Code cleaning

scripts/artifacts/backupSettings.py

@@ -14,27 +14,26 @@
 }
 
 import plistlib
-from datetime import datetime
-from scripts.ilapfuncs import artifact_processor, logfunc, logdevinfo, timestampsconv
+from scripts.ilapfuncs import artifact_processor, logfunc, logdevinfo, webkit_timestampsconv
 
 @artifact_processor
 def get_backupSettings(files_found, report_folder, seeker, wrap_text, timezone_offset):
     data_list = []
     source_path = str(files_found[0])
 
-    with open(file_found, "rb") as fp:
+    with open(source_path, "rb") as fp:
         pl = plistlib.load(fp)
         if len(pl) > 0:
             for key, val in pl.items():
                 if key == 'LastiTunesBackupDate':
-                    lastime = timestampsconv(val)
+                    lastime = webkit_timestampsconv(val)
                     data_list.append(('Last iTunes Backup Date', lastime))
                     logdevinfo(f"<b>Last iTunes Backup Date: </b>{lastime}")
                 elif key == 'LastiTunesBackupTZ':
                     data_list.append((key, val))
                     logdevinfo(f"<b>Last iTunes Backup TZ: </b>{val}")
                 elif key == 'LastCloudBackupDate':
-                    lastcloudtime = timestampsconv(val)
+                    lastcloudtime = webkit_timestampsconv(val)
                     data_list.append(('Last Cloud iTunes Backup Date', lastcloudtime))
                     logdevinfo(f"<b>Last Cloud iTunes Backup Date: </b>{lastcloudtime}")
                 elif key == 'LastCloudBackupTZ':

scripts/artifacts/biomeAirpMode.py

@@ -8,7 +8,7 @@
 from scripts.ccl import ccl_segb1
 from scripts.ccl import ccl_segb2
 from scripts.artifact_report import ArtifactHtmlReport
-from scripts.ilapfuncs import logfunc, tsv, timeline, is_platform_windows, open_sqlite_db_readonly, convert_utc_human_to_timezone, timestampsconv, convert_ts_int_to_utc
+from scripts.ilapfuncs import logfunc, tsv, timeline, is_platform_windows, open_sqlite_db_readonly, convert_utc_human_to_timezone, webkit_timestampsconv, convert_ts_int_to_utc
 
 def utf8_in_extended_ascii(input_string, *, raise_on_unexpected=False):
     """Returns a tuple of bool (whether mis-encoded utf-8 is present) and str (the converted string)"""
@@ -109,8 +109,8 @@ def get_biomeAirpMode(files_found, report_folder, seeker, wrap_text, timezone_of
                 if state == 'Written':
 
                     protostuff, types = blackboxprotobuf.decode_message(data[8:],typess)
-                    timestart = (timestampsconv(protostuff['2']))
-                    #timeend = (timestampsconv(protostuff['3']))
+                    timestart = (webkit_timestampsconv(protostuff['2']))
+                    #timeend = (webkit_timestampsconv(protostuff['3']))
                     #timeend = convert_ts_int_to_utc(timeend)
                     event = protostuff['1']['1']
                     guid = protostuff['5'].decode()
@@ -136,8 +136,8 @@ def get_biomeAirpMode(files_found, report_folder, seeker, wrap_text, timezone_of
                 if state == 'Written':
 
                     protostuff, types = blackboxprotobuf.decode_message(data,typess)
-                    timestart = (timestampsconv(protostuff['2']))
-                    #timeend = (timestampsconv(protostuff['3']))
+                    timestart = (webkit_timestampsconv(protostuff['2']))
+                    #timeend = (webkit_timestampsconv(protostuff['3']))
                     #timeend = convert_ts_int_to_utc(timeend)
                     event = protostuff['1']['1'].decode()
                     guid = protostuff['5'].decode()

