.getItemByID(id)
        attributes = item.getExtraAttributeMap()
        
        # could be enhanced, but gets the job done
        list_attrib = attributes.keySet().toString().replace('[', '').replace(']', '').replace(' ', '').split(',')  
        
        print(id)
        print(f'Nome : {item.toString().split()[1].split("/")[-1].strip()}')  # parsing the name is not straightforward 
        print(f'Categorias : {item.getCategories()}')
        for attrib in list_attrib:
            print(f'{attrib} : {item.getExtraAttribute(attrib)}')

Which classes should I instantiate to extract basic item information?
Thanks in advance!

[lfcnassif]

So I read the code and of course IItem doesn't have the getName method

Actually it does, it extends IItemBase class. I think you've put iped.jar in the CLASSPATH env var (right?), otherwise a similar error would be thrown before. Maybe there is something wrong with your classpath, wrong or different versions of iped.jar in it? Or maybe something misconfigured with jnius installation, not sure...

[lfcnassif]

Just tested code below and worked as expected:

from jnius import autoclass

File = autoclass('java.io.File')
IPEDSource = autoclass("iped.engine.data.IPEDSource")
iped = IPEDSource(File('E:\\teste\\wa-iphone-test-4.0.7'))

IPEDSearcher = autoclass("iped.engine.search.IPEDSearcher")
searcher = IPEDSearcher(iped)

# Search
searcher.setQuery("type:jpg")
ids = searcher.search().getIds()
if ids.isEmpty():
    print('Query returned empty.')
else:
    print(f'\n Query returned {ids.size()} ids')
    for i in range(ids.size()):
        id = ids.get(i)
        item = iped.getItemByID(id)
        print(item.getName())

PS: Code above updated to work with IPED 4.x

PS2: Another example: #701

See that ids.empty returns an AttributeError, ids is a java List object and you must use .isEmpty() method.

[lfcnassif]

Tested with python 3.8.6, pyjnius-1.4.1 and OpenJDK-1.8.0_302 x64 on Windows 10 and a Iped 3.18.7 case.

[joao-fernando]

Thanks Nassif!
I had several Javas installed... Removed them all and installed OpenJDK "1.8.0_312" x64.
Using Python 3.9.7, reinstalled everything needed and now it's working fine.