search

sepinf-inc / IPED

IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation by private examiners.
Other
982 stars 220 forks source link

NSKeyedAchiverParser #2353

Open patrickdalla opened 4 weeks ago

patrickdalla commented 4 weeks ago

Closes #2351.

patrickdalla commented 4 weeks ago

This implementation is dependent of BPList PR, so it has the commits of that PR too.

patrickdalla commented 4 weeks ago

Some issues/improvements derived from this implementation:

1) Can be implemented "specialized" parsers for specific object classes found inside the Object graph. Maybe an improvement can be to extract such kind of objects as new subitems, once registered. For example, I found some objects with info o a IGUser class that seems to represent instagram user information inside of a NSKeyedArchiver file of a IGDirectBanyanRankedRecipientsCollection object. image

2) The metadata name of the extracted timestamps are given as the tree path to the variable. I think IPED was not designed to support such long metadata names. One possible solution is to extract any object that has as timestamp field member as subitem, so the metadata name would be the path starting from this object class name. image

patrickdalla commented 4 weeks ago

On the long metadata name given from path issue: i've found one case that was leading to IPED indexing halt due to this long names (concatenated in eventtimegroups metadata) so I changed the implementation to use only the last member name on the object path.