dfindexeddb 20251109__py3-none-any.whl → 20260205__py3-none-any.whl

dfindexeddb/indexeddb/safari/record.py

@@ -54,6 +54,8 @@ class IndexedDBRecord:
     object_store_name: the object store name from the ObjectStoreInfo table.
     database_name: the IndexedDB database name from the IDBDatabaseInfo table.
     record_id: the record ID from the Record table.
+    raw_key: the raw key.
+    raw_value: the raw value.
   """
 
   key: Any
@@ -62,6 +64,8 @@ class IndexedDBRecord:
   object_store_name: str
   database_name: str
   record_id: int
+  raw_key: Optional[bytes] = None
+  raw_value: Optional[bytes] = None
 
 
 class FileReader:
@@ -128,7 +132,9 @@ class FileReader:
             database_name=self.database_name,
         )
 
-  def RecordById(self, record_id: int) -> Optional[IndexedDBRecord]:
+  def RecordById(
+      self, record_id: int, include_raw_data: bool = False
+  ) -> Optional[IndexedDBRecord]:
     """Returns an IndexedDBRecord for the given record_id.
 
     Returns:
@@ -156,10 +162,12 @@ class FileReader:
           object_store_name=row[3].decode("utf-8"),
           database_name=self.database_name,
           record_id=row[4],
+          raw_key=row[0] if include_raw_data else None,
+          raw_value=row[1] if include_raw_data else None,
       )
 
   def RecordsByObjectStoreName(
-      self, name: str
+      self, name: str, include_raw_data: bool = False
   ) -> Generator[IndexedDBRecord, None, None]:
     """Returns IndexedDBRecords for the given ObjectStore name.
 
@@ -184,10 +192,12 @@ class FileReader:
             object_store_name=row[3].decode("utf-8"),
             database_name=self.database_name,
             record_id=row[4],
+            raw_key=row[0] if include_raw_data else None,
+            raw_value=row[1] if include_raw_data else None,
         )
 
   def RecordsByObjectStoreId(
-      self, object_store_id: int
+      self, object_store_id: int, include_raw_data: bool = False
   ) -> Generator[IndexedDBRecord, None, None]:
     """Returns IndexedDBRecords for the given ObjectStore id.
 
@@ -213,9 +223,13 @@ class FileReader:
             object_store_name=row[3].decode("utf-8"),
             database_name=self.database_name,
             record_id=row[4],
+            raw_key=row[0] if include_raw_data else None,
+            raw_value=row[1] if include_raw_data else None,
         )
 
-  def Records(self) -> Generator[IndexedDBRecord, None, None]:
+  def Records(
+      self, include_raw_data: bool = False
+  ) -> Generator[IndexedDBRecord, None, None]:
     """Returns all the IndexedDBRecords."""
     with sqlite3.connect(f"file:{self.filename}?mode=ro", uri=True) as conn:
       conn.text_factory = bytes
@@ -252,4 +266,6 @@ class FileReader:
             object_store_name=row[3].decode("utf-8"),
             database_name=self.database_name,
             record_id=row[4],
+            raw_key=row[0] if include_raw_data else None,
+            raw_value=row[1] if include_raw_data else None,
         )

dfindexeddb/leveldb/utils.py

@@ -16,11 +16,21 @@
 from __future__ import annotations
 
 import io
+import struct
 from typing import BinaryIO, Tuple, Type, TypeVar
 
 from dfindexeddb import errors, utils
 
 
+_CHUNK_SIZE = 8
+_MARKER = _CHUNK_SIZE + 1
+_EMPTY_BINARY_SENTINEL = 0
+_SIGN_BIT = 1 << 63
+_SENTINEL = 0
+_TWO_BYTE_ENCODING_INDICATOR = 0x80
+_THREE_BYTE_ENCODING_INDICATOR = 0xFF
+
+
 class LevelDBDecoder(utils.StreamDecoder):
   """A helper class to decode data types from LevelDB files."""
 
