dfindexeddb 20240519__tar.gz → 20241105__tar.gz

{dfindexeddb-20240519/dfindexeddb.egg-info → dfindexeddb-20241105}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dfindexeddb
-Version: 20240519
+Version: 20241105
 Summary: dfindexeddb is an experimental Python tool for performing digital forensic analysis of IndexedDB and leveldb files.
 Author-email: Syd Pleno <sydp@google.com>
 Maintainer-email: dfIndexeddb Developers <dfindexeddb-dev@googlegroups.com>
@@ -230,8 +230,7 @@ analysis of IndexedDB and LevelDB files.
 
 It parses LevelDB, IndexedDB and JavaScript structures from these files without
 requiring native libraries.  (Note: only a subset of IndexedDB key types and
-JavaScript types for Safari and Chromium-based browsers are currently supported.
-Firefox is under development).
+JavaScript types for Firefox, Safari and Chromium-based browsers are currently supported).
 
 The content of IndexedDB files is dependent on what a web application stores
 locally/offline using the web browser's
@@ -313,6 +312,13 @@ options:
 
 #### Examples:
 
+To parse IndexedDB records from an sqlite file for Firefox and output the
+results as JSON, use the following command:
+
+```
+dfindexeddb db -s SOURCE --format firefox -o json
+```
+
 To parse IndexedDB records from an sqlite file for Safari and output the
 results as JSON-L, use the following command:
 
@@ -376,7 +382,7 @@ To parse records from a LevelDB folder, use the following command:
 dfleveldb db -s SOURCE
 ```
 
-To parse records from a LevelDB folder, and use the sequence number to 
+To parse records from a LevelDB folder, and use the sequence number to
 determine recovered records and output as JSON, use the
 following command:
 
@@ -409,8 +415,8 @@ $ dfleveldb descriptor -s SOURCE [-o {json,jsonl,repr}] [-t {blocks,physical_rec
 
 #### Plugins
 
-To apply a plugin parser for a leveldb file/folder, add the 
-`--plugin [Plugin Name]` argument.  Currently, there is support for the 
+To apply a plugin parser for a leveldb file/folder, add the
+`--plugin [Plugin Name]` argument.  Currently, there is support for the
 following artifacts:
 
 | Plugin Name | Artifact Name |

{dfindexeddb-20240519 → dfindexeddb-20241105}/README.md

@@ -5,8 +5,7 @@ analysis of IndexedDB and LevelDB files.
 
 It parses LevelDB, IndexedDB and JavaScript structures from these files without
 requiring native libraries.  (Note: only a subset of IndexedDB key types and
-JavaScript types for Safari and Chromium-based browsers are currently supported.
-Firefox is under development).
+JavaScript types for Firefox, Safari and Chromium-based browsers are currently supported).
 
 The content of IndexedDB files is dependent on what a web application stores
 locally/offline using the web browser's
@@ -88,6 +87,13 @@ options:
 
 #### Examples:
 
+To parse IndexedDB records from an sqlite file for Firefox and output the
+results as JSON, use the following command:
+
+```
+dfindexeddb db -s SOURCE --format firefox -o json
+```
+
 To parse IndexedDB records from an sqlite file for Safari and output the
 results as JSON-L, use the following command:
 
@@ -151,7 +157,7 @@ To parse records from a LevelDB folder, use the following command:
 dfleveldb db -s SOURCE
 ```
 
-To parse records from a LevelDB folder, and use the sequence number to 
+To parse records from a LevelDB folder, and use the sequence number to
 determine recovered records and output as JSON, use the
 following command:
 
@@ -184,8 +190,8 @@ $ dfleveldb descriptor -s SOURCE [-o {json,jsonl,repr}] [-t {blocks,physical_rec
 
 #### Plugins
 
-To apply a plugin parser for a leveldb file/folder, add the 
-`--plugin [Plugin Name]` argument.  Currently, there is support for the 
+To apply a plugin parser for a leveldb file/folder, add the
+`--plugin [Plugin Name]` argument.  Currently, there is support for the
 following artifacts:
 
 | Plugin Name | Artifact Name |

{dfindexeddb-20240519 → dfindexeddb-20241105}/dfindexeddb/indexeddb/chromium/definitions.py

@@ -16,6 +16,11 @@
 from enum import Enum, IntEnum, IntFlag
 
 
+REQUIRES_PROCESSING_SSV_PSEUDO_VERSION = 0x11
+REPLACE_WITH_BLOB = 0x01
+COMPRESSED_WITH_SNAPPY = 0x02
+
+
 class DatabaseMetaDataKeyType(IntEnum):
   """Database Metadata key types."""
   ORIGIN_NAME = 0