Skip to content

Conversation

@CandraTP
Copy link

@CandraTP CandraTP commented Dec 16, 2024

One line description of pull request

Add SQLite parser for iOS Notes file

Description:

We added and modified the following files :

  • Added a new parser plugin "ios_notes.py" to plaso/parsers/sqlite_plugins/
  • Added "NoteStore.sqlite" file to test_data/
  • Added unit test "ios_notes.py" to tests/parsers/sqlite_plugins/
  • Modified formatter "ios.yaml" (plaso/data/formatters/ios.yaml)
  • Modified "timeliner.yaml" (plaso/data/timeliner.yamll)

Related issue (if applicable): fixes #

Notes:

All contributions to Plaso undergo code review.
This makes sure that the code has appropriate test coverage and conforms to the
Plaso style guide.

One of the maintainers will examine your code, and may request changes. Check off the items below in
order, and then a maintainer will review your code.

Checklist:

  • Automated checks (GitHub Actions, AppVeyor) pass
  • No new new dependencies are required or l2tdevtools has been updated
  • Reviewer assigned
  • Test data has a Plaso compatible license

@joachimmetz joachimmetz self-assigned this Mar 2, 2025
@joachimmetz
Copy link
Member

I assume log2timeline-20241205T004447.log.gz was added by mistake?

@joachimmetz
Copy link
Member

@CandraTP what is the origin of the test data file?

# Plaso iOS related event formatters.
---
type: 'conditional'
data_type: 'ios:accounts:account'
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This does not appear to be used, removing

description: 'Creation Time'
place_holder_event: false
---
data_type: 'ios:accounts:account'
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This does not appear to be used, removing


cd config/docker;

docker build --no-cache --force-rm -t log2timeline/plaso . 2>&1 | tee ${LOGFILE};
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not needed

@joachimmetz joachimmetz added the pending reporter input Issue is pending input from the reporter label Mar 2, 2025
@codecov
Copy link

codecov bot commented Mar 2, 2025

Codecov Report

Attention: Patch coverage is 50.00000% with 16 lines in your changes missing coverage. Please review.

Project coverage is 85.06%. Comparing base (11259d3) to head (dc7bc2f).

Files with missing lines Patch % Lines
plaso/parsers/sqlite_plugins/ios_notes.py 50.00% 16 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #4944      +/-   ##
==========================================
- Coverage   85.09%   85.06%   -0.03%     
==========================================
  Files         432      433       +1     
  Lines       38792    38824      +32     
==========================================
+ Hits        33009    33025      +16     
- Misses       5783     5799      +16     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@CandraTP
Copy link
Author

I assume log2timeline-20241205T004447.log.gz was added by mistake?

Sorry for the late response.
I apologize, it was indeed a mistake on our part when pushing to the repository without checking the file list first.

@CandraTP
Copy link
Author

@CandraTP what is the origin of the test data file?

The test data file "NoteStore.sqlite" was obtained from the public image file of iOS 15.3.1, from the official Digital Corpora website.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

pending reporter input Issue is pending input from the reporter

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants