Skip to content

Commit

Permalink
Updated artifacts
Browse files Browse the repository at this point in the history
  • Loading branch information
abrignoni committed Jul 15, 2022
1 parent 180dcbc commit 964a510
Show file tree
Hide file tree
Showing 243 changed files with 1,110 additions and 224 deletions.
Empty file modified LICENSE
100644 → 100755
Empty file.
Empty file modified README.md
100644 → 100755
Empty file.
4 changes: 0 additions & 4 deletions aleapp.py
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -148,10 +148,6 @@ def crunch_artifacts(
for pathh in found:
if pathh.startswith('\\\\?\\'):
pathh = pathh[4:]
<<<<<<< Updated upstream
=======
#logfunc(f'Files for {artifact_search_regex} located at {pathh}')
>>>>>>> Stashed changes
log.write(f'Files for {artifact_search_regex} located at {pathh}<br><br>')
files_found.extend(found)
if files_found:
Expand Down
Empty file modified aleapp.spec
100644 → 100755
Empty file.
2 changes: 1 addition & 1 deletion aleappGUI.py
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@ def pickModules():
loader = plugin_loader.PluginLoader()

indx = MODULE_START_INDEX # arbitrary number to not interfere with other controls
for plugin in sorted(loader.plugins, key=lambda p: p.name.upper()):
for plugin in sorted(loader.plugins, key=lambda p: p.category.upper()):
disabled = plugin.module_name == 'usagestatsVersion'
mlist.append(CheckList(f'{plugin.category} [{plugin.name} - {plugin.module_name}.py]', indx, plugin.name, disabled))
indx = indx + 1
Expand Down
2 changes: 1 addition & 1 deletion aleappGUI.spec
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -36,4 +36,4 @@ exe = EXE(pyz,
upx=True,
console=False,
upx_exclude=[],
runtime_tmpdir=None )
runtime_tmpdir=None )
Empty file modified hook-plugin_loader.py
100644 → 100755
Empty file.
Empty file modified plugin_loader.py
100644 → 100755
Empty file.
Empty file modified requirements.txt
100644 → 100755
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/css/addons/datatables-select.min.css
100644 → 100755
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/css/addons/datatables.min.css
100644 → 100755
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/css/addons/directives.min.css
100644 → 100755
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/css/addons/flag.min.css
100644 → 100755
Empty file.
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/css/addons/rating.min.css
100644 → 100755
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/css/bootstrap.css
100644 → 100755
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/css/bootstrap.min.css
100644 → 100755
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/css/mdb.css
100644 → 100755
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/css/mdb.lite.css
100644 → 100755
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/css/mdb.lite.min.css
100644 → 100755
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/css/mdb.min.css
100644 → 100755
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/css/modules/animations-extended.min.css
100644 → 100755
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/css/style.css
100644 → 100755
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/img/overlays/01.png
100644 → 100755
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Empty file modified scripts/MDB-Free_4.13.0/img/overlays/02.png
100644 → 100755
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Empty file modified scripts/MDB-Free_4.13.0/img/overlays/03.png
100644 → 100755
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Empty file modified scripts/MDB-Free_4.13.0/img/overlays/04.png
100644 → 100755
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Empty file modified scripts/MDB-Free_4.13.0/img/overlays/05.png
100644 → 100755
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Empty file modified scripts/MDB-Free_4.13.0/img/overlays/06.png
100644 → 100755
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Empty file modified scripts/MDB-Free_4.13.0/img/overlays/07.png
100644 → 100755
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Empty file modified scripts/MDB-Free_4.13.0/img/overlays/08.png
100644 → 100755
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Empty file modified scripts/MDB-Free_4.13.0/img/overlays/09.png
100644 → 100755
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Empty file modified scripts/MDB-Free_4.13.0/img/svg/arrow_left.svg
100644 → 100755
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Empty file modified scripts/MDB-Free_4.13.0/img/svg/arrow_right.svg
100644 → 100755
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Empty file modified scripts/MDB-Free_4.13.0/js/addons/datatables-select.min.js
100644 → 100755
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/js/addons/datatables.min.js
100644 → 100755
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/js/addons/directives.min.js
100644 → 100755
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/js/addons/flag.min.js
100644 → 100755
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/js/addons/imagesloaded.pkgd.min.js
100644 → 100755
Empty file.
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/js/addons/masonry.pkgd.min.js
100644 → 100755
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/js/addons/rating.min.js
100644 → 100755
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/js/bootstrap.js
100644 → 100755
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/js/bootstrap.min.js
100644 → 100755
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/js/jquery.js
100644 → 100755
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/js/jquery.min.js
100644 → 100755
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/js/mdb.js
100644 → 100755
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/js/mdb.min.js
100644 → 100755
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/js/modules/animations-extended.min.js
100644 → 100755
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/js/modules/forms-free.min.js
100644 → 100755
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/js/modules/scrolling-navbar.min.js
100644 → 100755
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/js/modules/treeview.min.js
100644 → 100755
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/js/modules/wow.min.js
100644 → 100755
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/js/popper.js
100644 → 100755
Empty file.
Empty file modified scripts/MDB-Free_4.13.0/js/popper.min.js
100644 → 100755
Empty file.
Empty file modified scripts/artifact_report.py
100644 → 100755
Empty file.
9 changes: 8 additions & 1 deletion scripts/artifacts/AVG.py
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -317,4 +317,11 @@ def get_AVG(files_found, report_folder, seeker, wrap_text):
tsvname = f'AVG - Media Files'
tsv(report_folder, data_headers, media_data_list, tsvname)
else:
logfunc('No files found to decrypt')
logfunc('No files found to decrypt')

