adjustments to align with iLEAPP

.gitignore

@@ -1,115 +1,102 @@
-
-.vscode/
-.idea/
-
-# Byte-compiled / optimized / DLL files
+# Compiled files
 __pycache__/
-*.py[co]
+*.py[cod]
 *$py.class
-
-# ALEAPP
-ALEAPP_Reports_*
-
-# C extensions
 *.so
 
 # Distribution / packaging
 .Python
-env/
 build/
-develop-eggs/
 dist/
-downloads/
-eggs/
-.eggs/
-lib/
-lib64/
-parts/
-sdist/
-var/
-wheels/
 *.egg-info/
 .installed.cfg
 *.egg
-temp/
+MANIFEST
 
-# PyInstaller
-#  Usually these files are written by a python script from a template
-#  before PyInstaller builds the exe, so as to inject date/other infos into it.
-*.manifest
-*.spec
+# Installers
+*.cab
+*.msi
+*.msix
+*.msm
+*.msp
 
-# Installer logs
+# Logs
+*.log
 pip-log.txt
-pip-delete-this-directory.txt
+pytestdebug.log
 
-# Unit test / coverage reports
-htmlcov/
-.tox/
+# Environments
+.env
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Testing
 .coverage
 .coverage.*
+*.cover
+*.py,cover
+htmlcov/
+.tox/
+.nox/
 .cache
 nosetests.xml
 coverage.xml
-*.cover
 .hypothesis/
+.pytest_cache/
 
-# Translations
-*.mo
-*.pot
-
-# Django stuff:
-*.log
-local_settings.py
-
-# Flask stuff:
-instance/
-.webassets-cache
-
-# Scrapy stuff:
-.scrapy
-
-# Sphinx documentation
-docs/_build/
-
-# PyBuilder
-target/
-
-# Jupyter Notebook
-.ipynb_checkpoints
-
-# pyenv
-.python-version
-
-# celery beat schedule file
-celerybeat-schedule
-
-# SageMath parsed files
-*.sage.py
-
-# dotenv
-.env
-
-# virtualenv
-.venv
-venv/
-ENV/
-
-# Spyder project settings
+# IDEs
+.vscode/
+.idea/
 .spyderproject
 .spyproject
-
-# Rope project settings
 .ropeproject
 
-# mkdocs documentation
+# OS
+*.DS_Store
+Thumbs.db
+Thumbs.db:encryptable
+ehthumbs.db
+ehthumbs_vista.db
+[Dd]esktop.ini
+$RECYCLE.BIN/
+
+# Project specific
+?LEAPP_Reports_*
+path_list.txt
+coordinates.db
+
+# Documentation
+docs/_build/
 /site
+target/
 
-# mypy
+# Misc
+*.sage.py
+celerybeat-schedule
+__pypackages__/
 .mypy_cache/
+.pyre/
+.pytype/
 
-# OSX Cache
-.DS_Store
+# Version control
+.history
+
+# Other tools
+*.pot
+*.mo
+*.manifest
+*.spec
+pip-wheel-metadata/
+share/python-wheels/
+wheels/
+local_settings.py
+instance/
+.webassets-cache
+.scrapy
+.ipynb_checkpoints
+.python-version
 
-#GPS database cache
-coordinates.db

README.md

@@ -80,30 +80,30 @@ For example:
 
 ```python
 __artifacts_v2__ = {
-"cool_artifact_1": {
-"name": "Cool Artifact 1",
-"description": "Extracts cool data from database files",
-"author": "@username",
-"version": "0.1",
-"date": "2022-10-25",
-"requirements": "none",
-"category": "Really cool artifacts",
-"notes": "",
-"paths": ('*/com.android.cooldata/databases/database*.db',),
-"function": "get_cool_data1"
-},
-"cool_artifact_2": {
-"name": "Cool Artifact 2",
-"description": "Extracts cool data from XML files",
-"author": "@username",
-"version": "0.1",
-"date": "2022-10-25",
-"requirements": "none",
-"category": "Really cool artifacts",
-"notes": "",
-"paths": ('*/com.android.cooldata/files/cool.xml',),
-"function": "get_cool_data2"
-}
+    "cool_artifact_1": {
+        "name": "Cool Artifact 1",
+        "description": "Extracts cool data from database files",
+        "author": "@username",
+        "version": "0.1",
+        "date": "2022-10-25",
+        "requirements": "none",
+        "category": "Really cool artifacts",
+        "notes": "",
+        "paths": ('*/com.android.cooldata/databases/database*.db',),
+        "function": "get_cool_data1"
+    },
+    "cool_artifact_2": {
+        "name": "Cool Artifact 2",
+        "description": "Extracts cool data from XML files",
+        "author": "@username",
+        "version": "0.1",
+        "date": "2022-10-25",
+        "requirements": "none",
+        "category": "Really cool artifacts",
+        "notes": "",
+        "paths": ('*/com.android.cooldata/files/cool.xml',),
+        "function": "get_cool_data2"
+    }
 }
 ```
 
@@ -118,7 +118,7 @@ For example:
 
 ```python
 def get_cool_data1(files_found, report_folder, seeker, wrap_text):
-pass  # do processing here
+    pass  # do processing here
 ```
 
