xleapp

• Added a few more helper functions:

  • deep_get() - helps search dictionaries for values
  • filter_strings_in_files() - removes unprintable strings from a
    file

• Artifact changes

  • copyfile() now accepts a :obj:bytes object to save. This
    recommended method to save files when processing an
    artifact.
  • You can modify the report tile of an artifact by setting the
    :attr:self.report_title on the artifact. The default title
    is the :attr:self.name attribute.

• Report changes

  • :func:nav() macro has an additional argument for the artifact
    name. This helps with setting the artifacts as "active" on
    their respective reports
  • The device tab on the report propertly spaces out the words based
    on camel case ("PhoneVersion" -> "Phone Version") when displayed
    on the report.

Reports (KML, TIMELINE, HTML) files updated

• KML, TIMELINE, HTML updated/fixed
  • KML report is ran if and artifact contains three fields:
    "Timeline", "Latitude", "Longitude".
  • At this time, these fields are checked in the "report_header"
    list of headers. They must be exact but can be in any order.
  • DBFile validator was simplified because it was not working as
    intended
• Database Service (:obj:DBService) added to support managing
  the :obj:DBManager objects.
• Added pagnation and search fields to artifact tables.
• Core artifacts will not produce HTML report files

v0.1.1 Updates (#4)

• Version bump to 0.1.1

• Updating type hints + Minor changes

Plugins:

• Moved the "register_seekers" function. I hope this will align more
  on the intent of the function

Type hints are being updated after the inital fix for iTunes

• Renamed main application class + other Changes

• The main application class "XLEAPP" renamed to a more generic
  name "Application"

• web_icons.py changed to for readabilty.

• Artifact class changes

  • Added data_save_folder property to artifact classes.
    • This gives a quick reference on the export directory each
      artifact should save in.
    • It is recommended not to save outside this folder when exporting
      data from an extraction.
  • Updated copyfile function to use the new data_save_folder
    property. This function provides a direct way to export data
    from an artifact to the export folder. It is the preferred
    method to use on an artifact to save data.

• Removed tests\ from .gitignore

TODO: Add tests suite

• Ensure --artifacts as at least one value

• Minor fixes

• Fixed report naming for html files.

• Fixed artifact naming for navigation list

• Fixed process.log on how paths are outputted. Before, the file
  did not show all files looked at.

• Fixed for files returned back to an artifact if several regex are
  used with return_on_first_hit as True.

iTunes Backup parsing fixed

Unenrypted backups from iTunes can be parsed from dictionary,
zip, tar, or gz. If the file is compressed, it will be extracted
automaticaly for you. Unenrypting backups is not supported (yet).

The main sections of the application are stable.

• completely wrote application from
  ileapp (https://github.com/abrignoni/iLEAPP/)
• Plugin system has been added.
  note: artifacts still need to be moved to the new format.
  Check Creating Artifacts for more information.
• GUI side of the application has been reworked and extended to
  support plugins as well. Check the docs for a screenshot.
• Type hints and docstrings have been added and mostly completed.
  There might be dragons hiding so let me know if there needs any
  slaying!
• Lots of changes and additions over the past year+.

GUI has been fixed and working. See image below for a quick look at how it work.

Reset the version to the application to display right in the version header.

Minor fixes.

!!! Developmental Release !!!

This is an initial release of this application for testing purposes. Please take caution when using this package. Read commits to find the changes. There are many over the course of the last several weeks.