__artifacts__ = {
"AVG": (
"Encrypting Media Apps",
('*/data/data/com.antivirus/shared_prefs/PinSettingsImpl.xml', '*/Vault/*'),
get_AVG)
}
9 changes: 8 additions & 1 deletion scripts/artifacts/BashHistory.py
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -25,4 +25,11 @@ def get_BashHistory(files_found, report_folder, seeker, wrap_text):
tsv(report_folder, data_headers, data_list, tsvname)

else:
logfunc(f'No Bash History file available')
logfunc(f'No Bash History file available')

__artifacts__ = {
"Bash History": (
"Bash History",
('**/.bash_history'),
get_BashHistory)
}
8 changes: 7 additions & 1 deletion scripts/artifacts/Cast.py
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -62,4 +62,10 @@ def get_Cast(files_found, report_folder, seeker, wrap_text):
logfunc('No Cast data available')

db.close()
return

__artifacts__ = {
"Cast": (
"Cast",
('*/com.google.android.gms/databases/cast.db'),
get_Cast)
}
8 changes: 7 additions & 1 deletion scripts/artifacts/Cello.py
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -132,4 +132,10 @@ def get_Cello(files_found, report_folder, seeker, wrap_text):
logfunc('No Google Drive - Cello data available')

db.close()
return

__artifacts__ = {
"Cello": (
"Google Drive",
('*/com.google.android.apps.docs/app_cello/*/cello.db*', '*/com.google.android.apps.docs/files/shiny_blobs/blobs/*'),
get_Cello)
}
8 changes: 7 additions & 1 deletion scripts/artifacts/ChessComAccount.py
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -48,5 +48,11 @@ def get_ChessComAccount(files_found, report_folder, seeker, wrap_text):

tsv(report_folder, data_headers, data_list, title)


__artifacts__ = {
"ChessComAcct": (
"Chess.com",
('*/data/data/com.chess/shared_prefs/com.chess.app.login_credentials.xml', '*/data/data/com.chess/shared_prefs/com.chess.app.session_preferences.xml'),
get_ChessComAccount)
}