scripts/artifacts/biomeAppinstall.py

@@ -6,7 +6,7 @@
 from io import StringIO
 from io import BytesIO
 from scripts.artifact_report import ArtifactHtmlReport
-from scripts.ilapfuncs import logfunc, tsv, timeline, is_platform_windows, open_sqlite_db_readonly, convert_ts_human_to_utc, convert_utc_human_to_timezone, convert_time_obj_to_utc 
+from scripts.ilapfuncs import logfunc, tsv, timeline, is_platform_windows, open_sqlite_db_readonly, convert_ts_human_to_utc, convert_utc_human_to_timezone, convert_time_obj_to_utc, webkit_timestampsconv
 
 def utf8_in_extended_ascii(input_string, *, raise_on_unexpected=False):
     """Returns a tuple of bool (whether mis-encoded utf-8 is present) and str (the converted string)"""
@@ -66,11 +66,6 @@ def handle_bad_data(index, character):
 
     return mis_encoded_utf8_present, "".join(output)
 
-def timestampsconv(webkittime):
-    unix_timestamp = webkittime + 978307200
-    finaltime = datetime.fromtimestamp(unix_timestamp, tz=timezone.utc)
-    return(finaltime)
-
 def get_biomeAppinstall(files_found, report_folder, seeker, wrap_text, timezone_offset):
 
     typess = {'1': {'type': 'message', 'message_typedef': {'1': {'type': 'str', 'name': ''}, '2': {'type': 'message', 'message_typedef': {'1': {'type': 'int', 'name': ''}, '2': {'type': 'int', 'name': ''}}, 'name': ''}}, 'name': ''}, '2': {'type': 'double', 'name': ''}, '3': {'type': 'double', 'name': ''}, '4': {'type': 'message', 'message_typedef': {'1': {'type': 'message', 'message_typedef': {'1': {'type': 'int', 'name': ''}, '2': {'type': 'int', 'name': ''}}, 'name': ''}, '3': {'type': 'str', 'name': ''}}, 'name': ''}, '5': {'type': 'str', 'name': ''}, '7': {'type': 'message', 'message_typedef': {'1': {'type': 'message', 'message_typedef': {}, 'name': ''}, '2': {'type': 'message', 'message_typedef': {'1': {'type': 'message', 'message_typedef': {'1': {'type': 'int', 'name': ''}, '2': {'type': 'int', 'name': ''}}, 'name': ''}, '4': {'type': 'int', 'name': ''}, '3': {'type': 'str', 'name': ''}}, 'name': ''}, '3': {'type': 'int', 'name': ''}}, 'name': ''}, '8': {'type': 'double', 'name': ''}, '10': {'type': 'int', 'name': ''}}
@@ -123,11 +118,11 @@ def get_biomeAppinstall(files_found, report_folder, seeker, wrap_text, timezone_
                 protostuff, types = blackboxprotobuf.decode_message(protostuff, typess)
 
                 activity = (protostuff['1']['1'])
-                timestart = (timestampsconv(protostuff['2']))
+                timestart = (webkit_timestampsconv(protostuff['2']))
                 timestart = convert_utc_human_to_timezone(timestart, timezone_offset)
 
 
-                timeend = (timestampsconv(protostuff['3']))
+                timeend = (webkit_timestampsconv(protostuff['3']))
                 timeend = convert_utc_human_to_timezone(timeend, timezone_offset)
 
                 bundleid = (protostuff['4']['3'])
@@ -146,7 +141,7 @@ def get_biomeAppinstall(files_found, report_folder, seeker, wrap_text, timezone_
                 else:
                     bundleinfo = ''
 
