-
Notifications
You must be signed in to change notification settings - Fork 227
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Attachment being considered file (compatibility with PA 10) #2262
Comments
Checking the reported issue |
@aberenguel, looking closer at your picture, the name of those items listed in the duplicates tab starts with Attachment_XXXXX, they seem to be subitems of the InstantMessage_XXXX items, according to their path. So, maybe the new behavior is correct. Could you check in the chats if those instant messages display as media messages and also confirm that displaying using Cellebrite Reader? |
I'll check this weekend. My Windows machine is crashed. |
Part of report.xml from PA 7: <file fs="EXTRACTION_FFS.zip" fsid="3c19b9e3-c5db-4e1a-8239-d6cf68f22bbb" path="/data/media/0/Android/data/org.telegram.messenger/files/Telegram/Telegram Video/1_4983387851321246717.mp4" size="11617721" id="ed538543-e8df-40fa-bfd7-af99c81f6602" extractionId="0" deleted="Intact" embedded="false" isrelated="False" decodedBy="System" source_index="89250">
<accessInfo>
<timestamp name="ModifyTime" format="TimeStampKnown" formattedTimestamp="2023-10-10T21:19:24+00:00">2023-10-10T21:19:24.000+00:00</timestamp>
</accessInfo>
<metadata section="File">
<item name="Local Path" systemtype="System.String"><![CDATA[files\Video\1_4983387851321246717.mp4]]></item>
<item name="SHA256" systemtype="System.String"><![CDATA[]]></item>
<item name="MD5" systemtype="System.String"><![CDATA[7e6f473c66c3772fcab21d46e3fcfd1a]]></item>
<item name="Tags" systemtype="System.String"><![CDATA[Video]]></item>
</metadata>
<metadata section="MetaData">
<item name="CoreFileSystemFileSystemNodeFileDataOffsetName" group="CoreFileSystemFileSystemNodeFileOffsetsCategory" systemtype="System.String"><![CDATA[0x5501C5BA5]]></item>
<item name="CoreFileSystemFileSystemNodeCreationTime" group="CoreFileSystemFileSystemNodeDateTime" systemtype="System.String"><![CDATA[]]></item>
<item name="CoreFileSystemFileSystemNodeModifyTime" group="CoreFileSystemFileSystemNodeDateTime" systemtype="System.String"><![CDATA[10/10/2023 21:19:24(UTC+0)]]></item>
<item name="CoreFileSystemFileSystemNodeLastAccessTime" group="CoreFileSystemFileSystemNodeDateTime" systemtype="System.String"><![CDATA[]]></item>
<item name="CoreFileSystemFileSystemNodeDeletedTime" group="CoreFileSystemFileSystemNodeDateTime" systemtype="System.String"><![CDATA[]]></item>
<item name="CoreFileSystemFileSystemNodeChangeTime" group="CoreFileSystemFileSystemNodeDateTime" systemtype="System.String"><![CDATA[]]></item>
<item name="ReportTemplateFileSize" systemtype="System.String"><![CDATA[11617721 Bytes]]></item>
<item name="CoreFileSystemFileSystemNodeFileChunks" systemtype="System.String"><![CDATA[1]]></item>
</metadata>
<sourcemodels>
<ownerid direction="Incoming" type="InstantMessage"><![CDATA[58b33ac5-231c-4b60-bbd3-e408f9a9380a]]></ownerid>
<ownerid direction="Incoming" type="InstantMessage"><![CDATA[6d570ee2-f011-49de-82cf-5c986f8023dc]]></ownerid>
<ownerid direction="Incoming" type="InstantMessage"><![CDATA[27489ab4-a2b9-4473-89d6-00b3be46c30d]]></ownerid>
</sourcemodels>
<jumptargets name="">
<targetid ismodel="true"><![CDATA[58b33ac5-231c-4b60-bbd3-e408f9a9380a]]></targetid>
<targetid ismodel="true"><![CDATA[6d570ee2-f011-49de-82cf-5c986f8023dc]]></targetid>
<targetid ismodel="true"><![CDATA[27489ab4-a2b9-4473-89d6-00b3be46c30d]]></targetid>
</jumptargets>
</file>
<model type="InstantMessage" id="6d570ee2-f011-49de-82cf-5c986f8023dc" deleted_state="Intact" decoding_confidence="High" isrelated="False" source_index="104235" extractionId="0">
<field name="UserMapping" type="DecodingSourceOptions">
<value type="DecodingSourceOptions"><![CDATA[Decoding]]></value>
</field>
<field name="Source" type="String">
<value type="String"><![CDATA[Telegram]]></value>
</field>
<field name="ServiceIdentifier" type="String">
<empty />
</field>
<modelField name="From" type="Party">
<model type="Party" id="841aa42a-e236-4f43-9b89-c930ade2a4bd" deleted_state="Unknown" decoding_confidence="High" isrelated="False" source_index="104236" extractionId="0">
<field name="Identifier" type="String">
