from mvt.common.utils import convert_mactime_to_unix, convert_timestamp_to_iso

from .base import IOSExtraction


class NetBase(IOSExtraction):
    """This class provides a base for DataUsage and NetUsage extraction modules."""


            

Reported by Pylint.

              
    def find_deleted(self):
        """Identify process which may have been deleted from the DataUsage database"""
        results_by_proc = {proc["proc_id"]: proc for proc in self.results if proc["proc_id"]}
        all_proc_id = sorted(results_by_proc.keys())

        # Fix issue #108
        if not all_proc_id:
            return

            

Reported by Pylint.

                      # Add a placeholder entry for the missing processes.
        for proc_id, proc in missing_procs.items():
            # Set default DataUsage keys.
            result = {key: None for key in self.results[0].keys()}
            result["first_isodate"] = result["isodate"] = result["live_isodate"] = proc["prev_proc_first"]
            result["proc_name"] = "MISSING [follows {}]".format(proc["prev_proc_name"])
            result["proc_id"] = result["live_proc_id"] = proc["proc_id"]
            result["bundle_id"] = None


            

Reported by Pylint.

                          result["proc_id"] = result["live_proc_id"] = proc["proc_id"]
            result["bundle_id"] = None

            self.results.append(result)

        self.results = sorted(self.results, key=operator.itemgetter("first_isodate"))

    def check_indicators(self):
        # Check for manipulated process records.

            

Reported by Pylint.

              class NetBase(IOSExtraction):
    """This class provides a base for DataUsage and NetUsage extraction modules."""

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 fast_mode=False, log=None, results=[]):
        super().__init__(file_path=file_path, base_folder=base_folder,
                         output_folder=output_folder, fast_mode=fast_mode,
                         log=log, results=results)


            

Reported by Pylint.

              
            self.results.append(result)

        self.results = sorted(self.results, key=operator.itemgetter("first_isodate"))

    def check_indicators(self):
        # Check for manipulated process records.
        # TODO: Catching KeyError for live_isodate for retro-compatibility.
        #       This is not very good.

            

Reported by Pylint.

              
    def check_indicators(self):
        # Check for manipulated process records.
        # TODO: Catching KeyError for live_isodate for retro-compatibility.
        #       This is not very good.
        try:
            self.check_manipulated()
            self.find_deleted()
        except KeyError:

            

Reported by Pylint.

              # Mobile Verification Toolkit (MVT)
# Copyright (c) 2021 The MVT Project Authors.
# Use of this software is governed by the MVT License 1.1 that can be found at
#   https://license.mvt.re/1.1/

import operator
import sqlite3
from pathlib import Path


            

Reported by Pylint.

              class NetBase(IOSExtraction):
    """This class provides a base for DataUsage and NetUsage extraction modules."""

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 fast_mode=False, log=None, results=[]):
        super().__init__(file_path=file_path, base_folder=base_folder,
                         output_folder=output_folder, fast_mode=fast_mode,
                         log=log, results=results)


            

Reported by Pylint.

              
        self.log.info("Extracted information on %d processes", len(self.results))

    def serialize(self, record):
        record_data = f"{record['proc_name']} (Bundle ID: {record['bundle_id']}, ID: {record['proc_id']})"
        record_data_usage = record_data + f" WIFI IN: {record['wifi_in']}, WIFI OUT: {record['wifi_out']} - "  \
                            f"WWAN IN: {record['wwan_in']}, WWAN OUT: {record['wwan_out']}"

        records = [{

            

Reported by Pylint.

              
from mvt.common.utils import check_for_links, convert_timestamp_to_iso

from .base import AndroidExtraction

log = logging.getLogger(__name__)

SMS_BUGLE_PATH = "data/data/com.google.android.apps.messaging/databases/bugle_db"
SMS_BUGLE_QUERY = """

            

Reported by Pylint.

              class SMS(AndroidExtraction):
    """This module extracts all SMS messages containing links."""

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 serial=None, fast_mode=False, log=None, results=[]):
        super().__init__(file_path=file_path, base_folder=base_folder,
                         output_folder=output_folder, fast_mode=fast_mode,
                         log=log, results=results)


            

Reported by Pylint.

