Skip to content

feature: update media checkin to fix path bug and allow modules to set more media info #1320

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open

feature: update media checkin to fix path bug and allow modules to set more media info #1320

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
28ea00e
feature: update media checkin to fix path bug and allow modules to se…
JamesHabben Oct 31, 2025
107f8e2
Delete webkit.webkit_cache_records.josh_ios15_ffs.20251030183029.json
JamesHabben Oct 31, 2025
f552e56
Fix ileappGUI.py
Johann-PLW Nov 2, 2025
62dae36
update source_path value
JamesHabben Nov 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 18 additions & 15 deletions ileapp.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
from scripts.version_info import ileapp_version
from time import process_time, gmtime, strftime, perf_counter
from scripts.lavafuncs import *
from scripts.context import Context

def validate_args(args):
if args.artifact_paths or args.create_profile_casedata:
Expand Down Expand Up @@ -321,12 +322,14 @@ def main():
if output_path[1] == ':': output_path = '\\\\?\\' + output_path.replace('/', '\\')

out_params = OutputParameters(output_path, custom_output_folder)
Context.set_output_params(out_params)

initialize_lava(input_path, out_params.report_folder_base, extracttype)
initialize_lava(input_path, out_params.output_folder_base, extracttype)

crunch_artifacts(selected_plugins, extracttype, input_path, out_params, wrap_text, loader, casedata, time_offset, profile_filename, itunes_backup_password)
crunch_artifacts(selected_plugins, extracttype, input_path, out_params, wrap_text, loader, casedata, time_offset,
profile_filename, itunes_backup_password)

lava_finalize_output(out_params.report_folder_base)
lava_finalize_output(out_params.output_folder_base)

def crunch_artifacts(
plugins: typing.Sequence[plugin_loader.PluginSpec], extracttype, input_path, out_params, wrap_text,
Expand Down Expand Up @@ -403,7 +406,7 @@ def crunch_artifacts(
logfunc(f'File/Directory selected: {input_path}')
logfunc('\n--------------------------------------------------------------------------------------')

log = open(os.path.join(out_params.report_folder_base, '_HTML', '_Script_Logs', 'ProcessedFilesLog.html'), 'w+', encoding='utf8')
log = open(os.path.join(out_params.output_folder_base, '_HTML', '_Script_Logs', 'ProcessedFilesLog.html'), 'w+', encoding='utf8')
log.write(f'Extraction/Path selected: {input_path}<br><br>')
log.write(f'Timezone selected: {time_offset}<br><br>')

Expand All @@ -413,17 +416,17 @@ def crunch_artifacts(
if extracttype == 'itunes':
info_plist_path = os.path.join(input_path, 'Info.plist')
if os.path.exists(info_plist_path):
# process_artifact([info_plist_path], 'iTunesBackupInfo', 'Device Info', seeker, out_params.report_folder_base)
#plugin.method([info_plist_path], out_params.report_folder_base, seeker, wrap_text)
report_folder = os.path.join(out_params.report_folder_base, '_HTML', 'iTunes Backup')
# process_artifact([info_plist_path], 'iTunesBackupInfo', 'Device Info', seeker, out_params.output_folder_base)
#plugin.method([info_plist_path], out_params.output_folder_base, seeker, wrap_text)
report_folder = os.path.join(out_params.output_folder_base, '_HTML', 'iTunes Backup')
if not os.path.exists(report_folder):
try:
os.makedirs(report_folder)
except (FileExistsError, FileNotFoundError) as ex:
logfunc('Error creating report directory at path {}'.format(report_folder))
logfunc('Error was {}'.format(str(ex)))
loader["itunes_backup_info"].method([info_plist_path], report_folder, seeker, wrap_text, time_offset)
report_folder = os.path.join(out_params.report_folder_base, '_HTML', 'Installed Apps')
report_folder = os.path.join(out_params.output_folder_base, '_HTML', 'Installed Apps')
if not os.path.exists(report_folder):
try:
os.makedirs(report_folder)
Expand Down Expand Up @@ -456,7 +459,7 @@ def crunch_artifacts(
if search_regexes is None:
log.write(f'<ul><li>No search regexes provided for {plugin.name} module.')
log.write("<ul><li><i>'_lava_artifacts.db'</i> used as source file.</li></ul></li></ul>")
files_found = [os.path.join(out_params.report_folder_base, '_lava_artifacts.db')]
files_found = [os.path.join(out_params.output_folder_base, '_lava_artifacts.db')]
else:
for artifact_search_regex in search_regexes:
found = seeker.search(artifact_search_regex)
Expand All @@ -479,7 +482,7 @@ def crunch_artifacts(
if files_found:
if not lava_only and 'lava_only' in output_types:
lava_only = True
category_folder = os.path.join(out_params.report_folder_base, '_HTML', plugin.category)
category_folder = os.path.join(out_params.output_folder_base, '_HTML', plugin.category)
if not os.path.exists(category_folder):
try:
os.makedirs(category_folder)
Expand All @@ -490,7 +493,7 @@ def crunch_artifacts(
try:
plugin.method(files_found, category_folder, seeker, wrap_text, time_offset)
if plugin.name == 'logarchive':
lava_db_path = os.path.join(out_params.report_folder_base, '_lava_artifacts.db')
lava_db_path = os.path.join(out_params.output_folder_base, '_lava_artifacts.db')
if does_table_exist_in_db(lava_db_path, 'logarchive'):
loader["logarchive_artifacts"].method([lava_db_path], category_folder, seeker, wrap_text, time_offset)
if does_table_exist_in_db(lava_db_path, 'logarchive_artifacts'):
Expand Down Expand Up @@ -529,15 +532,15 @@ def crunch_artifacts(
logfunc('Report generation started.')
# remove the \\?\ prefix we added to input and output paths, so it does not reflect in report
if is_platform_windows():
if out_params.report_folder_base.startswith('\\\\?\\'):
out_params.report_folder_base = out_params.report_folder_base[4:]
if out_params.output_folder_base.startswith('\\\\?\\'):
out_params.output_folder_base = out_params.output_folder_base[4:]
if input_path.startswith('\\\\?\\'):
input_path = input_path[4:]