@@ -64,6 +74,80 @@ class LevelDBDecoder(utils.StreamDecoder):
     _, buffer = self.ReadBytes(length * 2)
     return offset, buffer.decode(encoding=encoding)
 
+  def DecodeSortableBinary(self) -> Tuple[int, bytes]:
+    """Decodes a sortable binary from the binary stream.
+
+    Returns:
+      a tuple of the offset and the decoded bytes.
+
+    Raises:
+      errors.ParserError: if an invalid tag is encountered.
+    """
+    output = bytearray()
+
+    offset, first = self.PeekBytes(1)
+    if first[0] == _EMPTY_BINARY_SENTINEL:
+      self.ReadBytes(1)
+      return offset, b""
+
+    while True:
+      _, marker_or_sentinel = self.DecodeUint8()
+      if marker_or_sentinel == _MARKER:
+        _, chunk = self.ReadBytes(_CHUNK_SIZE)
+        output.extend(chunk)
+        continue
+      if 1 <= marker_or_sentinel <= _CHUNK_SIZE:
+        payload_len = marker_or_sentinel
+        padding_len = _CHUNK_SIZE - payload_len
+        if padding_len > 0:
+          return offset, bytes(output[:-padding_len])
+        return offset, bytes(output)
+      raise errors.ParserError(
+          f"Invalid marker or sentinel {marker_or_sentinel} in sortable binary"
+      )
+
+  def DecodeSortableDouble(self) -> Tuple[int, float]:
+    """Decodes a sortable double-precision float from the binary stream.
+
+    Returns:
+      a tuple of the offset and the decoded double.
+    """
+    offset, host_bits = self.DecodeInt(8, byte_order="big", signed=False)
+    if host_bits & _SIGN_BIT:
+      host_bits ^= _SIGN_BIT
+    else:
+      host_bits ^= 0xFFFFFFFFFFFFFFFF
+    blob = host_bits.to_bytes(8, byteorder="big")
+    return offset, struct.unpack(">d", blob)[0]
+
+  def DecodeSortableString(self) -> Tuple[int, str]:
+    """Decodes a sortable string from the binary stream.
+
+    Returns:
+      a tuple of the offset and the decoded string.
+
+    Raises:
+      errors.ParserError: if an invalid byte is encountered.
+    """
+    output = []
+    offset = self.stream.tell()
+    while True:
+      _, first = self.DecodeUint8()
+      if first == _SENTINEL:
+        break
+      if (first & 0x80) == 0:
+        output.append(chr((first & 0x7F) - 1))
+      elif (first & 0xC0) == _TWO_BYTE_ENCODING_INDICATOR:
+        _, second = self.DecodeUint8()
+        output.append(chr(((first & 0x3F) << 8) | second))
+      elif first == _THREE_BYTE_ENCODING_INDICATOR:
+        _, high = self.DecodeUint8()
+        _, low = self.DecodeUint8()
+        output.append(chr((high << 8) | low))
+      else:
+        raise errors.ParserError(f"Invalid byte {first} in sortable string")
+    return offset, "".join(output)
+
 
 T = TypeVar("T")
 

dfindexeddb/version.py

@@ -15,7 +15,7 @@
 """Version information for dfIndexeddb."""
 
 
-__version__ = "20251109"
+__version__ = "20260205"
 
 
 def GetVersion() -> str:

