I'll send a picture.
",
+ ""
+ ],
+ [
+ 1637783225,
+ "ThisIs DfirTwo",
+ "8:live:.cid.5638f9306b7b8594",
+ "I'll audio call you.
",
+ ""
+ ],
+ [
+ 1637783673,
+ "ThisIs DfirTwo",
+ "8:live:.cid.5638f9306b7b8594",
+ "Looks like the call failed. I'll try it again.
",
+ ""
+ ],
+ [
+ 1637783830,
+ "ThisIs DFIR",
+ "8:live:.cid.832804f1252ed9b2",
+ "That one failed too, maybe...?",
+ ""
+ ],
+ [
+ 1637783914,
+ "ThisIs DfirTwo",
+ "8:live:.cid.5638f9306b7b8594",
+ "Here's your bad message.
",
+ ""
+ ],
+ [
+ 1637787099,
+ "ThisIs DFIR",
+ "8:live:.cid.832804f1252ed9b2",
+ "Looks like only the sender can delete. ",
+ ""
+ ],
+ [
+ 1637787129,
+ "ThisIs DFIR",
+ "8:live:.cid.832804f1252ed9b2",
+ "",
+ ""
+ ],
+ [
+ 1637787239,
+ "ThisIs DFIR",
+ "8:live:.cid.832804f1252ed9b2",
+ "Deleted. ",
+ ""
+ ],
+ [
+ 1638647000,
+ "ThisIs DFIR",
+ "8:live:.cid.832804f1252ed9b2",
+ "I have no idea. It's got to be generally correct though.
",
+ ""
+ ],
+ [
+ 1668541420,
+ "ThisIs DfirTwo",
+ "8:live:.cid.5638f9306b7b8594",
+ "Certainly looks that way. Lol. ",
+ ""
+ ],
+ [
+ 1668541538,
+ "ThisIs DFIR",
+ "8:live:.cid.832804f1252ed9b2",
+ "I'll send a picture. Standby.
",
+ ""
+ ],
+ [
+ 1668541688,
+ "ThisIs DfirTwo",
+ "8:live:.cid.5638f9306b7b8594",
+ "I'd say. Especially the part about the Christmas music.
",
+ ""
+ ],
+ [
+ 1668542061,
+ "ThisIs DFIR",
+ "8:live:.cid.832804f1252ed9b2",
+ "Yep. I'll audio call you. Hang on.
",
+ ""
+ ],
+ [
+ 1668542371,
+ "ThisIs DfirTwo",
+ "8:live:.cid.5638f9306b7b8594",
+ "My turn. ",
+ ""
+ ],
+ [
+ 1668542608,
+ "ThisIs DFIR",
+ "8:live:.cid.832804f1252ed9b2",
+ "Video call time. ",
+ ""
+ ],
+ [
+ 1668542834,
+ "ThisIs DfirTwo",
+ "8:live:.cid.5638f9306b7b8594",
+ "I'll video call you.
",
+ ""
+ ],
+ [
+ 1668543051,
+ "ThisIs DFIR",
+ "8:live:.cid.832804f1252ed9b2",
+ "",
+ ""
+ ],
+ [
+ 1668543082,
+ "ThisIs DfirTwo",
+ "8:live:.cid.5638f9306b7b8594",
+ "Then delete the one you just sent. ",
+ ""
+ ],
+ [
+ 1668543198,
+ "ThisIs DFIR",
+ "8:live:.cid.832804f1252ed9b2",
+ "Done. ",
+ ""
+ ],
+ [
+ 1670248018,
+ "ThisIs DFIR",
+ "8:live:.cid.832804f1252ed9b2",
+ "
'
- except:
- logfunc(f'Error on block lines 47 - 57, content on {row[0]}')
- data_list.append((row[0], row[1], row[2], thumb))
-
- description = 'Teams Messages'
- report = ArtifactHtmlReport('Teams Messages')
- report.start_artifact_report(report_folder, 'Teams Messages', description)
- report.add_script()
- data_headers = ('Timestamp', 'Name', 'Message', 'Shared Media')
- report.write_artifact_data_table(data_headers, data_list, file_found, html_no_escape=['Shared Media']
-)
- report.end_artifact_report()
+ try:
+ shutil.copy2(match, report_folder)
+ data_file_name = os.path.basename(match)
+ thumb = f'
'
+ except Exception as e:
+ logfunc(f'Error copying media file: {str(e)}')
+ except Exception as e:
+ logfunc(f'Error processing image for message at {timestamp}: {str(e)}')
- tsvname = 'Microsoft Teams Messages'
- tsv(report_folder, data_headers, data_list, tsvname)
-
- tlactivity = 'Microsoft Teams Messages'
- timeline(report_folder, tlactivity, data_list, data_headers)
- else:
- logfunc('No Microsoft Teams Messages data available')
+ data_list.append((timestamp, display_name, sender, content, thumb))
+
+ db.close()
+
+ data_headers = (
+ ('Timestamp', 'datetime'),
+ 'Display Name',
+ 'From',
+ 'Message',
+ 'Shared Media'
+ )
+
+ return data_headers, data_list, db_file
+
+@artifact_processor
