dod-cyber-crime-center / sqlite-dissect Goto Github PK

Hello,

Running the precompiled binary for Windows x64 for v.0.2.0 found here:
https://github.com/dod-cyber-crime-center/sqlite-dissect/releases/tag/v0.2.0

I am trying to recover records in the "Cookies"-database for Chrome/Edge located either in:
C:\Users<my-user>\AppData\Local\Google\Chrome\User Data\Default\Network [Chrome]
C:\Users<my-user>\AppData\Local\Microsoft\Edge\User Data\Default\Network [Edge]

and issuing the following command:
.\sqlite_dissect.exe "C:\Users\<my-user>\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies" -d "C:\Users\<my-user>\Desktop\sqlite_dissect\" -e sqlite --carve
and it returns:

Parsing: C:\Users\<my-user>\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies...
No handlers could be found for logger "sqlite_dissect"

Exporting history as SQLite to C:\Users\<my-user>\Desktop\sqlite_dissect\\Cookies-sqlite-dissect.db3...
Finished in 0.08 seconds.

Now the end result is a "db3"-file but no deleted cookies recovered.
Steps to reproduce:

1. Go into Edge / Chrome
2. Settings > Privacy & Security > Cookies > See all data and site permissions
3. Open up the "Cookies"-DB in SQLite DB Viewer
4. In the table "cookies" take note of exisiting cookies and using the opened Chrome/Edge Settings-page delete all cookies from a certain host
5. Refresh the table in SQLite DB Viewer to see that the cookies for host X are deleted
6. Run sqlite_dissect
7. Open the recovered DB / the output file

Just wondering if the error (?) "No handlers could be found for logger "sqlite_dissect"" can impact the carving result?

Dear sqlite-dissect-maintainers,

first of all, thanks for providing such a great tool!
Unfortunately, Python 2 reached its end of life a while ago. Are there any chances, that you will port the code to work with Python 3? Since, I saw that you work a lot with byte-strings, this might need numerous changes, I fear.

Thanks already in advance for considering this proposal.

Best regards
Jan

Background
Based on PEP-518, the build definition for a Python project should be converted to pyproject.toml

There is also not a current means to install and run SQLite Dissect without manually pointing to the main.py file.

Scope

• Convert all usage/references in workflows/ci.yml, .gitlab-ci.yml, docs/, and README.md
• Ensure the entire module can be installed and run as sqlite_dissect

During development, GitHub Actions warned that the v2 versions of several GitHub Actions were deprecated and needed to be upgraded to migrate to node 16 and to avoid set-output.

Node.js 12 actions are deprecated. For more information see: https://github.blog/changelog/2022-09-22-github-actions-all-actions-will-begin-running-on-node16-instead-of-node12/. Please update the following actions to use Node.js 16: actions/checkout@v2, actions/setup-python@v2, actions/upload-artifact@v2

The set-output command is deprecated and will be disabled soon. Please upgrade to using Environment Files. For more information see: https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/

Setting log debug is not a good programming practice, in production it can leak sensitive information.

Background:

With the CASE Cyber Ontology continuing to grow and be actively supported by forensic tools, we should ensure that SQLite Dissect supports this open standard of cyber investigations.

Scope:

For the initial operating capability, the following metadata should be supported:

• Tool information
• Runtime configuration (arguments)
• Investigation timeline and metadata from the execution
• Input observable files
• Output observable files and relationship to the tool

There should also exist a GitHub action and/or unit test to ensure the output is compatible with the CASE JSON-LD standard.

• Output validation

References:

CASE Ontology - https://caseontology.org/
CASE Export Examples - https://caseontology.org/examples/
CASE GitHub - https://github.com/casework/CASE