7 changes: 6 additions & 1 deletion scripts/artifacts/ChessComFriends.py
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -31,5 +31,10 @@ def get_ChessComFriends(files_found, report_folder, seeker, wrap_text):

tsv(report_folder, data_headers, data_list, title)


__artifacts__ = {
"ChessComFriends": (
"Chess.com",
('*/data/data/com.chess/databases/chess-database*'),
get_ChessComFriends)
}

6 changes: 6 additions & 0 deletions scripts/artifacts/ChessComGames.py
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -43,5 +43,11 @@ def get_ChessComGames(files_found, report_folder, seeker, wrap_text):

tsv(report_folder, data_headers, data_list, title)

__artifacts__ = {
"ChessComGames": (
"Chess.com",
('*/data/data/com.chess/databases/chess-database*', '*/data/data/com.chess/shared_prefs/com.chess.app.session_preferences.xml'),
get_ChessComGames)
}


7 changes: 6 additions & 1 deletion scripts/artifacts/ChessComMessages.py
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -31,5 +31,10 @@ def get_ChessComMessages(files_found, report_folder, seeker, wrap_text):

tsv(report_folder, data_headers, data_list, title)


__artifacts__ = {
"ChessComMessages": (
"Chess.com",
('*/data/data/com.chess/databases/chess-database*'),
get_ChessComMessages)
}

9 changes: 7 additions & 2 deletions scripts/artifacts/ChessWithFriends.py
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -46,5 +46,10 @@ def get_ChessWithFriends(files_found, report_folder, seeker, wrap_text):
logfunc('No Chess With Friends data available')

db.close()
return


__artifacts__ = {
"ChessWithFriends": (
"Chats",
('*/data/data/com.zynga.chess.googleplay/databases/wf_database.sqlite', '*/data/data/com.zynga.chess.googleplay/db/wf_database.sqlite'),
get_ChessWithFriends)
}
8 changes: 7 additions & 1 deletion scripts/artifacts/DocList.py
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -62,4 +62,10 @@ def get_DocList(files_found, report_folder, seeker, wrap_text):
logfunc('No Google Drive - DocList data available')

db.close()
return

__artifacts__ = {
"DocList'": (
"Google Drive",
('*/data/data/com.google.android.apps.docs/databases/DocList.db*'),
get_DocList)
}
9 changes: 7 additions & 2 deletions scripts/artifacts/FacebookMessenger.py
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -205,5 +205,10 @@ def get_FacebookMessenger(files_found, report_folder, seeker, wrap_text):
logfunc(f'No Facebook{typeof}- Contacts data available{usernum}')

db.close()



__artifacts__ = {
"FacebookMessenger": (
"Facebook Messenger",
('*/threads_db2*'),
get_FacebookMessenger)
}
12 changes: 10 additions & 2 deletions scripts/artifacts/FilesByGoogle_FilesMaster.py
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -60,8 +60,16 @@ def get_FilesByGoogle_FilesMaster(files_found, report_folder, seeker, wrap_text)

tlactivity = f'Files By Google - Files Master'
timeline(report_folder, tlactivity, data_list, data_headers)

db.close()
else:
logfunc('No Files By Google - Files Master data available')
db.close()

db.close()
return

__artifacts__ = {
"FilesMaster": (
"Files by Google",
('*/com.google.android.apps.nbu.files/databases/files_master_database*'),
get_FilesByGoogle_FilesMaster)
}
12 changes: 9 additions & 3 deletions scripts/artifacts/FilesByGoogle_SearchHistory.py
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -42,8 +42,14 @@ def get_FilesByGoogle_SearchHistory(files_found, report_folder, seeker, wrap_tex

tlactivity = f'Files By Google - Search History'
timeline(report_folder, tlactivity, data_list, data_headers)
db.close()
else:
logfunc('No Files By Google - Search History data available')

db.close()
return
db.close()

