RowIDetective/RowIDetective.xml at main · MetadataForensics/RowIDetective · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
<?xml version="1.0" encoding="utf-8"?>
<Artifacts version="2.0">
	<Artifact type="SqliteArtifact" name="RowIDetective - sms.db - Missing ROWID Data" version="2.0" platform="iOS">
		<Source type="FileName">sms.db</Source>
		<Query>
		WITH LastROWID AS (
			SELECT seq AS last_rowid
			FROM sqlite_sequence
			WHERE sqlite_sequence.name = 'message'
		)
		SELECT * FROM (
			SELECT * FROM (
				SELECT
				CASE
					WHEN length(DATE) = 18
					THEN LAG(DATETIME(DATE/1000000000 + 978307200, 'UNIXEPOCH'),1) OVER (ORDER BY ROWID)
					WHEN length(DATE) = 9
					THEN LAG(DATETIME(DATE + 978307200, 'UNIXEPOCH'),1) OVER (ORDER BY ROWID)
					END AS "Column1",
				CASE
					WHEN length(DATE) = 18
					THEN DATETIME(DATE/1000000000 + 978307200, 'UNIXEPOCH')
					WHEN length(DATE) = 9
					THEN DATETIME(DATE + 978307200, 'UNIXEPOCH')
					END  AS "Column2",
				LAG (guid,1) OVER (ORDER BY ROWID) AS "Previous guid",
				guid AS "guid",
				LAG (ROWID,1) OVER (ORDER BY ROWID) AS "Previous ROWID",
				ROWID AS "ROWID",
				(ROWID - (LAG (ROWID,1) OVER (ORDER BY ROWID)) - 1) AS "Column7"
				FROM message) list
				WHERE ROWID - "Previous ROWID" > 1

				UNION ALL

				SELECT
				CASE
					WHEN message.ROWID != (SELECT last_rowid FROM LastROWID)
					THEN MAX(CASE
						WHEN length(DATE) = 18
						THEN DATETIME(DATE/1000000000 + 978307200, 'UNIXEPOCH')
						WHEN length(DATE) = 9
						THEN DATETIME(DATE + 978307200, 'UNIXEPOCH')
						END)
					END AS "Column1",
				CASE
					WHEN message.ROWID != (SELECT last_rowid FROM LastROWID)
					THEN "Time of Extraction"
					END AS "Column2",
				CASE
					WHEN message.ROWID != (SELECT last_rowid FROM LastROWID)
					THEN guid
					END AS "Previous guid",
				CASE
					WHEN message.ROWID != (SELECT last_rowid FROM LastROWID)
					THEN "Unknown"
					END AS "guid",
				CASE
					WHEN message.ROWID != (SELECT last_rowid FROM LastROWID)
					THEN MAX(ROWID)
					END AS "Previous ROWID",
				CASE
					WHEN message.ROWID != (SELECT last_rowid FROM LastROWID)
					THEN (SELECT last_rowid FROM LastROWID)
					END AS "ROWID",
				CASE
					WHEN message.ROWID != (SELECT last_rowid FROM LastROWID)
					THEN ((SELECT last_rowid FROM LastROWID) - message.ROWID)
					END AS "Number of Missing Rows"
				FROM message)
		WHERE "ROWID" IS NOT NULL;</Query>
		<Fragments>
			<Fragment source="Column1" alias="Beginning Timestamp" datatype="String" category="None" />
			<Fragment source="Column2" alias="Ending Timestamp" datatype="String" category="None" />
			<Fragment source="Previous guid" alias="Previous guid" datatype="String" category="None" />
			<Fragment source="guid" alias="guid" datatype="String" category="None" />
			<Fragment source="Previous ROWID" alias="Previous ROWID" datatype="String" category="None" />
			<Fragment source="ROWID" alias="ROWID" datatype="String" category="None" />
			<Fragment source="Column7" alias="Number of Missing Rows" datatype="String" category="None" />
		</Fragments>
	</Artifact>
</Artifacts>