search

abrignoni / ALEAPP

Android Logs Events And Protobuf Parser
MIT License
528 stars 113 forks source link

parsing failed - Chrome Downloads - no such column "last_access_time" #53

Closed evandrix closed 4 years ago

evandrix commented 4 years ago

this arises from the Samsung Galaxy S5 Android v5 evidence in SANS DFIR NetWars 19.2, attached below, for your convenience: History.zip

Reading Chrome artifact had errors!
Error was no such column: last_access_time
Exception Traceback: Traceback (most recent call last): File "/scripts/ilap_artifacts.py", line 143, in process_artifact method(files_found, report_folder, seeker) File "/scripts/artifacts/chromeDownloads.py", line 22, in get_chromeDownloads cursor.execute(''' sqlite3.OperationalError: no such column: last_access_time
sqlite> .schema
CREATE TABLE downloads (id INTEGER PRIMARY KEY,current_path LONGVARCHAR NOT NULL,target_path LONGVARCHAR NOT NULL,start_time INTEGER NOT NULL,received_bytes INTEGER NOT NULL,total_bytes INTEGER NOT NULL,state INTEGER NOT NULL,danger_type INTEGER NOT NULL,interrupt_reason INTEGER NOT NULL,end_time INTEGER NOT NULL,opened INTEGER NOT NULL,referrer VARCHAR NOT NULL,by_ext_id VARCHAR NOT NULL,by_ext_name VARCHAR NOT NULL,etag VARCHAR NOT NULL,last_modified VARCHAR NOT NULL,mime_type VARCHAR(255) NOT NULL,original_mime_type VARCHAR(255) NOT NULL, guid VARCHAR NOT NULL DEFAULT '', hash BLOB NOT NULL DEFAULT X'', http_method VARCHAR NOT NULL DEFAULT '', tab_url VARCHAR NOT NULL DEFAULT '', tab_referrer_url VARCHAR NOT NULL DEFAULT '', site_url VARCHAR NOT NULL DEFAULT '');
ydkhatri commented 4 years ago

I will take a look at it over the weekend. Android v5 is old and not a priority though.

ydkhatri commented 4 years ago

Fixed in #54