                  """This module extracts all SMS messages containing links."""

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 serial=None, fast_mode=False, log=None, results=[]):
        super().__init__(file_path=file_path, base_folder=base_folder,
                         output_folder=output_folder, fast_mode=fast_mode,
                         log=log, results=results)

    def serialize(self, record):

            

Reported by Pylint.

                  """This module extracts all SMS messages containing links."""

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 serial=None, fast_mode=False, log=None, results=[]):
        super().__init__(file_path=file_path, base_folder=base_folder,
                         output_folder=output_folder, fast_mode=fast_mode,
                         log=log, results=results)

    def serialize(self, record):

            

Reported by Pylint.

              
    def run(self):
        if (self._adb_check_file_exists(os.path.join("/", SMS_BUGLE_PATH))):
            self.SMS_DB_TYPE = 1
            self._adb_process_file(os.path.join("/", SMS_BUGLE_PATH), self._parse_db)
        elif (self._adb_check_file_exists(os.path.join("/", SMS_MMSSMS_PATH))):
            self.SMS_DB_TYPE = 2
            self._adb_process_file(os.path.join("/", SMS_MMSSMS_PATH), self._parse_db)
        else:

            

Reported by Pylint.

                          self.SMS_DB_TYPE = 1
            self._adb_process_file(os.path.join("/", SMS_BUGLE_PATH), self._parse_db)
        elif (self._adb_check_file_exists(os.path.join("/", SMS_MMSSMS_PATH))):
            self.SMS_DB_TYPE = 2
            self._adb_process_file(os.path.join("/", SMS_MMSSMS_PATH), self._parse_db)
        else:
            self.log.error("No SMS database found")

            

Reported by Pylint.

              # Mobile Verification Toolkit (MVT)
# Copyright (c) 2021 The MVT Project Authors.
# Use of this software is governed by the MVT License 1.1 that can be found at
#   https://license.mvt.re/1.1/

import logging
import os
import sqlite3


            

Reported by Pylint.

              class SMS(AndroidExtraction):
    """This module extracts all SMS messages containing links."""

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 serial=None, fast_mode=False, log=None, results=[]):
        super().__init__(file_path=file_path, base_folder=base_folder,
                         output_folder=output_folder, fast_mode=fast_mode,
                         log=log, results=results)


            

Reported by Pylint.

                                       output_folder=output_folder, fast_mode=fast_mode,
                         log=log, results=results)

    def serialize(self, record):
        text = record["text"].replace("\n", "\\n")
        return {
            "timestamp": record["isodate"],
            "module": self.__class__.__name__,
            "event": f"sms_{record['direction']}",

            

Reported by Pylint.

                          "data": f"{record['number']}: \"{text}\""
        }

    def check_indicators(self):
        if not self.indicators:
            return

        for message in self.results:
            if not "text" in message:

            

Reported by Pylint.

              import os

import pkg_resources
from tqdm import tqdm

from mvt.common.module import InsufficientPrivileges
from mvt.common.utils import get_sha256_from_file_path

from .modules.adb.base import AndroidExtraction

            

Reported by Pylint.

              from mvt.common.module import InsufficientPrivileges
from mvt.common.utils import get_sha256_from_file_path

from .modules.adb.base import AndroidExtraction

log = logging.getLogger(__name__)

# TODO: Would be better to replace tqdm with rich.progress to reduce
#       the number of dependencies. Need to investigate whether

            

Reported by Pylint.

              
log = logging.getLogger(__name__)

# TODO: Would be better to replace tqdm with rich.progress to reduce
#       the number of dependencies. Need to investigate whether
#       it's possible to have a similar callback system.
class PullProgress(tqdm):
    """PullProgress is a tqdm update system for APK downloads."""


            

Reported by Pylint.

              class PullProgress(tqdm):
    """PullProgress is a tqdm update system for APK downloads."""

    def update_to(self, file_name, current, total):
        if total is not None:
            self.total = total
        self.update(current - self.n)



            

Reported by Pylint.

              
    def update_to(self, file_name, current, total):
        if total is not None:
            self.total = total
        self.update(current - self.n)


class Package:
    """Package indicates a package name and all the files associated with it."""