-                timewrite = (timestampsconv(protostuff['8']))
+                timewrite = (webkit_timestampsconv(protostuff['8']))
                 timewrite = convert_utc_human_to_timezone(timewrite, timezone_offset)
 
                 data_list.append((timestart, timeend, timewrite, activity, bundleid, bundleinfo, appinfo1, appinfo2, actionguid ))

scripts/artifacts/biomeBacklight.py

@@ -6,7 +6,7 @@
 from io import StringIO
 from io import BytesIO
 from scripts.artifact_report import ArtifactHtmlReport
-from scripts.ilapfuncs import logfunc, tsv, timeline, is_platform_windows, open_sqlite_db_readonly, convert_utc_human_to_timezone
+from scripts.ilapfuncs import logfunc, tsv, timeline, is_platform_windows, open_sqlite_db_readonly, convert_utc_human_to_timezone, webkit_timestampsconv
 
 def utf8_in_extended_ascii(input_string, *, raise_on_unexpected=False):
     """Returns a tuple of bool (whether mis-encoded utf-8 is present) and str (the converted string)"""
@@ -66,11 +66,6 @@ def handle_bad_data(index, character):
 
     return mis_encoded_utf8_present, "".join(output)
 
-def timestampsconv(webkittime):
-    unix_timestamp = webkittime + 978307200
-    finaltime = datetime.fromtimestamp(unix_timestamp, tz=timezone.utc)
-    return(finaltime)
-
 def get_biomeBacklight(files_found, report_folder, seeker, wrap_text, timezone_offset):
 
     typess = {'1': {'type': 'double', 'name': ''}, '2': {'type': 'int', 'name': ''}}
@@ -122,7 +117,7 @@ def get_biomeBacklight(files_found, report_folder, seeker, wrap_text, timezone_o
                 protostuff, types = blackboxprotobuf.decode_message(protostuff,typess)
                 #print(protostuff)
 
-                timestart = (timestampsconv(protostuff['1']))
+                timestart = (webkit_timestampsconv(protostuff['1']))
                 timestart = convert_utc_human_to_timezone(timestart, timezone_offset)
                 state = (protostuff['2'])
 

scripts/artifacts/biomeBattperc.py

@@ -6,7 +6,7 @@
 from io import StringIO
 from io import BytesIO
 from scripts.artifact_report import ArtifactHtmlReport
-from scripts.ilapfuncs import logfunc, tsv, timeline, is_platform_windows, open_sqlite_db_readonly, convert_ts_human_to_utc, convert_utc_human_to_timezone, convert_time_obj_to_utc
+from scripts.ilapfuncs import logfunc, tsv, timeline, is_platform_windows, open_sqlite_db_readonly, convert_ts_human_to_utc, convert_utc_human_to_timezone, convert_time_obj_to_utc, webkit_timestampsconv
 
 def utf8_in_extended_ascii(input_string, *, raise_on_unexpected=False):
     """Returns a tuple of bool (whether mis-encoded utf-8 is present) and str (the converted string)"""
@@ -66,11 +66,6 @@ def handle_bad_data(index, character):
 
     return mis_encoded_utf8_present, "".join(output)
 
-def timestampsconv(webkittime):
-    unix_timestamp = webkittime + 978307200
-    finaltime = datetime.fromtimestamp(unix_timestamp, tz=timezone.utc)
-    return(finaltime)
-
 def get_biomeBattperc(files_found, report_folder, seeker, wrap_text, timezone_offset):
 
     typess = {'1': {'type': 'message', 'message_typedef': {'1': {'type': 'str', 'name': ''}, '2': {'type': 'message', 'message_typedef': {'1': {'type': 'int', 'name': ''}, '2': {'type': 'int', 'name': ''}}, 'name': ''}}, 'name': ''}, '2': {'type': 'double', 'name': ''}, '3': {'type': 'double', 'name': ''}, '4': {'type': 'message', 'message_typedef': {'1': {'type': 'message', 'message_typedef': {'1': {'type': 'int', 'name': ''}, '2': {'type': 'int', 'name': ''}}, 'name': ''}, '5': {'type': 'double', 'name': ''}}, 'name': ''}, '5': {'type': 'str', 'name': ''}, '8': {'type': 'double', 'name': ''}, '10': {'type': 'int', 'name': ''}}
@@ -116,12 +111,12 @@ def get_biomeBattperc(files_found, report_folder, seeker, wrap_text, timezone_of
 