<value type="String"><![CDATA[1919626957]]></value>
</field>
<field name="Role" type="PartyRole">
<value type="PartyRole"><![CDATA[From]]></value>
</field>
<field name="Name" type="String">
<empty />
</field>
<multiField name="IPAddresses" type="String" />
<field name="IsPhoneOwner" type="Boolean">
<value type="Boolean"><![CDATA[False]]></value>
</field>
<field name="IsGroupAdmin" type="Boolean">
<empty />
</field>
</model>
</modelField>
<multiModelField name="To" type="Party" />
<field name="Body" type="String">
<value type="String"><![CDATA[Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.]]></value>
</field>
<field name="Identifier" type="String">
<value type="String"><![CDATA[-1919626957:427]]></value>
</field>
<field name="TimeStamp" type="TimeStamp">
<value type="TimeStamp" format="TimeStampKnown" formattedTimestamp="2023-10-10T21:06:52+00:00">2023-10-10T21:06:52.000+00:00</value>
</field>
<modelField name="Attachment" type="Attachment">
<empty />
</modelField>
<multiModelField name="Attachments" type="Attachment">
<model type="Attachment" id="8031eda5-90ce-46f2-ac63-51c8be978d05" deleted_state="Intact" decoding_confidence="High" isrelated="False" source_index="104238" extractionId="0" file_id="ed538543-e8df-40fa-bfd7-af99c81f6602">
<field name="Filename" type="String">
<value type="String"><![CDATA[1_4983387851321246717.mp4]]></value>
</field>
<field name="ContentType" type="String">
<value type="String"><![CDATA[video/mp4]]></value>
</field>
<dataField name="Data" type="MemoryRange">
<source length="11617721" />
</dataField>
<field name="URL" type="String">
<empty />
</field>
<field name="Title" type="String">
<empty />
</field>
<field name="attachment_extracted_path" type="String">
<value type="String"><![CDATA[files\Video\1_4983387851321246717.mp4]]></value>
</field>
</model>
</multiModelField>
<field name="Status" type="MessageStatus">
<value type="MessageStatus"><![CDATA[Unread]]></value>
</field>
<multiModelField name="SharedContacts" type="Contact" />
<multiModelField name="MessageExtraData" type="InstantMessageExtraData">
<model type="MessageLabel" id="d80187a7-3ce1-4644-9892-dcb1529fc3ce" deleted_state="Unknown" decoding_confidence="High" isrelated="False" source_index="104237" extractionId="0">
<field name="Label" type="Label">
<value type="Label"><![CDATA[Edited]]></value>
</field>
</model>
</multiModelField>
<field name="Type" type="InstantMessageType">
<value type="InstantMessageType"><![CDATA[AppMessage]]></value>
</field>
<field name="IsLocationSharing" type="Boolean">
<empty />
</field>
<field name="SourceApplication" type="String">
<value type="String"><![CDATA[Telegram]]></value>
</field>
<jumptargets name="">
<targetid ismodel="false"><![CDATA[ed538543-e8df-40fa-bfd7-af99c81f6602]]></targetid>
</jumptargets>
</model> |
Part of report.xml from PA 10: <file fs="EXTRACTION_FFS.zip" fsid="eb45688c-8048-44f3-9b61-371565784dc9" path="/data/media/0/Android/data/org.telegram.messenger/files/Telegram/Telegram Video/1_4983387851321246717.mp4" name="1_4983387851321246717.mp4" size="11617721" id="47071582-c602-49bb-9944-15c3a314d8aa" extractionId="0" deleted="Intact" embedded="false" isrelated="False" source_index="87951">
<accessInfo>
<timestamp name="ModifyTime" format="TimeStampKnown" formattedTimestamp="2023-10-10T21:19:24+00:00">2023-10-10T21:19:24.000+00:00</timestamp>
</accessInfo>
<metadata section="File">
<item name="Local Path" systemtype="System.String"><![CDATA[files\Video\1_4983387851321246717.mp4]]></item>
<item name="SHA256" systemtype="System.String"><![CDATA[20f88a26a1b724f4102156135badc1b040ca98f10839b4313c181919a11275ac]]></item>
<item name="MD5" systemtype="System.String"><![CDATA[7e6f473c66c3772fcab21d46e3fcfd1a]]></item>
<item name="Tags" systemtype="System.String"><![CDATA[Video]]></item>
<item name="CapturingDevice" systemtype="System.String"><![CDATA[External]]></item>
<item name="CaptureOriginReasoning" systemtype="System.String"><![CDATA[Received]]></item>
<item name="CaptureOriginReasoning" systemtype="System.String"><![CDATA[Downloaded]]></item>
</metadata>
<metadata section="MetaData">
