Skip to content

Type the timestamp columns of the cloud service and snapshot artifacts #2175

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
abrignoni merged 1 commit into from
Sep 13, 2026
+16 −15
Merged

Type the timestamp columns of the cloud service and snapshot artifacts #2175

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions scripts/artifacts/Ph085acntsdcloudServiceEnableLogplist.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,12 +2,12 @@
'Ph085accountsdcloudServiceEnableLogPlist': {
'name': 'Ph085-accountsd-cloud-Service-Enable-Log-Plist',
'description': 'Parses basic data from */PhotoData/private/com.apple.accountsd/cloudServiceEnableLog.plist'
' which is a plist that tracks when Cloud Photos Library (CPL) and Shared Albums have been'
' enabled. Based on research and published blogs written by Scott Koenig'
' https://theforensicscooter.com/2024/05/18/ileapp-parsers-photos-sqlite-queries/',
' which is a plist that records when iCloud Photo Library (CPL) and Shared Albums were enabled or'
' disabled. Based on research and published blogs written by Scott Koenig'
' https://theforensicscooter.com/2022/05/02/photos-sqlite-query-documentation-notable-artifacts/',
'author': 'Scott Koenig',
'creation_date': '2026-05-28',
'last_update_date': '2026-07-27',
'last_update_date': '2026-09-12',
'version': '5.0',
'date': '2025-01-05',
'requirements': 'Acquisition that contains accountsd cloudServiceEnableLog.plist',
Expand Down Expand Up @@ -60,7 +60,7 @@ def Ph085accountsdcloudServiceEnableLogPlist(context):
data_list.append((timestamputc, servicetype, enabledstate))

data_headers = (
'TimestampUTC',
('TimestampUTC', 'datetime'),
'Service-Type',
'Enabled-State')
return data_headers, data_list, source_path
8 changes: 4 additions & 4 deletions scripts/artifacts/Ph086astsdcloudServiceEnableLogplist.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,14 +2,14 @@
'Ph086assetsdcloudServiceEnableLogPlist': {
'name': 'Ph086-assetsd-cloud-Service-Enable-Log-Plist',
'description': 'Parses basic data from */PhotoData/private/com.apple.assetsd/cloudServiceEnableLog.plist'
' which is a plist that tracks when Cloud Photos Library (CPL) has been enabled.'
' which is a plist that records when iCloud Photo Library (CPL) was enabled or disabled.'
' Based on research and published blogs written by Scott Koenig'
' https://theforensicscooter.com/2024/05/18/ileapp-parsers-photos-sqlite-queries/',
' https://theforensicscooter.com/2022/05/02/photos-sqlite-query-documentation-notable-artifacts/',
'author': 'Scott Koenig',
'creation_date': '2026-05-28',
'version': '5.0',
'date': '2025-01-05',
'last_update_date': '2026-07-31',
'last_update_date': '2026-09-12',
'requirements': 'Acquisition that contains assetsd cloudServiceEnableLog.plist',
'category': 'Photos.sqlite',
'notes': '',
Expand Down Expand Up @@ -60,7 +60,7 @@ def Ph086assetsdcloudServiceEnableLogPlist(context):
data_list.append((timestamputc, servicetype, enabledstate))

data_headers = (
'TimestampUTC',
('TimestampUTC', 'datetime'),
'Service-Type',
'Enabled-State')
return data_headers, data_list, source_path
13 changes: 7 additions & 6 deletions scripts/artifacts/applicationStateDB.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,7 @@
"not by itself prove foreground application use or that the user viewed the image contents.",
"author": "@mxkrt - @AlexisBrignoni",
"creation_date": "2025-08-04",
"last_update_date": "2026-08-21",
"last_update_date": "2026-09-12",
"requirements": "none",
"category": "Device Usage",
"notes": "SplashBoard runtime headers expose creationDate and lastUsedDate properties on "
Expand Down Expand Up @@ -112,7 +112,7 @@
"at that time.",
"author": "@mxkrt - @AlexisBrignoni",
"creation_date": "2025-08-04",
"last_update_date": "2026-08-21",
"last_update_date": "2026-09-12",
"requirements": "none",
"category": "Device Usage",
"notes": "The property name is sourced from the runtime-derived SplashBoard header. Its forensic meaning is "
Expand Down Expand Up @@ -173,8 +173,8 @@
'contentType imageOpaque requiredOSVersion')

# display headers for the snapshot analysis results
_snapshot_headers = ('Creation Date', 'Bundle ID', 'Snapshot Group',
'Snapshot Index', 'Expiration Date', 'Last Used Date',
_snapshot_headers = (('Creation Date', 'datetime'), 'Bundle ID', 'Snapshot Group',
'Snapshot Index', ('Expiration Date', 'datetime'), ('Last Used Date', 'datetime'),
'Launch Interface Identifier', 'Relative Path',
'Group ID', 'Image Scale', 'Fullscreen', 'Name',
'Interface Orientation', 'File Location',
Expand Down Expand Up @@ -248,8 +248,9 @@ def get_snapshot_lastUsedDate(context):
new_data_list.append(new_entry)

# swap Last Used Date and Creation Date in headers as well
last_idx = _snapshot_headers.index('Last Used Date')
new_headers = [hdr for hdr in _snapshot_headers[1:] if hdr != 'Last Used Date']
names = [hdr[0] if isinstance(hdr, tuple) else hdr for hdr in _snapshot_headers]
last_idx = names.index('Last Used Date')
new_headers = [hdr for hdr, name in zip(_snapshot_headers[1:], names[1:]) if name != 'Last Used Date']
new_headers.insert(0, ('Last Used Date', 'datetime'))
new_headers.insert(last_idx, ('Creation Date', 'datetime'))

Expand Down
Loading