            

Reported by Pylint.

                              self._adb_download(remote_path, local_path,
                                   progress_callback=pp.update_to)
        except InsufficientPrivileges:
            log.warn("Unable to pull package file from %s: insufficient privileges, it might be a system app",
                     remote_path)
            self._adb_reconnect()
            return None
        except Exception as e:
            log.exception("Failed to pull package file from %s: %s",

            

Reported by Pylint.

                                   remote_path)
            self._adb_reconnect()
            return None
        except Exception as e:
            log.exception("Failed to pull package file from %s: %s",
                          remote_path, e)
            self._adb_reconnect()
            return None


            

Reported by Pylint.

                              output = self._clean_output(output)
                if not output:
                    continue
            except Exception as e:
                log.exception("Failed to get path of package %s: %s", package.name, e)
                self._adb_reconnect()
                continue

            # Sometimes the package path contains multiple lines for multiple apks.

            

Reported by Pylint.

              # Mobile Verification Toolkit (MVT)
# Copyright (c) 2021 The MVT Project Authors.
# Use of this software is governed by the MVT License 1.1 that can be found at
#   https://license.mvt.re/1.1/

import json
import logging
import os


            

Reported by Pylint.

              # TODO: Would be better to replace tqdm with rich.progress to reduce
#       the number of dependencies. Need to investigate whether
#       it's possible to have a similar callback system.
class PullProgress(tqdm):
    """PullProgress is a tqdm update system for APK downloads."""

    def update_to(self, file_name, current, total):
        if total is not None:
            self.total = total

            

Reported by Pylint.

                                             MVTModule)


class IOSExtraction(MVTModule):
    """This class provides a base for all iOS filesystem/backup extraction modules."""

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 fast_mode=False, log=None, results=[]):
        super().__init__(file_path=file_path, base_folder=base_folder,

            

Reported by Pylint.

                                             MVTModule)


class IOSExtraction(MVTModule):
    """This class provides a base for all iOS filesystem/backup extraction modules."""

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 fast_mode=False, log=None, results=[]):
        super().__init__(file_path=file_path, base_folder=base_folder,

            

Reported by Pylint.

                                             MVTModule)


class IOSExtraction(MVTModule):
    """This class provides a base for all iOS filesystem/backup extraction modules."""

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 fast_mode=False, log=None, results=[]):
        super().__init__(file_path=file_path, base_folder=base_folder,

            

Reported by Pylint.

              class IOSExtraction(MVTModule):
    """This class provides a base for all iOS filesystem/backup extraction modules."""

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 fast_mode=False, log=None, results=[]):
        super().__init__(file_path=file_path, base_folder=base_folder,
                         output_folder=output_folder, fast_mode=fast_mode,
                         log=log, results=results)


            

Reported by Pylint.

                      """Tries to recover a malformed database by running a .clone command.
        :param file_path: Path to the malformed database file.
        """
        # TODO: Find a better solution.
        conn = sqlite3.connect(file_path)
        cur = conn.cursor()

        try:
            recover = False

            

Reported by Pylint.

                              elif domain:
                    cur.execute(f"{base_sql} domain = ?;", (domain,))
        except Exception as e:
            raise Exception("Query to Manifest.db failed: %s", e)

        for row in cur:
            yield {
                "file_id": row[0],
                "domain": row[1],

            

Reported by Pylint.

                              elif domain:
                    cur.execute(f"{base_sql} domain = ?;", (domain,))
        except Exception as e:
            raise Exception("Query to Manifest.db failed: %s", e)

        for row in cur:
            yield {
                "file_id": row[0],
                "domain": row[1],

            

Reported by Pylint.

              
                yield found_path

    def _find_ios_database(self, backup_ids=None, root_paths=[]):
        """Try to locate a module's database file from either an iTunes
        backup or a full filesystem dump. This is intended only for
        modules that expect to work with a single SQLite database.
        If a module requires to process multiple databases or files,
        you should use the helper functions above.

            

Reported by Pylint.

