Parse the different plist and SQLite databases in a Safari profile
(User, Path)
| 628 | ParseFirefoxProfile(User, Profile) |
| 629 | |
| 630 | def ParseSafariProfile(User, Path): |
| 631 | ''' Parse the different plist and SQLite databases in a Safari profile ''' |
| 632 | |
| 633 | HistoryPlist = False |
| 634 | DownloadsPlist = False |
| 635 | NbFiles = 0 |
| 636 | |
| 637 | PrintAndLog(User + u'\'s Safari profile', 'SUBSECTION') |
| 638 | |
| 639 | PrintAndLog(User + u'\'s Safari downloads', 'SUBSECTION') |
| 640 | DownloadsPlistPath = os.path.join(Path, 'Downloads.plist') |
| 641 | PrintAndLog(DownloadsPlistPath.decode('utf-8'), 'DEBUG') |
| 642 | |
| 643 | DownloadsPlist = UniversalReadPlist(DownloadsPlistPath) |
| 644 | |
| 645 | if DownloadsPlist: |
| 646 | if 'DownloadHistory' in DownloadsPlist: |
| 647 | Downloads = DownloadsPlist['DownloadHistory'] |
| 648 | for DL in Downloads: |
| 649 | DlStr = u'' |
| 650 | DlStr += DL['DownloadEntryURL'].decode('utf-8') + u' -> ' + DL['DownloadEntryPath'].decode('utf-8') + u' (' + DL['DownloadEntryIdentifier'].decode('utf-8') + u')\n' |
| 651 | PrintAndLog(DlStr, 'INFO') |
| 652 | |
| 653 | PrintAndLog(User + u'\'s Safari history', 'SUBSECTION') |
| 654 | HistoryPlistPath = os.path.join(Path, 'History.plist') |
| 655 | PrintAndLog(HistoryPlistPath.decode('utf-8'), 'DEBUG') |
| 656 | |
| 657 | HistoryPlist = UniversalReadPlist(HistoryPlistPath) |
| 658 | |
| 659 | if HistoryPlist: |
| 660 | if 'WebHistoryDates' in HistoryPlist: |
| 661 | History = HistoryPlist['WebHistoryDates'] |
| 662 | for H in History: |
| 663 | HStr = u'' |
| 664 | if 'title' in H: |
| 665 | HStr += unicode(H['title']) + u' - ' |
| 666 | if 'diplayTitle' in H: |
| 667 | HStr += unicode(H['diplayTitle']) + u' - ' |
| 668 | HStr += unicode(H['']) + u'\n' |
| 669 | PrintAndLog(HStr, 'INFO') |
| 670 | |
| 671 | PrintAndLog(User + u'\'s Safari TopSites', 'SUBSECTION') |
| 672 | TopSitesPlistPath = os.path.join(Path, 'TopSites.plist') |
| 673 | |
| 674 | PrintAndLog(TopSitesPlistPath.decode('utf-8'), 'DEBUG') |
| 675 | TopSitesPlist = UniversalReadPlist(TopSitesPlistPath) |
| 676 | |
| 677 | if TopSitesPlist: |
| 678 | if 'TopSites' in TopSitesPlist: |
| 679 | TopSites = TopSitesPlist['TopSites'] |
| 680 | for T in TopSites: |
| 681 | TStr = u'' |
| 682 | if 'TopSiteTitle' in T: |
| 683 | TStr += unicode(T['TopSiteTitle']) + u' - ' |
| 684 | TStr += unicode(T['TopSiteURLString']) + u'\n' |
| 685 | PrintAndLog(TStr , 'INFO') |
| 686 | |
| 687 |
no test coverage detected