EricZimmerman · AndrewRathbun · Aug 7, 2024 · Aug 7, 2024
diff --git a/SQLMap/Maps/Windows_4KVideoDownloader_History.smap b/SQLMap/Maps/Windows_4KVideoDownloader_History.smap
@@ -1,10 +1,10 @@
 Description: 4K Video Downloader
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: ff0293ee-f646-4507-ade7-dc058d3e998e
 Version: 1.0
 CSVPrefix: 4KVideoDownloader
 FileName: random.sqlite # run --hunt mode on the directory to make use of this Map
 IdentifyQuery: SELECT count(*) FROM sqlite_master WHERE type='table' AND (name='media_item_description' OR name='url_description' OR name='media_info' OR name='audio_info' OR name='video_info' OR name='url_description');
 IdentifyValue: 6
 Queries:

diff --git a/SQLMap/Maps/Windows_ChromiumBrowser_AutofillEntries.smap b/SQLMap/Maps/Windows_ChromiumBrowser_AutofillEntries.smap
@@ -1,6 +1,6 @@
 Description: Chromium Browser Autofill Entries
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: 7cf6de25-2953-46aa-b555-7a5c7bf35b07
 Version: 1.0
 CSVPrefix: ChromiumBrowser

diff --git a/SQLMap/Maps/Windows_ChromiumBrowser_AutofillProfiles.smap b/SQLMap/Maps/Windows_ChromiumBrowser_AutofillProfiles.smap
@@ -1,6 +1,6 @@
 Description: Chromium Browser Autofill Profiles
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: f9d9d731-f6d3-43a6-907d-fe10ddc9e334
 Version: 1.01
 CSVPrefix: ChromiumBrowser

diff --git a/SQLMap/Maps/Windows_ChromiumBrowser_Cookies.smap b/SQLMap/Maps/Windows_ChromiumBrowser_Cookies.smap
@@ -1,6 +1,6 @@
 Description: Chromium Browser Cookies
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: e1849119-3265-4880-a45e-a6029757625d
 Version: 1.0
 CSVPrefix: ChromiumBrowser

diff --git a/SQLMap/Maps/Windows_ChromiumBrowser_Downloads.smap b/SQLMap/Maps/Windows_ChromiumBrowser_Downloads.smap
@@ -1,6 +1,6 @@
 Description: Chromium Browser Downloads
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: 0b575bcf-ade3-44e5-8162-eb52a96c2b06
 Version: 1.1
 CSVPrefix: ChromiumBrowser

diff --git a/SQLMap/Maps/Windows_ChromiumBrowser_Favicons.smap b/SQLMap/Maps/Windows_ChromiumBrowser_Favicons.smap
@@ -1,6 +1,6 @@
 Description: Chromium Browser Favicons
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: d13f7b03-3fa3-497b-a3b7-3b7936b46ad4
 Version: 1.0
 CSVPrefix: ChromiumBrowser

diff --git a/SQLMap/Maps/Windows_ChromiumBrowser_HistoryVisits.smap b/SQLMap/Maps/Windows_ChromiumBrowser_HistoryVisits.smap
@@ -1,6 +1,6 @@
 Description: Chromium Browser History Visits
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: 1f37cc07-2b10-4c80-b845-84708e4f7429
 Version: 1.2
 CSVPrefix: ChromiumBrowser

diff --git a/SQLMap/Maps/Windows_ChromiumBrowser_KeywordSearches.smap b/SQLMap/Maps/Windows_ChromiumBrowser_KeywordSearches.smap
@@ -1,6 +1,6 @@
 Description: Chromium Browser Keyword Searches
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: d968ece4-d24a-4baf-8f07-78da07727712
 Version: 1.1
 CSVPrefix: ChromiumBrowser

diff --git a/SQLMap/Maps/Windows_ChromiumBrowser_MaskedCreditCards.smap b/SQLMap/Maps/Windows_ChromiumBrowser_MaskedCreditCards.smap
@@ -1,6 +1,6 @@
 Description: Chromium Browser Masked Credit Cards
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: d8ae6c52-14c8-46af-823f-a406545c4614
 Version: 1.0
 CSVPrefix: ChromiumBrowser

diff --git a/SQLMap/Maps/Windows_ChromiumBrowser_MediaHistoryPlayback.smap b/SQLMap/Maps/Windows_ChromiumBrowser_MediaHistoryPlayback.smap
@@ -1,6 +1,6 @@
 Description: Chromium Browser Media History Playback
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: 4fa46af3-3dc5-4129-baf2-ec02bf09bf77
 Version: 1.0
 CSVPrefix: ChromiumBrowser