              # Mobile Verification Toolkit (MVT)
# Copyright (c) 2021 The MVT Project Authors.
# Use of this software is governed by the MVT License 1.1 that can be found at
#   https://license.mvt.re/1.1/

import glob
import os
import shutil
import sqlite3

            

Reported by Pylint.

              import os
import shutil
import sqlite3
import subprocess

from mvt.common.module import (DatabaseCorruptedError, DatabaseNotFoundError,
                               MVTModule)



            

Reported by Bandit.

              
from mvt.common.utils import convert_timestamp_to_iso

from ..base import IOSExtraction

WEBKIT_SESSION_RESOURCE_LOG_BACKUP_IDS = [
    "a500ee38053454a02e990957be8a251935e28d3f",
]
WEBKIT_SESSION_RESOURCE_LOG_BACKUP_RELPATH = "Library/WebKit/WebsiteData/ResourceLoadStatistics/full_browsing_session_resourceLog.plist"

            

Reported by Pylint.

              # Use of this software is governed by the MVT License 1.1 that can be found at
#   https://license.mvt.re/1.1/

import glob
import os
import plistlib

from mvt.common.utils import convert_timestamp_to_iso


            

Reported by Pylint.

                  resource logs, and checks them against any provided list of
    suspicious domains."""

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 fast_mode=False, log=None, results=[]):
        super().__init__(file_path=file_path, base_folder=base_folder,
                         output_folder=output_folder, fast_mode=fast_mode,
                         log=log, results=results)


            

Reported by Pylint.

                      if not self.indicators:
            return

        for key, entries in self.results.items():
            for entry in entries:
                source_domains = self._extract_domains(entry["redirect_source"])
                destination_domains = self._extract_domains(entry["redirect_destination"])

                # TODO: Currently not used.

            

Reported by Pylint.

                              source_domains = self._extract_domains(entry["redirect_source"])
                destination_domains = self._extract_domains(entry["redirect_destination"])

                # TODO: Currently not used.
                # subframe_origins = self._extract_domains(entry["subframe_under_origin"])
                # subresource_domains = self._extract_domains(entry["subresource_under_origin"])

                all_origins = set([entry["origin"]] + source_domains + destination_domains)


            

Reported by Pylint.

              # Mobile Verification Toolkit (MVT)
# Copyright (c) 2021 The MVT Project Authors.
# Use of this software is governed by the MVT License 1.1 that can be found at
#   https://license.mvt.re/1.1/

import glob
import os
import plistlib


            

Reported by Pylint.

              WEBKIT_SESSION_RESOURCE_LOG_BACKUP_IDS = [
    "a500ee38053454a02e990957be8a251935e28d3f",
]
WEBKIT_SESSION_RESOURCE_LOG_BACKUP_RELPATH = "Library/WebKit/WebsiteData/ResourceLoadStatistics/full_browsing_session_resourceLog.plist"
WEBKIT_SESSION_RESOURCE_LOG_ROOT_PATHS = [
    "private/var/mobile/Containers/Data/Application/*/SystemData/com.apple.SafariViewService/Library/WebKit/WebsiteData/full_browsing_session_resourceLog.plist",
    "private/var/mobile/Containers/Data/Application/*/Library/WebKit/WebsiteData/ResourceLoadStatistics/full_browsing_session_resourceLog.plist",
    "private/var/mobile/Library/WebClips/*/Storage/full_browsing_session_resourceLog.plist",
]

            

Reported by Pylint.

              ]
WEBKIT_SESSION_RESOURCE_LOG_BACKUP_RELPATH = "Library/WebKit/WebsiteData/ResourceLoadStatistics/full_browsing_session_resourceLog.plist"
WEBKIT_SESSION_RESOURCE_LOG_ROOT_PATHS = [
    "private/var/mobile/Containers/Data/Application/*/SystemData/com.apple.SafariViewService/Library/WebKit/WebsiteData/full_browsing_session_resourceLog.plist",
    "private/var/mobile/Containers/Data/Application/*/Library/WebKit/WebsiteData/ResourceLoadStatistics/full_browsing_session_resourceLog.plist",
    "private/var/mobile/Library/WebClips/*/Storage/full_browsing_session_resourceLog.plist",
]

class WebkitSessionResourceLog(IOSExtraction):

            

Reported by Pylint.

