abrignoni / iLEAPP

iOS Logs, Events, And Plist Parser
MIT License
710 stars 141 forks source link

Photos.sqlite Parser Updates #747

Closed ScottKjr3347 closed 3 months ago

ScottKjr3347 commented 3 months ago

Corrected and updated Ph15PeopleandDetFacesNAD.py and Ph16AssetPeopleandDetFaces.py to parse people and detected faces and assets that have people and faces.

Update modules_to_exclude.py to include Ph15 and Ph16 faces and people to be excluded by default

Updated parsers to make better file names for exported data files to relate them to a specific asset/record

Updated artifact categories to organize the different parsers

Moved Unique identifiers in Ph50AssetIntResouData.py to allow for easier finding and filtering

Added Ph70UserAdjustDateTimezoneLocation.py parser to compare asset data for possible user adjustments. See blog updates for details: https://theforensicscooter.com/2024/05/18/ileapp-parsers-photos-sqlite-queries/