+def teamsContacts(files_found, report_folder, seeker, wrap_text, timezone_offset):
+ if not files_found:
+ return
+
+ data_list = []
+ db_file = None
+
+ for file_found in files_found:
+ if file_found.endswith('.sqlite'):
+ db_file = file_found
+ break
+
+ if not db_file:
+ logfunc('No Teams database found')
+ return
+
+ db = open_sqlite_db_readonly(db_file)
+ cursor = db.cursor()
cursor.execute('''
- SELECT
- ZDISPLAYNAME,
- zemail,
- ZPHONENUMBER
- from
- ZDEVICECONTACTHASH
+ SELECT
+ ZDISPLAYNAME,
+ ZEMAIL,
+ ZPHONENUMBER
+ FROM ZDEVICECONTACTHASH
''')
- all_rows = cursor.fetchall()
- usageentries = len(all_rows)
+ for row in cursor.fetchall():
+ display_name = row[0] if row[0] else ''
+ email = row[1] if row[1] else ''
+
+ # Clean phone number
+ phone = row[2] if row[2] else ''
+ if phone:
+ # Remove common formatting characters
+ phone = phone.replace('(', '').replace(')', '').replace('-', '')
+ phone = phone.replace(' ', '').replace('.', '').replace('+', '')
+
+ data_list.append((display_name, email, phone))
+
+ db.close()
+
+ data_headers = (
+ 'Display Name',
+ ('Email', 'phonenumber'),
+ ('Phone Number', 'phonenumber')
+ )
+
+ return data_headers, data_list, db_file
+
+@artifact_processor
+def teamsUser(files_found, report_folder, seeker, wrap_text, timezone_offset):
+ if not files_found:
+ return
+
data_list = []
+ db_file = None
- if usageentries > 0:
- for row in all_rows:
- data_list.append((row[0], row[1], row[2]))
-
- description = 'Teams Contact'
- report = ArtifactHtmlReport('Teams Contact')
- report.start_artifact_report(report_folder, 'Teams Contact', description)
- report.add_script()
- data_headers = ('Display Name', 'Email', 'Phone Number')
- report.write_artifact_data_table(data_headers, data_list, file_found)
- report.end_artifact_report()
-
- tsvname = 'Teams Contact'
- tsv(report_folder, data_headers, data_list, tsvname)
-
- else:
- logfunc('No Teams Contact data available')
+ for file_found in files_found:
+ if file_found.endswith('.sqlite'):
+ db_file = file_found
+ break
+
+ if not db_file:
+ logfunc('No Teams database found')
+ return
+
+ db = open_sqlite_db_readonly(db_file)
+ cursor = db.cursor()
cursor.execute('''
- SELECT
- datetime('2001-01-01', "ZTS_LASTSYNCEDAT" || ' seconds'),
- ZDISPLAYNAME,
- ZTELEPHONENUMBER
- from zuser
+ SELECT
+ datetime('2001-01-01', "ZTS_LASTSYNCEDAT" || ' seconds'),
+ ZDISPLAYNAME,
+ ZTELEPHONENUMBER
+ FROM ZUSER
''')
- all_rows = cursor.fetchall()
- usageentries = len(all_rows)
+ for row in cursor.fetchall():
+ timestamp = convert_ts_human_to_timezone_offset(row[0], timezone_offset)
+ display_name = row[1] if row[1] else ''
+ phone = row[2] if row[2] else ''
+ data_list.append((timestamp, display_name, phone))
+
+ db.close()
+
+ data_headers = (
+ ('Timestamp Last Sync', 'datetime'),
+ 'Display Name',
+ ('Phone Number', 'phonenumber')
+ )
+
+ return data_headers, data_list, db_file
+
+@artifact_processor
+def teamsCalls(files_found, report_folder, seeker, wrap_text, timezone_offset):
+ if not files_found:
+ return
+
data_list = []
+ db_file = None
+
+ for file_found in files_found:
+ if file_found.endswith('.sqlite'):
+ db_file = file_found
+ break
+
+ if not db_file:
+ logfunc('No Teams database found')
+ return
+
+ db = open_sqlite_db_readonly(db_file)
+ cursor = db.cursor()
- if usageentries > 0:
- for row in all_rows:
- data_list.append((row[0], row[1], row[2]))
-
- description = 'Teams User'
- report = ArtifactHtmlReport('Teams User')