              WEBKIT_SESSION_RESOURCE_LOG_BACKUP_RELPATH = "Library/WebKit/WebsiteData/ResourceLoadStatistics/full_browsing_session_resourceLog.plist"
WEBKIT_SESSION_RESOURCE_LOG_ROOT_PATHS = [
    "private/var/mobile/Containers/Data/Application/*/SystemData/com.apple.SafariViewService/Library/WebKit/WebsiteData/full_browsing_session_resourceLog.plist",
    "private/var/mobile/Containers/Data/Application/*/Library/WebKit/WebsiteData/ResourceLoadStatistics/full_browsing_session_resourceLog.plist",
    "private/var/mobile/Library/WebClips/*/Storage/full_browsing_session_resourceLog.plist",
]

class WebkitSessionResourceLog(IOSExtraction):
    """This module extracts records from WebKit browsing session

            

Reported by Pylint.

                  resource logs, and checks them against any provided list of
    suspicious domains."""

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 fast_mode=False, log=None, results=[]):
        super().__init__(file_path=file_path, base_folder=base_folder,
                         output_folder=output_folder, fast_mode=fast_mode,
                         log=log, results=results)


            

Reported by Pylint.

              
import pkg_resources

from .base import AndroidExtraction

log = logging.getLogger(__name__)

class Packages(AndroidExtraction):
    """This module extracts the list of installed packages."""

            

Reported by Pylint.

              class Packages(AndroidExtraction):
    """This module extracts the list of installed packages."""

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 serial=None, fast_mode=False, log=None, results=[]):
        super().__init__(file_path=file_path, base_folder=base_folder,
                         output_folder=output_folder, fast_mode=fast_mode,
                         log=log, results=results)


            

Reported by Pylint.

                  """This module extracts the list of installed packages."""

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 serial=None, fast_mode=False, log=None, results=[]):
        super().__init__(file_path=file_path, base_folder=base_folder,
                         output_folder=output_folder, fast_mode=fast_mode,
                         log=log, results=results)

    def serialize(self, record):

            

Reported by Pylint.

                  """This module extracts the list of installed packages."""

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 serial=None, fast_mode=False, log=None, results=[]):
        super().__init__(file_path=file_path, base_folder=base_folder,
                         output_folder=output_folder, fast_mode=fast_mode,
                         log=log, results=results)

    def serialize(self, record):

            

Reported by Pylint.

              # Mobile Verification Toolkit (MVT)
# Copyright (c) 2021 The MVT Project Authors.
# Use of this software is governed by the MVT License 1.1 that can be found at
#   https://license.mvt.re/1.1/

import logging
import os

import pkg_resources

            

Reported by Pylint.

              class Packages(AndroidExtraction):
    """This module extracts the list of installed packages."""

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 serial=None, fast_mode=False, log=None, results=[]):
        super().__init__(file_path=file_path, base_folder=base_folder,
                         output_folder=output_folder, fast_mode=fast_mode,
                         log=log, results=results)


            

Reported by Pylint.

                                       output_folder=output_folder, fast_mode=fast_mode,
                         log=log, results=results)

    def serialize(self, record):
        records = []

        timestamps = [
            {"event": "package_install", "timestamp": record["timestamp"]},
            {"event": "package_first_install", "timestamp": record["first_install_time"]},

            

Reported by Pylint.

                          {"event": "package_last_update", "timestamp": record["last_update_time"]},
        ]

        for ts in timestamps:
            records.append({
                "timestamp": ts["timestamp"],
                "module": self.__class__.__name__,
                "event": ts["event"],
                "data": f"{record['package_name']} (system: {record['system']}, third party: {record['third_party']})",

            

Reported by Pylint.

