The iOS Logs, Events, And Properties Parser has been updated by adding the following artifacts:
- Photos.sqlite
- Metadata about media files to include deletion timestamps.
- Thanks to Heather Mahalik for the query.
- Medialibrary.sqlite
- Multimedia file list and metadata.
- Accounts3.sqlite
- System accounts.
- Zliveusage & zliveprocess data.
- Thanks to Sarah Edwards for the queries.
- Device screen auto lock history.
Fixes:
- Unicode support for artifact reports.
- Thanks to @xbrookego for testing and helping debug
- Error handling for databases that lack tables.
- Alternating report background row color for readability.
Any errors encountered during usage or request to support additional artifacts please report via Twitter @AlexisBrignoni and/or email 4n6[at]abrignoni[dot]com.
