Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
74 changes: 48 additions & 26 deletions scripts/artifacts/atxDatastore.py
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
}
}

from scripts.ilapfuncs import artifact_processor, open_sqlite_db_readonly, attach_sqlite_db_readonly, convert_cocoa_core_data_ts_to_utc
from scripts.ilapfuncs import artifact_processor, logfunc, open_sqlite_db_readonly, attach_sqlite_db_readonly, convert_cocoa_core_data_ts_to_utc

@artifact_processor
def atxDatastore(context):
Expand All @@ -30,39 +30,61 @@ def atxDatastore(context):
elif file_name.endswith('Local.sqlite'):
localdb = str(file_found)

if not atxdb:
logfunc("Required databases not found: ATXDataStore")
return data_headers, data_list, ''

if not localdb:
logfunc("Required databases not found: Local")
return data_headers, data_list, ''

db = open_sqlite_db_readonly(atxdb)
if db is None:
logfunc(f"Error opening ATXDataStore database: {atxdb}")
return data_headers, data_list, ''

cursor = db.cursor()

attach_query = attach_sqlite_db_readonly(localdb, 'Local')
cursor.execute(attach_query)
if attach_query:
cursor.execute(attach_query)
else:
logfunc(f"Error attaching Local database: {localdb}")
db.close()
return data_headers, data_list, atxdb

cursor.execute('''
SELECT
alog.id AS Id,
alog.bundleId AS bundleId,
alogAction.actionType AS ptype,
Local.ZRTLEARNEDLOCATIONOFINTERESTMO.ZLOCATIONLATITUDE AS latitude,
Local.ZRTLEARNEDLOCATIONOFINTERESTMO.ZLOCATIONLONGITUDE AS longitude,
alog.date AS date,
alog.appSessionStartDate AS appSessionStartDate,
alog.appSessionEndDate AS appSessionEndDate,
hex(alog.location) AS location,
hex(alog.prevLocation) AS prevLocation,
alog.motionType AS potionType,
alog.geohash AS geohash,
alog.coarseGeohash AS coarseGeohash
FROM alog
INNER JOIN alogAction ON alogAction.id = alog.actionType
LEFT JOIN Local.ZRTLEARNEDLOCATIONOFINTERESTMO
ON Local.ZRTLEARNEDLOCATIONOFINTERESTMO.ZIDENTIFIER = alog.location
''')
try:
cursor.execute('''
SELECT
alog.id AS Id,
alog.bundleId AS bundleId,
alogAction.actionType AS ptype,
Local.ZRTLEARNEDLOCATIONOFINTERESTMO.ZLOCATIONLATITUDE AS latitude,
Local.ZRTLEARNEDLOCATIONOFINTERESTMO.ZLOCATIONLONGITUDE AS longitude,
alog.date AS date,
alog.appSessionStartDate AS appSessionStartDate,
alog.appSessionEndDate AS appSessionEndDate,
hex(alog.location) AS location,
hex(alog.prevLocation) AS prevLocation,
alog.motionType AS potionType,
alog.geohash AS geohash,
alog.coarseGeohash AS coarseGeohash
FROM alog
INNER JOIN alogAction ON alogAction.id = alog.actionType
LEFT JOIN Local.ZRTLEARNEDLOCATIONOFINTERESTMO
ON Local.ZRTLEARNEDLOCATIONOFINTERESTMO.ZIDENTIFIER = alog.location
''')

all_rows = cursor.fetchall()
all_rows = cursor.fetchall()
except Exception as e:
logfunc(f"Error querying ATXDataStore database: {e}")
db.close()
return data_headers, data_list, atxdb

for row in all_rows:
timestamp = convert_cocoa_core_data_ts_to_utc(row[5]) if row[5] is not None else ''
startdate = convert_cocoa_core_data_ts_to_utc(row[6]) if row[6] is not None else ''
enddate = convert_cocoa_core_data_ts_to_utc(row[7]) if row[7] is not None else ''
timestamp = convert_cocoa_core_data_ts_to_utc(row[5])
startdate = convert_cocoa_core_data_ts_to_utc(row[6])
enddate = convert_cocoa_core_data_ts_to_utc(row[7])
data_list.append(
(timestamp, startdate, enddate, row[2], row[3], row[4],row[8], row[9], row[0])
)
Expand Down