<item name="CoreFileSystemFileSystemNodeChangeTime" group="CoreFileSystemFileSystemNodeDateTime" systemtype="System.String"><![CDATA[]]></item>
<item name="CoreFileSystemFileSystemNodeCreationTime" group="CoreFileSystemFileSystemNodeDateTime" systemtype="System.String"><![CDATA[]]></item>
<item name="CoreFileSystemFileSystemNodeDeletedTime" group="CoreFileSystemFileSystemNodeDateTime" systemtype="System.String"><![CDATA[]]></item>
<item name="CoreFileSystemFileSystemNodeFileChunks" systemtype="System.String"><![CDATA[1]]></item>
<item name="CoreFileSystemFileSystemNodeFileDataOffsetName" group="CoreFileSystemFileSystemNodeFileOffsetsCategory" systemtype="System.String"><![CDATA[0x5501C5BA5]]></item>
<item name="CoreFileSystemFileSystemNodeFilePath" systemtype="System.String"><![CDATA[EXTRACTION_FFS.zip/data/media/0/Android/data/org.telegram.messenger/files/Telegram/Telegram Video/1_4983387851321246717.mp4]]></item>
<item name="CoreFileSystemFileSystemNodeLastAccessTime" group="CoreFileSystemFileSystemNodeDateTime" systemtype="System.String"><![CDATA[]]></item>
<item name="CoreFileSystemFileSystemNodeModifyTime" group="CoreFileSystemFileSystemNodeDateTime" systemtype="System.String"><![CDATA[10/10/2023 18:19:24(UTC-3)]]></item>
<item name="QuickTimeMovieEnumCreated" group="EXIF" systemtype="System.String"><![CDATA[ter out 10 21:06:56 2023]]></item>
<item name="QuickTimeTrackEnumCreated" group="EXIF" systemtype="System.String"><![CDATA[ter out 10 21:06:43 2023]]></item>
</metadata>
<sourcemodels>
<ownerid direction="Incoming"><![CDATA[9dab2cda-100a-4054-98d1-df08be783e7a]]></ownerid>
<ownerid direction="Incoming"><![CDATA[f94f50ad-30ff-4d51-81b9-6b972c8f72cb]]></ownerid>
<ownerid direction="Incoming"><![CDATA[750096b7-c2a3-4e54-9291-9002d6422f02]]></ownerid>
</sourcemodels>
</file>
<model type="InstantMessage" id="bd63e606-355f-4e3e-98fa-095b09bc7e8d" deleted_state="Intact" decoding_confidence="High" isrelated="False" source_index="104405" extractionId="0">
<field name="UserMapping" type="DecodingSourceOptions">
<value type="DecodingSourceOptions"><![CDATA[Decoding]]></value>
</field>
<field name="Source" type="String">
<value type="String"><![CDATA[Telegram]]></value>
</field>
<modelField name="From" type="Party">
<model type="Party" id="623b8eca-ddff-4424-ba04-4330bb1cb44a" deleted_state="Unknown" decoding_confidence="High" isrelated="False" source_index="104406" extractionId="0">
<field name="Identifier" type="String">
<value type="String"><![CDATA[1919626957]]></value>
</field>
<field name="Role" type="PartyRole">
<value type="PartyRole"><![CDATA[From]]></value>
</field>
<field name="Status" type="PartyStatus">
<value type="PartyStatus"><![CDATA[Unknown]]></value>
</field>
<field name="Name" type="String">
<value type="String"><![CDATA[XXXXXXXXXXXXXXXXXXXXXX]]></value>
</field>
<field name="Distance" type="Double">
<value type="Double"><![CDATA[0]]></value>
</field>
<field name="IsPhoneOwner" type="Boolean">
<value type="Boolean"><![CDATA[False]]></value>
</field>
<field name="IsGroupAdmin" type="Boolean">
<value type="Boolean"><![CDATA[False]]></value>
</field>
</model>
</modelField>
<field name="Body" type="String">
<value type="String"><![CDATA[Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.]]></value>
</field>
<field name="TimeStamp" type="TimeStamp">
<value type="TimeStamp" format="TimeStampKnown" formattedTimestamp="2023-10-10T21:06:55+00:00">2023-10-10T21:06:55.000+00:00</value>
</field>
<modelField name="Attachment" type="Attachment">
<empty />
</modelField>
<multiModelField name="Attachments" type="Attachment">
<model type="Attachment" id="48f59070-37bd-4e1c-89f9-73dab5b63f1b" deleted_state="Intact" decoding_confidence="High" isrelated="False" source_index="104409" extractionId="0" file_id="47071582-c602-49bb-9944-15c3a314d8aa">
<field name="Source" type="String">
<empty />
</field>
<field name="Filename" type="String">
<value type="String"><![CDATA[1_4983387851321246717.mp4]]></value>
</field>
<field name="ContentType" type="String">
<value type="String"><![CDATA[video/mp4]]></value>
</field>
<dataField name="Data" type="MemoryRange">
<source length="11617721" />
</dataField>
<field name="attachment_extracted_path" type="String">