__artifacts__ = {
"FilesSearchHist": (
"Files by Google",
('*/com.google.android.apps.nbu.files/databases/search_history_database*'),
get_FilesByGoogle_SearchHistory)
}
8 changes: 7 additions & 1 deletion scripts/artifacts/HideX.py
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -43,4 +43,10 @@ def get_HideX(files_found, report_folder, seeker, wrap_text):
logfunc('No HideX data available')

db.close()
return

__artifacts__ = {
"HideX": (
"GroupMe",
('*/com.flatfish.cal.privacy/databases/hidex.db*'),
get_HideX)
}
7 changes: 6 additions & 1 deletion scripts/artifacts/NQVault.py
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -190,6 +190,11 @@ def get_NQVault(files_found, report_folder, seeker, wrap_text):
logfunc('No Encrypted Media Present in Database.')
return


__artifacts__ = {
"NQVault": (
"Encrypting Media apps",
('*/emulated/0/Android/data/com.netqin.ps/files/Documents/SystemAndroid/Data/322w465ay423xy11', '*/SystemAndroid/Data/*'),
get_NQVault)
}


8 changes: 7 additions & 1 deletion scripts/artifacts/Oruxmaps.py
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -69,4 +69,10 @@ def get_Oruxmaps(files_found, report_folder, seeker, wrap_text):
logfunc('No Oruxmaps Tracks data available')

db.close()
return

__artifacts__ = {
"Oruxmaps": (
"GEO Location",
('**/oruxmaps/tracklogs/oruxmapstracks.db*'),
get_Oruxmaps)
}
9 changes: 8 additions & 1 deletion scripts/artifacts/Turbo_AppUsage.py
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -43,4 +43,11 @@ def get_Turbo_AppUsage(files_found, report_folder, seeker, wrap_text):
tlactivity = f'Turbo - Application Usage'
timeline(report_folder, tlactivity, data_list, data_headers)
else:
logfunc(f'No Turbo - Application Usage data available')
logfunc(f'No Turbo - Application Usage data available')

__artifacts__ = {
"Turbo_AppUsage": (
"Device Health Services",
('*/com.google.android.apps.turbo/shared_prefs/app_usage_stats.xml'),
get_Turbo_AppUsage)
}
8 changes: 7 additions & 1 deletion scripts/artifacts/Turbo_Battery.py
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -111,4 +111,10 @@ def get_Turbo_Battery(files_found, report_folder, seeker, wrap_text):
logfunc('No Turbo - Bluetooth Device Info data available')

db.close()
return

__artifacts__ = {
"Turbo_Battery": (
"Device Health Services",
('*/com.google.android.apps.turbo/databases/turbo.db*','*/com.google.android.apps.turbo/databases/bluetooth.db*'),
get_Turbo_Battery)
}
7 changes: 6 additions & 1 deletion scripts/artifacts/Viber.py
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -211,4 +211,9 @@ def get_Viber(files_found, report_folder, seeker, wrap_text):

db.close()

return
__artifacts__ = {
"Viber": (
"Viber",
('*/com.viber.voip/databases/*'),
get_Viber)
}
8 changes: 7 additions & 1 deletion scripts/artifacts/WhatsApp.py
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -459,4 +459,10 @@ def get_WhatsApp(files_found, report_folder, seeker, wrap_text):
timeline(report_folder, tlactivity, data_list, data_headers)
else:
logfunc("No WhatsApp - Profile data found")
return