                              "timestamp": ts["timestamp"],
                "module": self.__class__.__name__,
                "event": ts["event"],
                "data": f"{record['package_name']} (system: {record['system']}, third party: {record['third_party']})",
            })

        return records

    def check_indicators(self):

            

Reported by Pylint.

              
        return records

    def check_indicators(self):
        root_packages_path = os.path.join("..", "..", "data", "root_packages.txt")
        root_packages_string = pkg_resources.resource_string(__name__, root_packages_path)
        root_packages = root_packages_string.decode("utf-8").split("\n")

        for root_package in root_packages:

            

Reported by Pylint.

              
from mvt.common.utils import convert_mactime_to_unix, convert_timestamp_to_iso

from ..base import IOSExtraction

SMS_BACKUP_IDS = [
    "3d0d7e5fb2ce288813306e4d4636395e047a3d28",
]
SMS_ROOT_PATHS = [

            

Reported by Pylint.

              class SMSAttachments(IOSExtraction):
    """This module extracts all info about SMS/iMessage attachments."""

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 fast_mode=False, log=None, results=[]):
        super().__init__(file_path=file_path, base_folder=base_folder,
                         output_folder=output_folder, fast_mode=fast_mode,
                         log=log, results=results)


            

Reported by Pylint.

                          attachment["service"] = attachment["service"] or "Unknown"
            attachment["filename"] = attachment["filename"] or "NULL"

            if (attachment["filename"].startswith("/var/tmp/") and attachment["filename"].endswith("-1") and
                attachment["direction"] == "received"):
                self.log.warn(f"Suspicious iMessage attachment '{attachment['filename']}' on {attachment['isodate']}")
                self.detected.append(attachment)

            self.results.append(attachment)

            

Reported by Bandit.

              # Mobile Verification Toolkit (MVT)
# Copyright (c) 2021 The MVT Project Authors.
# Use of this software is governed by the MVT License 1.1 that can be found at
#   https://license.mvt.re/1.1/

import sqlite3
from base64 import b64encode

from mvt.common.utils import convert_mactime_to_unix, convert_timestamp_to_iso

            

Reported by Pylint.

              class SMSAttachments(IOSExtraction):
    """This module extracts all info about SMS/iMessage attachments."""

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 fast_mode=False, log=None, results=[]):
        super().__init__(file_path=file_path, base_folder=base_folder,
                         output_folder=output_folder, fast_mode=fast_mode,
                         log=log, results=results)


            

Reported by Pylint.

                                       output_folder=output_folder, fast_mode=fast_mode,
                         log=log, results=results)

    def serialize(self, record):
        return {
            "timestamp": record["isodate"],
            "module": self.__class__.__name__,
            "event": "sms_attachment",
            "data": f"{record['service']}: Attachment '{record['transfer_name']}' {record['direction']} from {record['phone_number']} "

            

Reported by Pylint.

                          "timestamp": record["isodate"],
            "module": self.__class__.__name__,
            "event": "sms_attachment",
            "data": f"{record['service']}: Attachment '{record['transfer_name']}' {record['direction']} from {record['phone_number']} "
                    f"with {record['total_bytes']} bytes (is_sticker: {record['is_sticker']}, has_user_info: {record['has_user_info']})"
        }

    def run(self):
        self._find_ios_database(backup_ids=SMS_BACKUP_IDS,

            

Reported by Pylint.

                          "module": self.__class__.__name__,
            "event": "sms_attachment",
            "data": f"{record['service']}: Attachment '{record['transfer_name']}' {record['direction']} from {record['phone_number']} "
                    f"with {record['total_bytes']} bytes (is_sticker: {record['is_sticker']}, has_user_info: {record['has_user_info']})"
        }

    def run(self):
        self._find_ios_database(backup_ids=SMS_BACKUP_IDS,
                                root_paths=SMS_ROOT_PATHS)

            

Reported by Pylint.

                                  f"with {record['total_bytes']} bytes (is_sticker: {record['is_sticker']}, has_user_info: {record['has_user_info']})"
        }

    def run(self):
        self._find_ios_database(backup_ids=SMS_BACKUP_IDS,
                                root_paths=SMS_ROOT_PATHS)
        self.log.info("Found SMS database at path: %s", self.file_path)

        conn = sqlite3.connect(self.file_path)

            

Reported by Pylint.

                                  value = b64encode(value).decode()
                attachment[names[index]] = value

            attachment["isodate"] = convert_timestamp_to_iso(convert_mactime_to_unix(attachment["created_date"]))
            attachment["start_date"] = convert_timestamp_to_iso(convert_mactime_to_unix(attachment["start_date"]))
            attachment["direction"] = ("sent" if attachment["is_outgoing"] == 1 else "received")
            attachment["has_user_info"] = attachment["user_info"] is not None
            attachment["service"] = attachment["service"] or "Unknown"
            attachment["filename"] = attachment["filename"] or "NULL"

            

Reported by Pylint.