report.generate_report(out_params.report_folder_base, run_time_secs, run_time_HMS, extracttype, input_path, casedata, profile_filename, icons, lava_only)
report.generate_report(out_params.output_folder_base, run_time_secs, run_time_HMS, extracttype, input_path, casedata, profile_filename, icons, lava_only)
logfunc('Report generation Completed.')
logfunc('')
logfunc(f'Report location: {out_params.report_folder_base}')
logfunc(f'Report location: {out_params.output_folder_base}')

return True

Expand Down
10 changes: 6 additions & 4 deletions ileappGUI.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@
from scripts.tz_offset import tzvalues
from scripts.modules_to_exclude import modules_to_exclude
from scripts.lavafuncs import *
from scripts.context import Context


def pickModules():
Expand Down Expand Up @@ -238,6 +239,7 @@ def process(casedata):
progress_bar.config(maximum=len(selected_modules))
casedata = {key: value.get() for key, value in casedata.items()}
out_params = OutputParameters(output_folder)
Context.set_output_params(out_params)
wrap_text = True
time_offset = timezone_set.get()
if time_offset == '':
Expand All @@ -247,16 +249,16 @@ def process(casedata):
bottom_frame.grid_remove()
progress_bar.grid(padx=16, sticky='we')

initialize_lava(input_path, out_params.report_folder_base, extracttype)
initialize_lava(input_path, out_params.output_folder_base, extracttype)

crunch_successful = ileapp.crunch_artifacts(
selected_modules, extracttype, input_path, out_params, wrap_text,
loader, casedata, time_offset, profile_filename, None, decryption_keys)
lava_finalize_output(out_params.report_folder_base)

lava_finalize_output(out_params.output_folder_base)

if crunch_successful:
report_path = os.path.join(out_params.report_folder_base, 'index.html')
report_path = os.path.join(out_params.output_folder_base, 'index.html')
if report_path.startswith('\\\\?\\'): # windows
report_path = report_path[4:]
if report_path.startswith('\\\\'): # UNC path
Expand Down
31 changes: 29 additions & 2 deletions scripts/context.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ class Context:
methods for retrieving and manipulating this data.
"""

_output_params = None
_report_folder = None
_seeker = None
_artifact_info = None
Expand All @@ -28,6 +29,17 @@ class Context:
_os_builds = {}
_installed_os_version = ""

@staticmethod
def set_output_params(output_params):
"""
Sets the OutputParameters instance in the Context. This should only be
called once at the start of a run.

Args:
output_params: The initialized OutputParameters object.
"""
Context._output_params = output_params

@staticmethod
def set_report_folder(report_folder):
"""
Expand Down Expand Up @@ -169,6 +181,21 @@ def _build_lookup_map():
filename_lookup[filename].append(full_path)
return filename_lookup

@staticmethod
def get_output_params():
"""
Retrieves the current OutputParameters instance from the Context.

Raises:
ValueError: If the output parameters are not set.

Returns:
OutputParameters: The OutputParameters instance.
"""
if not Context._output_params:
raise ValueError("Context not set. OutputParameters not available.")
return Context._output_params

@staticmethod
def get_report_folder():
"""
Expand Down Expand Up @@ -433,8 +460,8 @@ def get_installed_os_version():
def clear():
"""
Resets all context-related class variables to None, effectively
clearing any stored state or references, except for the device IDs and
OS builds which are retained for efficiency.
clearing any stored state or references, except for the device IDs,
OS builds, and output parameters which are retained for efficiency.
"""
Context._report_folder = None
Context._seeker = None
Expand Down
Loading
Loading