- report.start_artifact_report(report_folder, 'Teams User', description)
- report.add_script()
- data_headers = ('Timestamp Last Sync', 'Display Name', 'Phone Number')
- report.write_artifact_data_table(data_headers, data_list, file_found)
- report.end_artifact_report()
-
- tsvname = 'Microsoft Teams User'
- tsv(report_folder, data_headers, data_list, tsvname)
-
- tlactivity = 'Microsoft Teams User'
- timeline(report_folder, tlactivity, data_list, data_headers)
-
- else:
- logfunc('No Teams User data available')
-
cursor.execute('''
- SELECT
- ZCOMPOSETIME,
- zfrom,
- ZIMDISPLAYNAME,
- zcontent,
- ZPROPERTIES
- from ZSMESSAGE, ZMESSAGEPROPERTIES
- where ZSMESSAGE.ZTSID = ZMESSAGEPROPERTIES.ZTSID
- order by ZCOMPOSETIME
+ SELECT
+ ZCOMPOSETIME,
+ ZFROM,
+ ZIMDISPLAYNAME,
+ ZCONTENT,
+ ZPROPERTIES
+ FROM ZSMESSAGE
+ JOIN ZMESSAGEPROPERTIES ON ZSMESSAGE.ZTSID = ZMESSAGEPROPERTIES.ZTSID
+ WHERE ZPROPERTIES IS NOT NULL
+ ORDER BY ZCOMPOSETIME
''')
- all_rows = cursor.fetchall()
- usageentries = len(all_rows)
- data_list_calls = []
- data_list_cards = []
- data_list_unparsed = []
+ for row in cursor.fetchall():
+ try:
+ compose_time = convert_ts_human_to_timezone_offset(row[0].replace('T', ' '), timezone_offset)
+ plist_file_object = io.BytesIO(row[4])
+
+ try:
+ plist = nd.deserialize_plist(plist_file_object)
+ except Exception as e:
+ logfunc(f'Failed to read plist: {str(e)}')
+ continue
+
+ if 'call-log' in plist:
+ try:
+ if isinstance(plist['call-log'], dict):
+ datacalls = plist['call-log']
+ else:
+ datacalls = json.loads(plist['call-log'])
+
+ call_start = convert_ts_human_to_timezone_offset(
+ datacalls.get('startTime', '').replace('T', ' '),
+ timezone_offset
+ ) if datacalls.get('startTime') else ''
+
+ call_connect = convert_ts_human_to_timezone_offset(
+ datacalls.get('connectTime', '').replace('T', ' '),
+ timezone_offset
+ ) if datacalls.get('connectTime') else ''
+
+ call_end = convert_ts_human_to_timezone_offset(
+ datacalls.get('endTime', '').replace('T', ' '),
+ timezone_offset
+ ) if datacalls.get('endTime') else ''
+
+ data_list.append((
+ compose_time,
+ row[1] if row[1] else '', # from
+ row[2] if row[2] else '', # display_name
+ row[3] if row[3] else '', # content
+ call_start,
+ call_connect,
+ call_end,
+ datacalls.get('callDirection', ''),
+ datacalls.get('callType', ''),
+ datacalls.get('callState', ''),
+ datacalls.get('originator', ''),
+ datacalls.get('target', ''),
+ datacalls.get('originatorParticipant', {}).get('displayName', ''),
+ datacalls.get('targetParticipant', {}).get('displayName', '')
+ ))
+ except Exception as e:
+ logfunc(f'Error processing call log data: {str(e)} - Data: {plist["call-log"]}')
+
+ except Exception as e:
+ logfunc(f'Error processing row: {str(e)}')
+
+ db.close()
- if usageentries > 0:
- for row in all_rows:
- plist = ''
- composetime = row[0].replace('T',' ')
+ data_headers = (
+ ('Compose Timestamp', 'datetime'),
+ 'From',
+ 'Display Name',
+ 'Content',
+ ('Call Start', 'datetime'),
+ ('Call Connect', 'datetime'),
+ ('Call End', 'datetime'),
+ 'Call Direction',
+ 'Call Type',
+ 'Call State',
+ 'Call Originator',
+ 'Call Target',
+ 'Call Originator Name',
+ 'Call Participant Name'
+ )
+
+ return data_headers, data_list, db_file
+
+@artifact_processor
+def teamsLocations(files_found, report_folder, seeker, wrap_text, timezone_offset):
+ if not files_found:
+ return
+
+ data_list = []
+ db_file = None
+
+ for file_found in files_found:
