puffyCid / artemis

A cross platform forensic parser written in Rust!
MIT License
64 stars 7 forks source link

Support for parsing macOS Spotlight database #114

Closed puffyCid closed 7 months ago

puffyCid commented 7 months ago

This PR adds support for parsing the macOS Spotlight database. Spotlight is similar to the Windows Search functionality, it tracks files and content on macOS

puffyCid commented 7 months ago

cargo-deny recently added version 2 of the format. Looks like the CI action has not been updated yet

codecov[bot] commented 7 months ago

Codecov Report

Attention: Patch coverage is 88.51276% with 207 lines in your changes are missing coverage. Please review.

Project coverage is 83.98%. Comparing base (3cfde56) to head (9429200).

:exclamation: Current head 9429200 differs from pull request most recent head 6ea5026. Consider uploading reports for the commit 6ea5026 to get more accurate results

Files Patch % Lines
...-core/src/artifacts/os/macos/spotlight/store/db.rs 84.81% 41 Missing :warning:
artemis-core/src/artifacts/os/macos/artifacts.rs 67.07% 27 Missing :warning:
...src/artifacts/os/macos/spotlight/store/property.rs 93.19% 27 Missing :warning:
...facts/os/macos/spotlight/store/properties/float.rs 65.07% 22 Missing :warning:
...ore/src/artifacts/os/macos/spotlight/dbstr/meta.rs 76.19% 20 Missing :warning:
...mis-core/src/artifacts/os/macos/spotlight/light.rs 84.92% 19 Missing :warning:
...mis-core/src/artifacts/os/macos/spotlight/error.rs 0.00% 16 Missing :warning:
.../os/macos/spotlight/store/properties/multivalue.rs 76.31% 9 Missing :warning:
artemis-core/src/artifacts/macos_collection.rs 66.66% 5 Missing :warning:
artemis-core/src/runtime/macos/sudo.rs 66.66% 5 Missing :warning:
... and 10 more
Additional details and impacted files ```diff @@ Coverage Diff @@ ## main #114 +/- ## ========================================== + Coverage 83.84% 83.98% +0.14% ========================================== Files 448 466 +18 Lines 51274 53020 +1746 ========================================== + Hits 42989 44528 +1539 - Misses 8285 8492 +207 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.