              #   https://license.mvt.re/1.1/

import requests
from tld import get_tld

SHORTENER_DOMAINS = [
    "1link.in",
    "1url.com",
    "2big.at",

            

Reported by Pylint.

                      :param url: URL to parse
        :returns: Just the domain name extracted from the URL
        """
        # TODO: Properly handle exception.
        try:
            return get_tld(self.url, as_object=True, fix_protocol=True).parsed_url.netloc.lower().lstrip("www.")
        except:
            return None


            

Reported by Pylint.

                      # TODO: Properly handle exception.
        try:
            return get_tld(self.url, as_object=True, fix_protocol=True).parsed_url.netloc.lower().lstrip("www.")
        except:
            return None

    def get_top_level(self):
        """Get only the top level domain from a URL.
        :param url: URL to parse

            

Reported by Pylint.

                      :param url: URL to parse
        :returns: The top level domain extracted from the URL
        """
        # TODO: Properly handle exception.
        try:
            return get_tld(self.url, as_object=True, fix_protocol=True).fld.lower()
        except:
            return None


            

Reported by Pylint.

                      # TODO: Properly handle exception.
        try:
            return get_tld(self.url, as_object=True, fix_protocol=True).fld.lower()
        except:
            return None

    def check_if_shortened(self):
        if self.domain.lower() in SHORTENER_DOMAINS:
            self.is_shortened = True

            

Reported by Pylint.

              # Mobile Verification Toolkit (MVT)
# Copyright (c) 2021 The MVT Project Authors.
# Use of this software is governed by the MVT License 1.1 that can be found at
#   https://license.mvt.re/1.1/

import requests
from tld import get_tld

SHORTENER_DOMAINS = [

            

Reported by Pylint.

                  "1drv.ms",
]

class URL:

    def __init__(self, url):
        if type(url) == bytes:
            url = url.decode()


            

Reported by Pylint.

              class URL:

    def __init__(self, url):
        if type(url) == bytes:
            url = url.decode()

        self.url = url
        self.domain = self.get_domain()
        self.top_level = self.get_top_level()

            

Reported by Pylint.

                      """
        # TODO: Properly handle exception.
        try:
            return get_tld(self.url, as_object=True, fix_protocol=True).parsed_url.netloc.lower().lstrip("www.")
        except:
            return None

    def get_top_level(self):
        """Get only the top level domain from a URL.

            

Reported by Pylint.

                      except:
            return None

    def check_if_shortened(self):
        if self.domain.lower() in SHORTENER_DOMAINS:
            self.is_shortened = True

        return self.is_shortened


            

Reported by Pylint.

              import os
import sqlite3

from ..base import IOSExtraction


class CacheFiles(IOSExtraction):

    def __init__(self, file_path=None, base_folder=None, output_folder=None,

            

Reported by Pylint.

              
class CacheFiles(IOSExtraction):

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 fast_mode=False, log=None, results=[]):
        super().__init__(file_path=file_path, base_folder=base_folder,
                         output_folder=output_folder, fast_mode=fast_mode,
                         log=log, results=results)


            

Reported by Pylint.

                      if not self.indicators:
            return

        self.detected = {}
        for key, items in self.results.items():
            for item in items:
                if self.indicators.check_domain(item["url"]):
                    if key not in self.detected:
                        self.detected[key] = [item,]

            

Reported by Pylint.

                          })

    def run(self):
        self.results = {}
        for root, dirs, files in os.walk(self.base_folder):
            for file_name in files:
                if file_name != "Cache.db":
                    continue


            

Reported by Pylint.

              
    def run(self):
        self.results = {}
        for root, dirs, files in os.walk(self.base_folder):
            for file_name in files:
                if file_name != "Cache.db":
                    continue

                file_path = os.path.join(root, file_name)

            

Reported by Pylint.