diff --git a/SQLMap/Maps/Windows_ChromiumBrowser_MediaHistoryPlaybackSession.smap b/SQLMap/Maps/Windows_ChromiumBrowser_MediaHistoryPlaybackSession.smap
@@ -1,6 +1,6 @@
 Description: Chromium Browser Media History Playback Session
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: 22fd15b3-3028-4b95-b706-829eca7d1bc4
 Version: 1.0
 CSVPrefix: ChromiumBrowser

diff --git a/SQLMap/Maps/Windows_ChromiumBrowser_NetworkActionPredictor.smap b/SQLMap/Maps/Windows_ChromiumBrowser_NetworkActionPredictor.smap
@@ -1,6 +1,6 @@
 Description: Chromium Browser Network Action Predictor
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: ecca7ec3-3c7d-4c79-a394-091e7d7f4f97
 Version: 1.0
 CSVPrefix: ChromiumBrowser

diff --git a/SQLMap/Maps/Windows_ChromiumBrowser_OmniboxShortcuts.smap b/SQLMap/Maps/Windows_ChromiumBrowser_OmniboxShortcuts.smap
@@ -1,6 +1,6 @@
 Description: Chromium Browser Omnibox Shortcuts
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: 0e137968-371b-4078-9440-a94b3dcf0d2f
 Version: 1.0
 CSVPrefix: ChromiumBrowser

diff --git a/SQLMap/Maps/Windows_ChromiumBrowser_TopSites.smap b/SQLMap/Maps/Windows_ChromiumBrowser_TopSites.smap
@@ -1,6 +1,6 @@
 Description: Chromium Browser Top Sites
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: 3b2fc9c8-23ea-4694-82a2-266aa819db3b
 Version: 1.0
 CSVPrefix: ChromiumBrowser

diff --git a/SQLMap/Maps/Windows_Dropbox_AggregationDBX.smap b/SQLMap/Maps/Windows_Dropbox_AggregationDBX.smap
@@ -1,6 +1,6 @@
 Description: Dropbox Aggregation database
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: 69ace2ef-a789-4ec7-9408-b264467e3801
 Version: 1.0
 CSVPrefix: Dropbox

diff --git a/SQLMap/Maps/Windows_Dropbox_IconDB.smap b/SQLMap/Maps/Windows_Dropbox_IconDB.smap
@@ -1,6 +1,6 @@
 Description: Dropbox Icon DB
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: 9f59bb9d-387e-49b0-97f8-f3e271787d4b
 Version: 1.0
 CSVPrefix: Dropbox

diff --git a/SQLMap/Maps/Windows_Dropbox_NonLocalResources.smap b/SQLMap/Maps/Windows_Dropbox_NonLocalResources.smap
@@ -1,6 +1,6 @@
 Description: Dropbox Non-Local Resources
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: 255c6d03-a065-49dd-b1bd-4cf7c635554a
 Version: 1.0
 CSVPrefix: Dropbox

diff --git a/SQLMap/Maps/Windows_Dropbox_RecentItems.smap b/SQLMap/Maps/Windows_Dropbox_RecentItems.smap
@@ -1,6 +1,6 @@
 Description: Dropbox Recent Items
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: 97a2f126-f939-4516-9c61-8b74a8cf482b
 Version: 1.0
 CSVPrefix: Dropbox

diff --git a/SQLMap/Maps/Windows_Dropbox_SFJResources.smap b/SQLMap/Maps/Windows_Dropbox_SFJResources.smap
@@ -1,6 +1,6 @@
 Description: Dropbox SFJ Resources
 Author: Andrew Rathbun and Chad Tilbury
-Email: andrew.rathbun@kroll.com and ctilbury@sans.org
+Email: andrew.d.rathbun@gmail.com and ctilbury@sans.org
 Id: 34366884-7119-4c0f-b252-11457cc8490a
 Version: 1.1
 CSVPrefix: Dropbox

diff --git a/SQLMap/Maps/Windows_Dropbox_StarredItems.smap b/SQLMap/Maps/Windows_Dropbox_StarredItems.smap
@@ -1,6 +1,6 @@
 Description: Dropbox Starred Items
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: 4092c211-3032-41b1-abc3-a2a6b82f0ac3
 Version: 1.0
 CSVPrefix: Dropbox

diff --git a/SQLMap/Maps/Windows_Dropbox_SyncHistory.smap b/SQLMap/Maps/Windows_Dropbox_SyncHistory.smap
@@ -1,6 +1,6 @@
 Description: Dropbox Sync History
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: 4ff4d115-8f35-4233-8edd-c1fb74280754
 Version: 1.0
 CSVPrefix: Dropbox

diff --git a/SQLMap/Maps/Windows_EventTranscriptDB_DataSampling.smap b/SQLMap/Maps/Windows_EventTranscriptDB_DataSampling.smap
@@ -1,6 +1,6 @@
 Description: EventTranscript.db - Data Sampling
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: 4529ee5e-088d-4822-8cfe-ccaf46e0b1f9
 Version: 1.0
 FileName: EventTranscript.db