__artifacts__ = {
"WhatsApp": (
"WhatsApp",
('*/com.whatsapp/databases/*.db*','**/com.whatsapp/shared_prefs/com.whatsapp_preferences_light.xml','*/WhatsApp Images/*.*','*/WhatsApp Video/*.*'),
get_WhatsApp)
}
8 changes: 7 additions & 1 deletion scripts/artifacts/WordsWithFriends.py
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -49,4 +49,10 @@ def get_WordsWithFriends(files_found, report_folder, seeker, wrap_text):
logfunc('No Words With Friends data available')

db.close()
return

__artifacts__ = {
"WordsWithFriends": (
"Chats",
('*/com.zynga.words/db/wf_database.sqlite'),
get_WordsWithFriends)
}
8 changes: 7 additions & 1 deletion scripts/artifacts/Xender.py
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -89,4 +89,10 @@ def get_Xender(files_found, report_folder, seeker, wrap_text):
logfunc('No Xender file transfer messages data available')

db.close()
return

__artifacts__ = {
"Xender": (
"File Transfer",
('*/cn.xender/databases/trans-history-db*'),
get_Xender)
}
8 changes: 7 additions & 1 deletion scripts/artifacts/Zapya.py
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -47,4 +47,10 @@ def get_Zapya(files_found, report_folder, seeker, wrap_text):
logfunc('No Zapya data available')

db.close()
return

__artifacts__ = {
"Zapya": (
"File Transfer",
('*/com.dewmobile.kuaiya.play/databases/transfer20.db*'),
get_Zapya)
}
Empty file modified scripts/artifacts/accounts_ce.py
100644 → 100755
Empty file.
Empty file modified scripts/artifacts/accounts_ce_authtokens.py
100644 → 100755
Empty file.
Empty file modified scripts/artifacts/accounts_de.py
100644 → 100755
Empty file.
4 changes: 2 additions & 2 deletions scripts/artifacts/adb_hosts.py
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -26,8 +26,8 @@ def get_adb_hosts(files_found, report_folder, seeker, wrap_text):
logfunc(f'No ADB Hosts file available')

__artifacts__ = {
"Adb hosts": (
"adb hosts",
"adb hosts": (
"Adb Hosts",
('*/data/misc/adb/adb_keys'),
get_adb_hosts)
}
Empty file modified scripts/artifacts/airGuard.py
100644 → 100755
Empty file.
Empty file modified scripts/artifacts/appLockerfishingnet.py
100644 → 100755
Empty file.
9 changes: 8 additions & 1 deletion scripts/artifacts/appLockerfishingnetdb.py
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -28,4 +28,11 @@ def get_appLockerfishingnetdb(files_found, report_folder, seeker, wrap_text):


else:
logfunc('No Calculator Locker Database data available')
logfunc('No Calculator Locker Database data available')

__artifacts__ = {
"App Locker DB": (
"Encrypting Media Apps",
('*/.privacy_safe/db/privacy_safe.db'),
get_appLockerfishingnetdb)
}
9 changes: 8 additions & 1 deletion scripts/artifacts/appLockerfishingnetpat.py
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -37,4 +37,11 @@ def get_appLockerfishingnetpat(files_found, report_folder, seeker, wrap_text):


else:
logfunc('No Calculator Locker Pattern data available')
logfunc('No Calculator Locker Pattern data available')

__artifacts__ = {
"App Locker Pat": (
"Encrypting Media Apps",
('*/data/com.hld.anzenbokusufake/shared_prefs/share_privacy_safe.xml'),
get_appLockerfishingnetpat)
}
Empty file modified scripts/artifacts/appicons.py
100644 → 100755
Empty file.
9 changes: 8 additions & 1 deletion scripts/artifacts/appopSetupWiz.py
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -48,4 +48,11 @@ def get_appopSetupWiz(files_found, report_folder, seeker, wrap_text):
tlactivity = f'Appops Setup Wizard data'
timeline(report_folder, tlactivity, data_list, data_headers)
else:
logfunc('No Appops Setup Wizard data available')
logfunc('No Appops Setup Wizard data available')

__artifacts__ = {
"appopSetupWiz": (
"Wipe & Setup",
('*/data/system/appops.xml'),
get_appopSetupWiz)
}
Loading

0 comments on commit 964a510

Please sign in to comment.