 Plugins are generally expected to provide output in ILEAPP's HTML output format, TSV, and optionally submit records to 
@@ -127,50 +127,49 @@ At a high level, an example might resemble:
 
 ```python
 __artifacts_v2__ = {
-"cool_artifact_1": {
-"name": "Cool Artifact 1",
-"description": "Extracts cool data from database files",
-"author": "@username",  # Replace with the actual author's username or name
-"version": "0.1",  # Version number
-"date": "2022-10-25",  # Date of the latest version
-"requirements": "none",
-"category": "Really cool artifacts",
-"notes": "",
-"paths": ('*/com.android.cooldata/databases/database*.db',),
-"function": "get_cool_data1"
-}
+    "cool_artifact_1": {
+        "name": "Cool Artifact 1",
+        "description": "Extracts cool data from database files",
+        "author": "@username",  # Replace with the actual author's username or name
+        "version": "0.1",  # Version number
+        "date": "2022-10-25",  # Date of the latest version
+        "requirements": "none",
+        "category": "Really cool artifacts",
+        "notes": "",
+        "paths": ('*/com.android.cooldata/databases/database*.db',),
+        "function": "get_cool_data1"
+    }
 }
 
 import datetime
 from scripts.artifact_report import ArtifactHtmlReport
 import scripts.ilapfuncs
 
 def get_cool_data1(files_found, report_folder, seeker, wrap_text):
-# let's pretend we actually got this data from somewhere:
-rows = [
-(datetime.datetime.now(), "Cool data col 1, value 1", "Cool data col 1, value 2", "Cool data col 1, value 3"),
-(datetime.datetime.now(), "Cool data col 2, value 1", "Cool data col 2, value 2", "Cool data col 2, value 3"),
-]
-
-headers = ["Timestamp", "Data 1", "Data 2", "Data 3"]
-
-# HTML output:
-report = ArtifactHtmlReport("Cool stuff")
-report_name = "Cool DFIR Data"
-report.start_artifact_report(report_folder, report_name)
-report.add_script()
-report.write_artifact_data_table(headers, rows, files_found[0])  # assuming only the first file was processed
-report.end_artifact_report()
-
-# TSV output:
-scripts.ilapfuncs.tsv(report_folder, headers, rows, report_name, files_found[0])  # assuming first file only
-
-# Timeline:
-scripts.ilapfuncs.timeline(report_folder, report_name, rows, headers)
+    # let's pretend we actually got this data from somewhere:
+    rows = [
+     (datetime.datetime.now(), "Cool data col 1, value 1", "Cool data col 1, value 2", "Cool data col 1, value 3"),
+     (datetime.datetime.now(), "Cool data col 2, value 1", "Cool data col 2, value 2", "Cool data col 2, value 3"),
+    ]
+    
+    headers = ["Timestamp", "Data 1", "Data 2", "Data 3"]
+    
+    # HTML output:
+    report = ArtifactHtmlReport("Cool stuff")
+    report_name = "Cool DFIR Data"
+    report.start_artifact_report(report_folder, report_name)
+    report.add_script()
+    report.write_artifact_data_table(headers, rows, files_found[0])  # assuming only the first file was processed
+    report.end_artifact_report()
+    
+    # TSV output:
+    scripts.ilapfuncs.tsv(report_folder, headers, rows, report_name, files_found[0])  # assuming first file only
+    
+    # Timeline:
+    scripts.ilapfuncs.timeline(report_folder, report_name, rows, headers)
 
 ```
 
 ## Acknowledgements
 
 This tool is the result of a collaborative effort of many people in the DFIR community.
-

aleapp.py

@@ -29,7 +29,7 @@ def validate_args(args):
         raise argparse.ArgumentError(None, 'OUTPUT folder does not exist! Run the program again.')
 
     try:
-      timezone = pytz.timezone(args.timezone)
+        timezone = pytz.timezone(args.timezone)
     except pytz.UnknownTimeZoneError:
       raise argparse.ArgumentError(None, 'Unknown timezone! Run the program again.')
 
@@ -219,4 +219,5 @@ def crunch_artifacts(
     return True
 
 if __name__ == '__main__':
-    main()
+    main()
+

requirements.txt

@@ -1,23 +1,23 @@
 bcrypt==3.2.0
 beautifulsoup4==4.8.2
+bencoding
 blackboxprotobuf
+filetype==1.0.8
+fitdecode==0.10.0
+folium==0.14.0
+geopy==2.3.0
 packaging==20.1
+pillow
+polyline==2.0.0
 protobuf==3.10.0
 PyCryptodome
 PySimpleGUI==4.16.0
-simplekml
-wheel
-xmltodict
-filetype==1.0.8
 python-magic==0.4.24; platform_system == "Linux"
 python-magic-bin==0.4.14; platform_system == "Windows"
 python-magic-bin; platform_system == "Darwin" and platform_machine == "x86_64"
 python-magic; platform_system == "Darwin" and platform_machine == "arm64"
-pillow
-folium==0.14.0
-polyline==2.0.0
-fitdecode==0.10.0
-bencoding
-geopy==2.3.0
+pytz
+simplekml
+wheel
 xlsxwriter==3.1.1
-pytz
+xmltodict