diff --git a/SQLMap/Maps/Windows_EventTranscriptDB_NoDataSampling.smap b/SQLMap/Maps/Windows_EventTranscriptDB_NoDataSampling.smap
@@ -1,6 +1,6 @@
 Description: EventTranscript.db - No Data Sampling
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: b28f0ea6-d514-4452-a70b-fa29ba303e15
 Version: 1.0
 FileName: EventTranscript.db

diff --git a/SQLMap/Maps/Windows_Firefox_Bookmarks.smap b/SQLMap/Maps/Windows_Firefox_Bookmarks.smap
@@ -1,6 +1,6 @@
 Description: Firefox Bookmarks
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: eda1fb9b-8275-4fb5-9ff2-ac557dc0d399
 Version: 1.1
 CSVPrefix: Firefox

diff --git a/SQLMap/Maps/Windows_Firefox_Cookies.smap b/SQLMap/Maps/Windows_Firefox_Cookies.smap
@@ -1,6 +1,6 @@
 Description: Firefox Cookies
 Author: Heather Mahalik and Andrew Rathbun
-Email: hmahalik@gmail.com, andrew.rathbun@kroll.com
+Email: hmahalik@gmail.com, andrew.d.rathbun@gmail.com
 Id: 7be83590-8260-4c8a-9b75-c5f82290ebc2
 Version: 0.3
 CSVPrefix: Firefox

diff --git a/SQLMap/Maps/Windows_Firefox_Downloads-Downloads.smap b/SQLMap/Maps/Windows_Firefox_Downloads-Downloads.smap
@@ -1,6 +1,6 @@
 Description: Firefox Downloads - downloads.sqlite
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: 163ac574-ab35-4509-b925-f8a14a470d4a
 Version: 1.0
 CSVPrefix: Firefox

diff --git a/SQLMap/Maps/Windows_Firefox_Downloads-Places.smap b/SQLMap/Maps/Windows_Firefox_Downloads-Places.smap
@@ -1,6 +1,6 @@
 Description: Firefox Downloads - Places.sqlite
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: f5d66594-1b5a-45f7-8cdf-57d76d646649
 Version: 1.0
 CSVPrefix: Firefox

diff --git a/SQLMap/Maps/Windows_Firefox_Favicons.smap b/SQLMap/Maps/Windows_Firefox_Favicons.smap
@@ -1,6 +1,6 @@
 Description: Firefox Favicons
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: 3242e11b-0575-4501-862f-265e2f3fccdf
 Version: 1.0
 CSVPrefix: Firefox

diff --git a/SQLMap/Maps/Windows_Firefox_History.smap b/SQLMap/Maps/Windows_Firefox_History.smap
@@ -1,6 +1,6 @@
 Description: Firefox History
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: 2f34be88-08d0-43c1-a2fd-60fe0b71f32b
 Version: 1.0
 CSVPrefix: Firefox

diff --git a/SQLMap/Maps/Windows_GoogleDrive_Changes.smap b/SQLMap/Maps/Windows_GoogleDrive_Changes.smap
@@ -1,9 +1,9 @@
 Description: Google Drive - Changes
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: 690cd1e6-def2-42d4-8cc8-64858cd9d4e4
 Version: 1.0
 FileName: random.db # run --hunt mode on the directory to make use of this map
 CSVPrefix: GoogleDrive
 IdentifyQuery: SELECT count(*) FROM sqlite_master WHERE type='table' AND (name='change_buffer_entries' OR name='fschanges');
 IdentifyValue: 2

diff --git a/SQLMap/Maps/Windows_GoogleDrive_SyncConfigDB.smap b/SQLMap/Maps/Windows_GoogleDrive_SyncConfigDB.smap
@@ -1,6 +1,6 @@
 Description: Google Drive Sync Config database
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: ebd2e7bf-11ae-4b61-8126-1958ee46d570
 Version: 1.0
 CSVPrefix: GoogleDrive

diff --git a/SQLMap/Maps/Windows_MicrosoftStickyNotes_NotesDB.smap b/SQLMap/Maps/Windows_MicrosoftStickyNotes_NotesDB.smap
@@ -1,6 +1,6 @@
 Description: Microsoft Sticky Notes Database
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: afa8cd82-e364-41e9-8d5b-8ec7ff466bce
 Version: 1.0
 CSVPrefix: MicrosoftStickyNotes

diff --git a/SQLMap/Maps/Windows_Nessus_Preferences.smap b/SQLMap/Maps/Windows_Nessus_Preferences.smap
@@ -1,6 +1,6 @@
 Description: Nessus Preferences Database
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: 6f9a2fe7-6052-414e-bda0-448b95e8d5ac
 Version: 1.0
 CSVPrefix: Nessus