{dfindexeddb-20251109.dist-info → dfindexeddb-20260205.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dfindexeddb
-Version: 20251109
+Version: 20260205
 Summary: dfindexeddb is an experimental Python tool for performing digital forensic analysis of IndexedDB and leveldb files.
 Author-email: Syd Pleno <sydp@google.com>
 Maintainer-email: dfIndexeddb Developers <dfindexeddb-dev@googlegroups.com>
@@ -55,6 +55,8 @@ include:
     $ pip install dfindexeddb
 ```
 
+### Optional plugins
+
 To also install the dependencies for leveldb/indexeddb plugins, run
 ```
     $ pip install 'dfindexeddb[plugins]'
@@ -79,6 +81,8 @@ To also install the dependencies for leveldb/indexeddb plugins, run
     $ pip install .
 ```
 
+### Optional plugins
+
 To also install the dependencies for leveldb/indexeddb plugins, run
 ```
     $ pip install '.[plugins]'
@@ -94,15 +98,17 @@ installation:
 
 ```
 $ dfindexeddb -h
-usage: dfindexeddb [-h] {db,ldb,log} ...
+usage: dfindexeddb [-h] {blink,gecko,db,ldb,log} ...
 
-A cli tool for parsing indexeddb files
+A cli tool for parsing IndexedDB files
 
 positional arguments:
-  {db,ldb,log}
-    db          Parse a directory as indexeddb.
-    ldb         Parse a ldb file as indexeddb.
-    log         Parse a log file as indexeddb.
+  {blink,gecko,db,ldb,log}
+    blink               Parse a file as a blink-encoded value.
+    gecko               Parse a file as a gecko-encoded value.
+    db                  Parse a directory/file as IndexedDB.
+    ldb                 Parse a ldb file as IndexedDB.
+    log                 Parse a log file as IndexedDB.
 
 options:
   -h, --help    show this help message and exit
@@ -110,48 +116,17 @@ options:
 
 #### Examples:
 
-To parse IndexedDB records from an sqlite file for Firefox and output the
-results as JSON, use the following command:
-
-```
-dfindexeddb db -s SOURCE --format firefox -o json
-```
-
-To parse IndexedDB records from an sqlite file for Safari and output the
-results as JSON-L, use the following command:
-
-```
-dfindexeddb db -s SOURCE --format safari -o jsonl
-```
-
-To parse IndexedDB records from a LevelDB folder for Chrome/Chromium, using the
-manifest file to determine recovered records and output as JSON, use the
-following command:
-
-```
-dfindexeddb db -s SOURCE --format chrome --use_manifest
-```
-
-To parse IndexedDB records from a LevelDB ldb (.ldb) file and output the
-results as JSON-L, use the following command:
-
-```
-dfindexeddb ldb -s SOURCE -o jsonl
-```
-
-To parse IndexedDB records from a LevelDB log (.log) file and output the
-results as the Python printable representation, use the following command:
-
-```
-dfindexeddb log -s SOURCE -o repr
-```
-
-To parse a file as a Chrome/Chromium IndexedDB blink value and output the
-results as JSON:
+| Platform / Source | Format | Command |
+| :--- | :--- | :--- |
+| **Firefox** (sqlite) | JSON | `dfindexeddb db -s SOURCE --format firefox -o json` |
+| **Safari** (sqlite) | JSON-L | `dfindexeddb db -s SOURCE --format safari -o jsonl` |
+| **Chrome** (LevelDB/sqlite) | JSON | `dfindexeddb db -s SOURCE --format chrome` |
+| **Chrome** (.ldb) | JSON-L | `dfindexeddb ldb -s SOURCE -o jsonl` |
+| **Chrome** (.log) | Python repr | `dfindexeddb log -s SOURCE -o repr` |
+| **Chrome** (Blink) | JSON | `dfindexeddb blink -s SOURCE` |
+| **Filter Records by key** | JSON | `dfindexeddb db -s SOURCE --format chrome --filter_key search_term` |
+| **Filter Records by value** | JSON | `dfindexeddb db -s SOURCE --format chrome --filter_value "search_term"` |
 
-```
-dfindexeddb blink -s SOURCE
-```
 
