puffyCid / artemis

A cross platform forensic parser written in Rust!
MIT License
64 stars 7 forks source link

Initial support for Property Stores #53

Closed puffyCid closed 1 year ago

puffyCid commented 1 year ago

This PR add initial support for Windows Property Stores. Property Stores sometimes exist in ShellItems. They may contain additional directories or strings as well additional GUIDs or data. They are primarily seen when a user uses Windows Search in Explorer

They do not provide a huge amount of forensic information.

codecov[bot] commented 1 year ago

Codecov Report

Patch coverage: 89.05% and project coverage change: +0.05% :tada:

Comparison is base (3d9c823) 85.27% compared to head (0e977b2) 85.32%. Report is 2 commits behind head on main.

:exclamation: Current head 0e977b2 differs from pull request most recent head 0019222. Consider uploading reports for the commit 0019222 to get more accurate results

Additional details and impacted files ```diff @@ Coverage Diff @@ ## main #53 +/- ## ========================================== + Coverage 85.27% 85.32% +0.05% ========================================== Files 343 348 +5 Lines 42229 42665 +436 ========================================== + Hits 36010 36404 +394 - Misses 6219 6261 +42 ``` | [Files Changed](https://app.codecov.io/gh/puffyCid/artemis/pull/53?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) | Coverage Δ | | |---|---|---| | [artemis-core/src/artifacts/os/windows/ole/olecf.rs](https://app.codecov.io/gh/puffyCid/artemis/pull/53?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None#diff-YXJ0ZW1pcy1jb3JlL3NyYy9hcnRpZmFjdHMvb3Mvd2luZG93cy9vbGUvb2xlY2YucnM=) | `90.47% <ø> (ø)` | | | [...-core/src/artifacts/os/windows/shellitems/items.rs](https://app.codecov.io/gh/puffyCid/artemis/pull/53?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None#diff-YXJ0ZW1pcy1jb3JlL3NyYy9hcnRpZmFjdHMvb3Mvd2luZG93cy9zaGVsbGl0ZW1zL2l0ZW1zLnJz) | `87.64% <ø> (ø)` | | | [...e/src/artifacts/os/windows/shortcuts/shellitems.rs](https://app.codecov.io/gh/puffyCid/artemis/pull/53?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None#diff-YXJ0ZW1pcy1jb3JlL3NyYy9hcnRpZmFjdHMvb3Mvd2luZG93cy9zaG9ydGN1dHMvc2hlbGxpdGVtcy5ycw==) | `96.05% <50.00%> (-3.95%)` | :arrow_down: | | [...-core/src/artifacts/os/windows/shellbags/parser.rs](https://app.codecov.io/gh/puffyCid/artemis/pull/53?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None#diff-YXJ0ZW1pcy1jb3JlL3NyYy9hcnRpZmFjdHMvb3Mvd2luZG93cy9zaGVsbGJhZ3MvcGFyc2VyLnJz) | `62.09% <60.00%> (-0.05%)` | :arrow_down: | | [...re/src/artifacts/os/windows/shellitems/variable.rs](https://app.codecov.io/gh/puffyCid/artemis/pull/53?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None#diff-YXJ0ZW1pcy1jb3JlL3NyYy9hcnRpZmFjdHMvb3Mvd2luZG93cy9zaGVsbGl0ZW1zL3ZhcmlhYmxlLnJz) | `93.50% <64.70%> (-0.37%)` | :arrow_down: | | [...ore/src/artifacts/os/windows/jumplists/jumplist.rs](https://app.codecov.io/gh/puffyCid/artemis/pull/53?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None#diff-YXJ0ZW1pcy1jb3JlL3NyYy9hcnRpZmFjdHMvb3Mvd2luZG93cy9qdW1wbGlzdHMvanVtcGxpc3QucnM=) | `77.77% <75.00%> (+6.17%)` | :arrow_up: | | [artemis-core/src/artifacts/os/windows/ole/types.rs](https://app.codecov.io/gh/puffyCid/artemis/pull/53?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None#diff-YXJ0ZW1pcy1jb3JlL3NyYy9hcnRpZmFjdHMvb3Mvd2luZG93cy9vbGUvdHlwZXMucnM=) | `79.22% <79.22%> (ø)` | | | [.../artifacts/os/windows/shortcuts/extras/property.rs](https://app.codecov.io/gh/puffyCid/artemis/pull/53?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None#diff-YXJ0ZW1pcy1jb3JlL3NyYy9hcnRpZmFjdHMvb3Mvd2luZG93cy9zaG9ydGN1dHMvZXh0cmFzL3Byb3BlcnR5LnJz) | `90.90% <80.00%> (+0.66%)` | :arrow_up: | | [.../src/artifacts/os/windows/propertystore/formats.rs](https://app.codecov.io/gh/puffyCid/artemis/pull/53?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None#diff-YXJ0ZW1pcy1jb3JlL3NyYy9hcnRpZmFjdHMvb3Mvd2luZG93cy9wcm9wZXJ0eXN0b3JlL2Zvcm1hdHMucnM=) | `89.65% <89.65%> (ø)` | | | [...re/src/artifacts/os/windows/shellitems/property.rs](https://app.codecov.io/gh/puffyCid/artemis/pull/53?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None#diff-YXJ0ZW1pcy1jb3JlL3NyYy9hcnRpZmFjdHMvb3Mvd2luZG93cy9zaGVsbGl0ZW1zL3Byb3BlcnR5LnJz) | `97.43% <90.90%> (+0.16%)` | :arrow_up: | | ... and [18 more](https://app.codecov.io/gh/puffyCid/artemis/pull/53?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) | | ... and [5 files with indirect coverage changes](https://app.codecov.io/gh/puffyCid/artemis/pull/53/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None)

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.