             date1 = ab.read(8) 
             date1 = (struct.unpack_from("<d",date1)[0])
-            convertedtime1 = timestampsconv(date1)
+            convertedtime1 = webkit_timestampsconv(date1)
             #print(convertedtime1)
 
             date2 = ab.read(8)
             date2 = (struct.unpack_from("<d",date2)[0])
-            convertedtime2 = timestampsconv(date2)
+            convertedtime2 = webkit_timestampsconv(date2)
             #print(convertedtime2)
 
 
@@ -143,13 +138,13 @@ def get_biomeBattperc(files_found, report_folder, seeker, wrap_text, timezone_of
 
 
                 activity = (protostuff['1']['1'])
-                timestart = (timestampsconv(protostuff['2']))
+                timestart = (webkit_timestampsconv(protostuff['2']))
                 timestart = convert_utc_human_to_timezone(timestart, timezone_offset)
 
-                timeend = (timestampsconv(protostuff['3']))
+                timeend = (webkit_timestampsconv(protostuff['3']))
                 timeend = convert_utc_human_to_timezone(timeend, timezone_offset)
 
-                timewrite = (timestampsconv(protostuff['8']))
+                timewrite = (webkit_timestampsconv(protostuff['8']))
                 timewrite = convert_utc_human_to_timezone(timewrite, timezone_offset)
 
                 percent = (protostuff['4']['5'])

scripts/artifacts/biomeBluetooth.py

@@ -6,7 +6,7 @@
 from io import StringIO
 from io import BytesIO
 from scripts.artifact_report import ArtifactHtmlReport
-from scripts.ilapfuncs import logfunc, tsv, timeline, is_platform_windows, open_sqlite_db_readonly, convert_ts_human_to_utc, convert_utc_human_to_timezone, convert_time_obj_to_utc
+from scripts.ilapfuncs import logfunc, tsv, timeline, is_platform_windows, open_sqlite_db_readonly, convert_ts_human_to_utc, convert_utc_human_to_timezone, convert_time_obj_to_utc, webkit_timestampsconv
 
 def utf8_in_extended_ascii(input_string, *, raise_on_unexpected=False):
     """Returns a tuple of bool (whether mis-encoded utf-8 is present) and str (the converted string)"""
@@ -66,11 +66,6 @@ def handle_bad_data(index, character):
 
     return mis_encoded_utf8_present, "".join(output)
 
-def timestampsconv(webkittime):
-    unix_timestamp = webkittime + 978307200
-    finaltime = datetime.fromtimestamp(unix_timestamp, tz=timezone.utc)
-    return(finaltime)
-
 def get_biomeBluetooth(files_found, report_folder, seeker, wrap_text, timezone_offset):
 
     typess = {'1': {'type': 'message', 'message_typedef': {'1': {'type': 'bytes', 'name': ''}, '2': {'type': 'message', 'message_typedef': {'1': {'type': 'int', 'name': ''}, '2': {'type': 'int', 'name': ''}}, 'name': ''}}, 'name': ''}, '2': {'type': 'double', 'name': ''}, '3': {'type': 'double', 'name': ''}, '4': {'type': 'message', 'message_typedef': {'1': {'type': 'message', 'message_typedef': {'1': {'type': 'int', 'name': ''}, '2': {'type': 'int', 'name': ''}}, 'name': ''}, '3': {'type': 'str', 'name': ''}}, 'name': ''}, '5': {'type': 'str', 'name': ''}, '8': {'type': 'fixed64', 'name': ''}, '10': {'type': 'int', 'name': ''}}
@@ -116,14 +111,14 @@ def get_biomeBluetooth(files_found, report_folder, seeker, wrap_text, timezone_o
 