 ### LevelDB
 
@@ -174,44 +149,18 @@ options:
 
 #### Examples
 
-To parse records from a LevelDB folder, use the following command:
-
-```
-dfleveldb db -s SOURCE
-```
-
-To parse records from a LevelDB folder, and use the sequence number to
-determine recovered records and output as JSON, use the
-following command:
-
-```
-dfleveldb db -s SOURCE --use_sequence_number
-```
-
-To parse blocks / physical records/ write batches / internal key records from a
-LevelDB log (.log) file, use the following command, specifying the type (block,
-physical_records, etc) via the `-t` option.  By default, internal key records are parsed:
-
-```
-$ dfleveldb log  -s SOURCE [-t {blocks,physical_records,write_batches,parsed_internal_key}]
-```
-
-To parse blocks / records from a LevelDB table (.ldb) file, use the following
-command, specifying the type (blocks, records) via the `-t` option.  By
-default, records are parsed:
-
-```
-$ dfleveldb ldb -s SOURCE [-t {blocks,records}]
-```
-
-To parse version edit records from a Descriptor (MANIFEST) file, use the
-following command:
-
-```
-$ dfleveldb descriptor -s SOURCE [-o {json,jsonl,repr}] [-t {blocks,physical_records,versionedit} | -v]
-```
-
-#### Plugins
+| Source | Type | Command |
+| :--- | :--- | :--- |
+| **LevelDB Folder** | Records | `dfleveldb db -s SOURCE` |
+| **Log file** (.log) | Physical Records | `dfleveldb log -s SOURCE -t physical_records` |
+| **Log file** (.log) | Blocks | `dfleveldb log -s SOURCE -t blocks` |
+| **Log file** (.log) | Write Batches | `dfleveldb log -s SOURCE -t write_batches` |
+| **Log file** (.log) | Internal Key Records | `dfleveldb log -s SOURCE -t parsed_internal_key` |
+| **Table file** (.ldb) | Records | `dfleveldb ldb -s SOURCE -t record` |
+| **Table file** (.ldb) | Blocks | `dfleveldb ldb -s SOURCE -t blocks` |
+| **Descriptor** (MANIFEST) | Version Edits | `dfleveldb descriptor -s SOURCE -t versionedit` |
+
+#### Optional Plugins
 
 To apply a plugin parser for a leveldb file/folder, add the
 `--plugin [Plugin Name]` argument.  Currently, there is support for the

{dfindexeddb-20251109.dist-info → dfindexeddb-20260205.dist-info}/RECORD

@@ -1,23 +1,24 @@
 dfindexeddb/__init__.py,sha256=KPYL9__l8od6_OyDfGRTgaJ6iy_fqIgZ-dS2S-e3Rac,599
 dfindexeddb/errors.py,sha256=PNpwyf_lrPc4TE77oAakX3mu5D_YcP3f80wq8Y1LkvY,749
 dfindexeddb/utils.py,sha256=gep43m3LpAZNnW6JFOQTDn8MRrEXzGlc1NZ5yMuBsvI,10194
-dfindexeddb/version.py,sha256=C6239PGrB1o3OzfiWQ-W1g11b6xwmAfs53zspL7Ub1w,758
+dfindexeddb/version.py,sha256=Cc6Drn2uY77dYocXLvSTJsbyUur_ujj6hChTvvNhnnY,758
 dfindexeddb/indexeddb/__init__.py,sha256=kExXSVBCTKCD5BZJkdMfUMqGksH-DMJxP2_lI0gq-BE,575
-dfindexeddb/indexeddb/cli.py,sha256=gEVlE6ZRAu360Oc5dePVQEupKLEGQUt6mUljlbptIUE,7686
+dfindexeddb/indexeddb/cli.py,sha256=EbPmRloa95xoDlBhwH9ShgMGb8z118CZN_oarFtbZDE,12419
 dfindexeddb/indexeddb/types.py,sha256=m9llt7PTVMSvhsQ_uDIlZJUkbM_5k3gUx5CtMc3TvC8,1893
 dfindexeddb/indexeddb/utils.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 dfindexeddb/indexeddb/chromium/__init__.py,sha256=kExXSVBCTKCD5BZJkdMfUMqGksH-DMJxP2_lI0gq-BE,575
 dfindexeddb/indexeddb/chromium/blink.py,sha256=oQdbgzn4w1dUs3jAqtCF0078o4ccupHSjH0hB42vJSc,32978
-dfindexeddb/indexeddb/chromium/definitions.py,sha256=cNFUhE9ngd_-NSNnH-0sXNRaX1keNrN6UKvF_ADaYds,8864
-dfindexeddb/indexeddb/chromium/record.py,sha256=AwZTvgjwj3wOPSNh2S94SXD2Ynhi8l1xqTB1asWp3vg,49373
+dfindexeddb/indexeddb/chromium/definitions.py,sha256=HFe2aiAMCOrGkncZX80wzQVvaka8MzDpDZ8I1vE0HMs,10732
+dfindexeddb/indexeddb/chromium/record.py,sha256=3U_NzidU-pAIFo1bHZucupi44-QmYXitYU9f9VA3yjI,56224