diff --git a/SQLMap/Maps/Windows_TeraCopy_History.smap b/SQLMap/Maps/Windows_TeraCopy_History.smap
@@ -1,9 +1,9 @@
 Description: TeraCopy - history
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: d05d5a1f-7479-4ade-8b6b-92c59a90d45d
 Version: 1.1
 FileName: random.db # run --hunt mode on the directory to make use of this map
 CSVPrefix: TeraCopy
 IdentifyQuery: SELECT count(*) FROM sqlite_master WHERE type='table' AND (name='Files');
 IdentifyValue: 1

diff --git a/SQLMap/Maps/Windows_TeraCopy_MainDB.smap b/SQLMap/Maps/Windows_TeraCopy_MainDB.smap
@@ -1,6 +1,6 @@
 Description: TeraCopy - Main.DB
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: e470201e-f1d6-448d-8876-4ee267dc523b
 Version: 1.0
 CSVPrefix: TeraCopy

diff --git a/SQLMap/Maps/Windows_WPNDatabase_Notifications.smap b/SQLMap/Maps/Windows_WPNDatabase_Notifications.smap
@@ -1,6 +1,6 @@
 Description: Windows WPNDatabase - Notifications
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: cd952d69-7b3e-4d13-9810-8d987155bc58
 Version: 1.0
 CSVPrefix: Windows

diff --git a/SQLMap/Maps/Windows_WPNDatabase_WNSPushChannel.smap b/SQLMap/Maps/Windows_WPNDatabase_WNSPushChannel.smap
@@ -1,6 +1,6 @@
 Description: Windows WPNDatabase - WNSPushChannel
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: a91038dd-baa5-42a3-a92e-e1105171c6fa
 Version: 1.0
 CSVPrefix: Windows

diff --git a/SQLMap/Maps/Windows_WindowsUpdate_StoreDB.smap b/SQLMap/Maps/Windows_WindowsUpdate_StoreDB.smap
@@ -1,6 +1,6 @@
 Description: Windows Update History Database
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: a226e8a0-fc99-499d-8797-ba80179f349f
 Version: 1.0
 CSVPrefix: Windows

diff --git a/SQLMap/Maps/Windows_YourPhone_ContactsDB.smap b/SQLMap/Maps/Windows_YourPhone_ContactsDB.smap
@@ -1,6 +1,6 @@
 Description: Windows Your Phone Contacts DB
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: 5865567d-06d2-4831-87ec-0aaf11f840a2
 Version: 1.0
 CSVPrefix: WindowsYourPhone

diff --git a/SQLMap/Maps/Windows_YourPhone_NotificationsDB.smap b/SQLMap/Maps/Windows_YourPhone_NotificationsDB.smap
@@ -1,6 +1,6 @@
 Description: Windows Your Phone Notifications DB
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: 736e7cef-7d90-4d06-99f9-5a29e9ca431b
 Version: 1.1
 CSVPrefix: WindowsYourPhone

diff --git a/SQLMap/Maps/Windows_YourPhone_PhoneDB-SMSMessages.smap b/SQLMap/Maps/Windows_YourPhone_PhoneDB-SMSMessages.smap
@@ -1,6 +1,6 @@
 Description: Windows Your Phone SMS Messages
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: 6aefdb56-01ad-4a5d-8bd7-28f6c9f31625
 Version: 1.1
 CSVPrefix: WindowsYourPhone

diff --git a/SQLMap/Maps/Windows_YourPhone_PhotosDB.smap b/SQLMap/Maps/Windows_YourPhone_PhotosDB.smap
@@ -1,6 +1,6 @@
 Description: Windows Your Phone Photos DB
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: 560f493c-bdf8-4e23-ac17-3f757c5a048a
 Version: 1.1
 CSVPrefix: WindowsYourPhone

diff --git a/SQLMap/Maps/Windows_YourPhone_SettingsDB.smap b/SQLMap/Maps/Windows_YourPhone_SettingsDB.smap
@@ -1,6 +1,6 @@
 Description: Windows Your Phone Settings DB
 Author: Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: c3bb2711-f8e8-425e-89e8-900ea4897283
 Version: 1.1
 CSVPrefix: WindowsYourPhone

diff --git a/SQLMap/Maps/Windows_pCloud.smap b/SQLMap/Maps/Windows_pCloud.smap
@@ -1,6 +1,6 @@
 Description: pCloud
 Author: Clifton Martin and Andrew Rathbun
-Email: andrew.rathbun@kroll.com
+Email: andrew.d.rathbun@gmail.com
 Id: 4a5e2e51-8951-445f-8988-8742e1681604
 Version: 1.0
 CSVPrefix: pCloud