+ if file_found.endswith('.sqlite'):
+ db_file = file_found
+ break
+
+ if not db_file:
+ logfunc('No Teams database found')
+ return
+
+ db = open_sqlite_db_readonly(db_file)
+ cursor = db.cursor()
+
+ cursor.execute('''
+ SELECT
+ ZCOMPOSETIME,
+ ZFROM,
+ ZIMDISPLAYNAME,
+ ZCONTENT,
+ ZPROPERTIES
+ FROM ZSMESSAGE
+ JOIN ZMESSAGEPROPERTIES ON ZSMESSAGE.ZTSID = ZMESSAGEPROPERTIES.ZTSID
+ WHERE ZPROPERTIES IS NOT NULL
+ ORDER BY ZCOMPOSETIME
+ ''')
+
+ for row in cursor.fetchall():
+ try:
+ compose_time = convert_ts_human_to_timezone_offset(row[0].replace('T', ' '), timezone_offset)
plist_file_object = io.BytesIO(row[4])
- if row[4].find(b'NSKeyedArchiver') == -1:
- if sys.version_info >= (3, 9):
- plist = plistlib.load(plist_file_object)
- else:
- plist = biplist.readPlist(plist_file_object)
- else:
+
+ try:
+ plist = nd.deserialize_plist(plist_file_object)
+ except Exception as e:
+ logfunc(f'Failed to read plist: {str(e)}')
+ continue
+
+ if 'cards' in plist:
try:
- plist = nd.deserialize_plist(plist_file_object)
- except (nd.DeserializeError, nd.biplist.NotBinaryPlistException, nd.biplist.InvalidPlistException,
- nd.plistlib.InvalidFileException, nd.ccl_bplist.BplistError, ValueError, TypeError, OSError, OverflowError) as ex:
- logfunc(f'Failed to read plist for {row[4]}, error was:' + str(ex))
- if 'call-log' in plist:
- datacalls = json.loads(plist['call-log'])
- callstart = (datacalls.get('startTime'))
- callstart = callstart.replace('T',' ')
- callconnect = (datacalls.get('connectTime'))
- callconnect = callconnect.replace('T',' ')
- callend = (datacalls['endTime'])
- callend = callend.replace('T',' ')
- calldirection = (datacalls['callDirection'])
- calltype = (datacalls['callType'])
- callstate = (datacalls['callState'])
- calloriginator = (datacalls['originator'])
- calltarget = (datacalls['target'])
- calloriginatordname = (datacalls['originatorParticipant']['displayName'])
- callparticipantdname = (datacalls['targetParticipant']['displayName'])
- data_list_calls.append((composetime, row[1], row[2], row[3], callstart, callconnect, callend, calldirection, calltype, callstate, calloriginator, calltarget, calloriginatordname, callparticipantdname))
- elif 'cards' in plist:
- cards = json.loads(plist['cards'])
- cardurl = (cards[0]['content']['body'][0]['selectAction']['url'])
- cardtitle = (cards[0]['content']['body'][0]['selectAction']['title'])
- cardtext = (cards[0]['content']['body'][1]['text'])
- cardurl2 = (cards[0]['content']['body'][0]['url'])
- if (cards[0]['content']['body'][0].get('id')) is not None:
- idcontent = json.loads(cards[0]['content']['body'][0]['id'])
- cardlat = (idcontent.get('latitude'))
- cardlong = (idcontent.get('longitude'))
- cardexpires = (idcontent.get('expiresAt'))
- cardexpires = datetime.datetime.fromtimestamp(cardexpires / 1000)
- carddevid = (idcontent.get('deviceId'))
- data_list_cards.append((composetime, row[1], row[2], row[3], cardurl, cardtitle, cardtext, cardurl2, cardlat, cardlong, cardexpires, carddevid))
- else:
- data_list_unparsed.append((composetime, row[1], row[2], row[3], plist))
-
- description = 'Microsoft Teams Call Logs'
- report = ArtifactHtmlReport('Microsoft Teams Call Logs')
- report.start_artifact_report(report_folder, 'Teams Call Logs', description)
- report.add_script()
- data_headers = ('Compose Timestamp', 'From', 'Display Name', 'Content',' Call Start', 'Call Connect', 'Call End', 'Call Direction', 'Call Type', 'Call State', 'Call Originator', 'Call Target', 'Call Originator Name', 'Call Participant Name')