+dfindexeddb/indexeddb/chromium/sqlite.py,sha256=fT3fmDuM3KgQD6OKhRrgYkg3ranfFN3BQZmr8DEt5PE,11476
 dfindexeddb/indexeddb/chromium/v8.py,sha256=cbaFQmhZoJMWGphLdvz1ZcvTge9MSh6GLH4K1yQNiWk,21888
 dfindexeddb/indexeddb/firefox/__init__.py,sha256=kExXSVBCTKCD5BZJkdMfUMqGksH-DMJxP2_lI0gq-BE,575
 dfindexeddb/indexeddb/firefox/definitions.py,sha256=C9qziLvNMmWFwVrt6K_lw4I_1YbiWJ9nxb65x0TefvU,4306
 dfindexeddb/indexeddb/firefox/gecko.py,sha256=rcph8PrX0IL_67cCvx9EsbEK_8r8lkXvW-nU7_2IsxA,19932
-dfindexeddb/indexeddb/firefox/record.py,sha256=wm0jHuTK47Qp6NPb2dQzRcqHnFTxOaPIz9sDHqb8gSc,6878
+dfindexeddb/indexeddb/firefox/record.py,sha256=8T2s9e66qNUugCEqOLG3mtpq309njGkY20yrdek_Kio,7314
 dfindexeddb/indexeddb/safari/__init__.py,sha256=kExXSVBCTKCD5BZJkdMfUMqGksH-DMJxP2_lI0gq-BE,575
 dfindexeddb/indexeddb/safari/definitions.py,sha256=_st96KuCjgzAeltDGylmoojlCtVvTGQPWwqzYCuX3s8,2793
-dfindexeddb/indexeddb/safari/record.py,sha256=TKD1ltTOzhjKKU-3sCy7zm4H2r4NAZjlNel57m4BDZo,8132
+dfindexeddb/indexeddb/safari/record.py,sha256=vwAud6yxlGmhT4UGvojBPjJ7NuIIsNkr7liJjY1yBj0,8874
 dfindexeddb/indexeddb/safari/webkit.py,sha256=16Vj7f3Pbts2ebdFg1dXmqQ3ixAKKv4_3znvsP21b4U,20816
 dfindexeddb/leveldb/__init__.py,sha256=KPYL9__l8od6_OyDfGRTgaJ6iy_fqIgZ-dS2S-e3Rac,599
 dfindexeddb/leveldb/cli.py,sha256=7CkM9P0bk83uj1cJrGFai82FIPBF0sul1tI2KUTMokA,10291
@@ -26,15 +27,15 @@ dfindexeddb/leveldb/descriptor.py,sha256=Cmy9y73cBeb586pryoagZ0-Zb2iA_8MCRGu6SN5
 dfindexeddb/leveldb/ldb.py,sha256=7sjpqMXrU6iXz5d4GAx58BuEknpjPM3qlrzNv6jdLIk,8140
 dfindexeddb/leveldb/log.py,sha256=oCMpLH8STOSK0qM-u44wnf781ehy5-JPe1e_osMlgL4,9510
 dfindexeddb/leveldb/record.py,sha256=Fnz7i446IO3IjJZAlB9olM_VSiEaM2ONHzG7BqrBzak,11978
-dfindexeddb/leveldb/utils.py,sha256=-70BjnttqGHHG1Ze9r8Pxspp6LGbRqHxXb3FODyXF6I,3879
+dfindexeddb/leveldb/utils.py,sha256=Nl4JT_rnQZnHA6APhM_c8tPS9U6R2EAM4KxnclbRqTg,6476
 dfindexeddb/leveldb/plugins/__init__.py,sha256=RoC6tRkq8FhqIaFs6jwu1fao_qaSvlSfIFxQVjWregI,690
 dfindexeddb/leveldb/plugins/chrome_notifications.py,sha256=H2TgriK_mre1kflTh2Zd2aIvcoHXa_qJum5f5Sbwp88,5485
 dfindexeddb/leveldb/plugins/interface.py,sha256=1kFbhzgiRLQ18gdOc-pzbizQ7dp_Li-ut4ZHjXSxKIU,1193
 dfindexeddb/leveldb/plugins/manager.py,sha256=UV8dtdeu6xPCNzvx3fSef1WrZxGPzkPBD8mD2qpoVzY,2317
 dfindexeddb/leveldb/plugins/notification_database_data_pb2.py,sha256=DCPZHbyq2szLgrBprOKrJKycKJma8Z_SnAQM6Jx9bZg,4389
-dfindexeddb-20251109.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
-dfindexeddb-20251109.dist-info/METADATA,sha256=pewsavAQMLj0KqCnAxod4ZswNQ02HV9dBXEIEirLiLc,6015
-dfindexeddb-20251109.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
-dfindexeddb-20251109.dist-info/entry_points.txt,sha256=WG9YNLZ9lBx4Q9QF6wS4dZdZfADT3Zs4_-MV5TcA0ls,102
-dfindexeddb-20251109.dist-info/top_level.txt,sha256=X9OTaub1c8S_JJ7g-f8JdkhhdiZ4x1j4eni1hdUCwE4,12
-dfindexeddb-20251109.dist-info/RECORD,,
+dfindexeddb-20260205.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
+dfindexeddb-20260205.dist-info/METADATA,sha256=q0VwkHYGOmrEp7Up_dPYGwXPdULB4MxI1y_dWH5IGAE,5520
+dfindexeddb-20260205.dist-info/WHEEL,sha256=wUyA8OaulRlbfwMtmQsvNngGrxQHAvkKcvRmdizlJi0,92
+dfindexeddb-20260205.dist-info/entry_points.txt,sha256=WG9YNLZ9lBx4Q9QF6wS4dZdZfADT3Zs4_-MV5TcA0ls,102
+dfindexeddb-20260205.dist-info/top_level.txt,sha256=X9OTaub1c8S_JJ7g-f8JdkhhdiZ4x1j4eni1hdUCwE4,12
+dfindexeddb-20260205.dist-info/RECORD,,

{dfindexeddb-20251109.dist-info → dfindexeddb-20260205.dist-info}/WHEEL

@@ -1,5 +1,5 @@
 Wheel-Version: 1.0
-Generator: setuptools (80.9.0)
+Generator: setuptools (80.10.2)
 Root-Is-Purelib: true
 Tag: py3-none-any