              # Mobile Verification Toolkit (MVT)
# Copyright (c) 2021 The MVT Project Authors.
# Use of this software is governed by the MVT License 1.1 that can be found at
#   https://license.mvt.re/1.1/

import os
import sqlite3

from ..base import IOSExtraction

            

Reported by Pylint.

              from ..base import IOSExtraction


class CacheFiles(IOSExtraction):

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 fast_mode=False, log=None, results=[]):
        super().__init__(file_path=file_path, base_folder=base_folder,
                         output_folder=output_folder, fast_mode=fast_mode,

            

Reported by Pylint.

              
class CacheFiles(IOSExtraction):

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 fast_mode=False, log=None, results=[]):
        super().__init__(file_path=file_path, base_folder=base_folder,
                         output_folder=output_folder, fast_mode=fast_mode,
                         log=log, results=results)


            

Reported by Pylint.

                                       output_folder=output_folder, fast_mode=fast_mode,
                         log=log, results=results)

    def serialize(self, record):
        records = []
        for item in self.results[record]:
            records.append({
                "timestamp": item["isodate"],
                "module": self.__class__.__name__,

            

Reported by Pylint.

              
        return records

    def check_indicators(self):
        if not self.indicators:
            return

        self.detected = {}
        for key, items in self.results.items():

            

Reported by Pylint.

              
from mvt.common.utils import convert_timestamp_to_iso

from ..base import IOSExtraction


class Filesystem(IOSExtraction):
    """This module extracts creation and modification date of files from a
    full file-system dump."""

            

Reported by Pylint.

                  """This module extracts creation and modification date of files from a
    full file-system dump."""

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 fast_mode=False, log=None, results=[]):
        super().__init__(file_path=file_path, base_folder=base_folder,
                         output_folder=output_folder, fast_mode=fast_mode,
                         log=log, results=results)


            

Reported by Pylint.

                              self.detected.append(result)

    def run(self):
        for root, dirs, files in os.walk(self.base_folder):
            for file_name in files:
                try:
                    file_path = os.path.join(root, file_name)
                    result = {
                        "file_path": os.path.relpath(file_path, self.base_folder),

            

Reported by Pylint.

                                      "file_path": os.path.relpath(file_path, self.base_folder),
                        "modified": convert_timestamp_to_iso(datetime.datetime.utcfromtimestamp(os.stat(file_path).st_mtime)),
                    }
                except:
                    continue
                else:
                    self.results.append(result)

            

Reported by Pylint.

              # Mobile Verification Toolkit (MVT)
# Copyright (c) 2021 The MVT Project Authors.
# Use of this software is governed by the MVT License 1.1 that can be found at
#   https://license.mvt.re/1.1/

import datetime
import os

from mvt.common.utils import convert_timestamp_to_iso

            

Reported by Pylint.

                  """This module extracts creation and modification date of files from a
    full file-system dump."""

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 fast_mode=False, log=None, results=[]):
        super().__init__(file_path=file_path, base_folder=base_folder,
                         output_folder=output_folder, fast_mode=fast_mode,
                         log=log, results=results)


            

Reported by Pylint.

                                       output_folder=output_folder, fast_mode=fast_mode,
                         log=log, results=results)

    def serialize(self, record):
        return {
            "timestamp": record["modified"],
            "module": self.__class__.__name__,
            "event": "file_modified",
            "data": record["file_path"],

            

Reported by Pylint.

                          "data": record["file_path"],
        }

    def check_indicators(self):
        if not self.indicators:
            return

        for result in self.results:
            if self.indicators.check_file(result["file_path"]):

            

Reported by Pylint.

                          if self.indicators.check_file(result["file_path"]):
                self.detected.append(result)

    def run(self):
        for root, dirs, files in os.walk(self.base_folder):
            for file_name in files:
                try:
                    file_path = os.path.join(root, file_name)
                    result = {

            

Reported by Pylint.

                                  file_path = os.path.join(root, file_name)
                    result = {
                        "file_path": os.path.relpath(file_path, self.base_folder),
                        "modified": convert_timestamp_to_iso(datetime.datetime.utcfromtimestamp(os.stat(file_path).st_mtime)),
                    }
                except:
                    continue
                else:
                    self.results.append(result)

            

Reported by Pylint.