             date1 = ab.read(8) 
             date1 = (struct.unpack_from("<d",date1)[0])
-            convertedtime1 = timestampsconv(date1)
+            convertedtime1 = webkit_timestampsconv(date1)
             convertedtime1 = convert_utc_human_to_timezone(convertedtime1, timezone_offset)
             #print(convertedtime1)
             segbtime = convertedtime1
 
             date2 = ab.read(8)
             date2 = (struct.unpack_from("<d",date2)[0])
-            convertedtime2 = timestampsconv(date2)
+            convertedtime2 = webkit_timestampsconv(date2)
             #print(convertedtime2)
 
 

scripts/artifacts/biomeCarplayisconnected.py

@@ -6,7 +6,7 @@
 from io import StringIO
 from io import BytesIO
 from scripts.artifact_report import ArtifactHtmlReport
-from scripts.ilapfuncs import logfunc, tsv, timeline, is_platform_windows, open_sqlite_db_readonly, convert_utc_human_to_timezone, timestampsconv
+from scripts.ilapfuncs import logfunc, tsv, timeline, is_platform_windows, open_sqlite_db_readonly, convert_utc_human_to_timezone, webkit_timestampsconv
 
 def utf8_in_extended_ascii(input_string, *, raise_on_unexpected=False):
     """Returns a tuple of bool (whether mis-encoded utf-8 is present) and str (the converted string)"""
@@ -109,12 +109,12 @@ def get_biomeCarplayisconnected(files_found, report_folder, seeker, wrap_text, t
 
             date1 = ab.read(8) 
             date1 = (struct.unpack_from("<d",date1)[0])
-            convertedtime1 = timestampsconv(date1)
+            convertedtime1 = webkit_timestampsconv(date1)
             #print(convertedtime1)
 
             date2 = ab.read(8)
             date2 = (struct.unpack_from("<d",date2)[0])
-            convertedtime1 = timestampsconv(date2)
+            convertedtime1 = webkit_timestampsconv(date2)
             #print(convertedtime1)
 
 
@@ -131,13 +131,13 @@ def get_biomeCarplayisconnected(files_found, report_folder, seeker, wrap_text, t
                 protostuff, types = blackboxprotobuf.decode_message(protostuff, typess)
                 activity = (protostuff['1']['1'])
 
-                timestart = (timestampsconv(protostuff['2']))
+                timestart = (webkit_timestampsconv(protostuff['2']))
                 timestart = convert_utc_human_to_timezone(timestart, timezone_offset)
 
-                timeend = (timestampsconv(protostuff['3']))
+                timeend = (webkit_timestampsconv(protostuff['3']))
                 timeend = convert_utc_human_to_timezone(timeend, timezone_offset)
 
-                timewrite = (timestampsconv(protostuff['8']))
+                timewrite = (webkit_timestampsconv(protostuff['8']))
                 timewrite = convert_utc_human_to_timezone(timewrite, timezone_offset)
 
                 actionguid = (protostuff['5'])

scripts/artifacts/biomeDevWifi.py

@@ -8,7 +8,7 @@
 from scripts.artifact_report import ArtifactHtmlReport
 from scripts.ccl import ccl_segb1
 from scripts.ccl import ccl_segb2
-from scripts.ilapfuncs import logfunc, tsv, timeline, is_platform_windows, open_sqlite_db_readonly, convert_utc_human_to_timezone, timestampsconv, convert_ts_int_to_utc
+from scripts.ilapfuncs import logfunc, tsv, timeline, is_platform_windows, open_sqlite_db_readonly, convert_utc_human_to_timezone, convert_ts_int_to_utc
 
 def utf8_in_extended_ascii(input_string, *, raise_on_unexpected=False):
     """Returns a tuple of bool (whether mis-encoded utf-8 is present) and str (the converted string)"""