- report.write_artifact_data_table(data_headers, data_list_calls, file_found)
- report.end_artifact_report()
-
- tsvname = 'Microsoft Teams Call Logs'
- tsv(report_folder, data_headers, data_list_calls, tsvname)
-
- tlactivity = 'Microsoft Teams Call Logs'
- timeline(report_folder, tlactivity, data_list_calls, data_headers)
-
- description = 'Microsoft Teams Shared Locations'
- report = ArtifactHtmlReport('Microsoft Teams Shared Locations')
- report.start_artifact_report(report_folder, 'Teams Shared Locations', description)
- report.add_script()
- data_headers = ('Timestamp', 'From', 'Display Name', 'Content','Card URL', 'Card Title', 'Card Text', 'Card URL2', 'Latitude', 'Longitude', 'Card Expires', 'Device ID')
- report.write_artifact_data_table(data_headers, data_list_cards, file_found)
- report.end_artifact_report()
-
- tsvname = 'Microsoft Teams Shared Locations'
- tsv(report_folder, data_headers, data_list_cards, tsvname)
-
- tlactivity = 'Microsoft Teams Shared Locations'
- timeline(report_folder, tlactivity, data_list_cards, data_headers)
-
- kmlactivity = 'Microsoft Teams Shared Locations'
- kmlgen(report_folder, kmlactivity, data_list_cards, data_headers)
-
- else:
- logfunc('No Microsoft Teams Call Logs & Cards data available')
-
+ cards = json.loads(plist['cards'])
+ card = cards[0]['content']['body'][0]
+
+ card_url = card.get('selectAction', {}).get('url', '')
+ card_title = card.get('selectAction', {}).get('title', '')
+ card_text = cards[0]['content']['body'][1].get('text', '')
+ card_url2 = card.get('url', '')
+
+ card_lat = None
+ card_long = None
+ card_expires = None
+ card_devid = None
+
+ if card.get('id'):
+ try:
+ id_content = json.loads(card['id'])
+ card_lat = id_content.get('latitude')
+ card_long = id_content.get('longitude')
+ expires_ms = id_content.get('expiresAt')
+ if expires_ms:
+ card_expires = convert_ts_human_to_timezone_offset(
+ datetime.datetime.fromtimestamp(expires_ms / 1000).strftime('%Y-%m-%d %H:%M:%S'),
+ timezone_offset
+ )
+ card_devid = id_content.get('deviceId')
+ except Exception as e:
+ logfunc(f'Error processing card ID data: {str(e)}')
+
+ data_list.append((
+ compose_time,
+ row[1] if row[1] else '', # from
+ row[2] if row[2] else '', # display_name
+ row[3] if row[3] else '', # content
+ card_url,
+ card_title,
+ card_text,
+ card_url2,
+ card_lat,
+ card_long,
+ card_expires,
+ card_devid
+ ))
+ except Exception as e:
+ logfunc(f'Error processing card data: {str(e)}')
+
+ except Exception as e:
+ logfunc(f'Error processing row: {str(e)}')
db.close()
-__artifacts__ = {
- "teams": (
- "Microsoft Teams",
- ('*/mobile/Containers/Shared/AppGroup/*/SkypeSpacesDogfood/*/Skype*.sqlite*','*/mobile/Containers/Shared/AppGroup/*/SkypeSpacesDogfood/Downloads/*/Images/*'),
- get_teams)
-}
-
-
\ No newline at end of file
+ data_headers = (
+ ('Timestamp', 'datetime'),
+ 'From',
+ 'Display Name',
+ 'Content',
+ 'Card URL',
+ 'Card Title',
+ 'Card Text',
+ 'Card URL2',
+ 'Latitude',
+ 'Longitude',
+ ('Card Expires', 'datetime'),
+ 'Device ID'
+ )
+
+ return data_headers, data_list, db_file
+
![\"Selected](\"https://us-api.asm.skype.com/v1/objects/0-eus-d3-57ce420192f2c16feda74acc08c9acc3/views/imgo\")
\n ![\"\ud83e\udd37\"](\"https://statics.teams.cdn.live.net/evergreen-assets/personal-expressions/v1/assets/emoticons/manshrug/default/100_f.png?etag=v56\")
\n