<value type="String"><![CDATA[files\Video\1_4983387851321246717_33679.mp4]]></value>
</field>
</model>
</multiModelField>
<field name="Status" type="MessageStatus">
<value type="MessageStatus"><![CDATA[Unread]]></value>
</field>
<multiModelField name="SharedContacts" type="Contact" />
<field name="Label" type="Label">
<value type="Label"><![CDATA[Default]]></value>
</field>
<field name="Platform" type="Platform">
<value type="Platform"><![CDATA[Unknown]]></value>
</field>
<multiModelField name="MessageExtraData" type="InstantMessageExtraData">
<model type="MessageLabel" id="42fe7360-2fcc-4add-84b6-708773605a1e" deleted_state="Intact" decoding_confidence="High" isrelated="False" source_index="104407" extractionId="0">
<field name="Label" type="Label">
<value type="Label"><![CDATA[Edited]]></value>
</field>
</model>
<model type="ForwardedMessageData" id="3dffdc35-ab5f-43c3-b350-cade829529e8" deleted_state="Intact" decoding_confidence="High" isrelated="False" source_index="104408" extractionId="0">
<field name="Label" type="Label">
<value type="Label"><![CDATA[Forwarded]]></value>
</field>
<field name="TimeCreated" type="TimeStamp">
<value type="TimeStamp" format="TimeStampKnown" formattedTimestamp="2023-10-10T21:06:52+00:00">2023-10-10T21:06:52.000+00:00</value>
</field>
<modelField name="OriginalSender" type="Party">
<model type="Party" id="0ccc0a4a-e938-442e-8c20-83a0616c40e7" deleted_state="Unknown" decoding_confidence="High" isrelated="False" source_index="104410" extractionId="0">
<field name="Identifier" type="String">
<value type="String"><![CDATA[1919626957]]></value>
</field>
<field name="Role" type="PartyRole">
<value type="PartyRole"><![CDATA[From]]></value>
</field>
<field name="Status" type="PartyStatus">
<value type="PartyStatus"><![CDATA[Unknown]]></value>
</field>
<field name="Name" type="String">
<value type="String"><![CDATA[XXXXXXXXXXXXXXXXXXXXXX]]></value>
</field>
<field name="Distance" type="Double">
<value type="Double"><![CDATA[0]]></value>
</field>
<field name="IsPhoneOwner" type="Boolean">
<value type="Boolean"><![CDATA[False]]></value>
</field>
<field name="IsGroupAdmin" type="Boolean">
<value type="Boolean"><![CDATA[False]]></value>
</field>
</model>
</modelField>
</model>
</multiModelField>
<field name="Type" type="InstantMessageType">
<value type="InstantMessageType"><![CDATA[AppMessage]]></value>
</field>
<field name="Priority" type="MailPriority">
<value type="MailPriority"><![CDATA[Normal]]></value>
</field>
<field name="SelfDestructDuration" type="TimeSpan">
<value type="TimeSpan"><![CDATA[00:00:00]]></value>
</field>
<field name="IsLocationSharing" type="Boolean">
<value type="Boolean"><![CDATA[False]]></value>
</field>
<field name="Identifier" type="String">
<value type="String"><![CDATA[1811718519:5562]]></value>
</field>
<field name="SourceApplication" type="String">
<value type="String"><![CDATA[Telegram]]></value>
</field>
<jumptargets name="">
<targetid ismodel="false" targetType="File"><![CDATA[47071582-c602-49bb-9944-15c3a314d8aa]]></targetid>
</jumptargets>
</model> |
I pasted just one |
The path of items named as
|
…he ufedId of attached file
Talking to @marcosammoura, this bug happens due to the existence of duplicated files inside UFDR.
This might be related to a bug in Physical Analyzer. |
I've just checked a new UFDR generated by PA 10.3. In such case, the PA 10.3 solved the problem of duplicated files. The The fix of #2149 solves the issue when |
Not sure if I completely understood the situation here. Could someone elaborate more on what is the issue and how the proposed PR fix it? |
This proposal targets UFDR files generated by PA 8.x until 10.2. Those UFDRs files have fields Some examples of
Only the first one is added |
I wonder if |
This issue will be handled in #2286 UfedChatParser refactoring. |
#2262: if extracted_path does not reference a ufedId, use the ufedId of attached file
I processed an UFDR file generated by Physical Analyzer 10.2.
The result is that instant messages got from
DecodedData
are being considered files (same contentType, hash).This behavior first appeared after #2028 fix.
The text was updated successfully, but these errors were encountered: