Don't add SMS entries when read timestamp not set

This commit is contained in:
Donncha Ó Cearbhaill 2023-12-12 15:55:03 +01:00
parent e94913cf78
commit aa7c37d64e
2 changed files with 13 additions and 8 deletions

View File

@ -44,20 +44,25 @@ class SMS(IOSExtraction):
def serialize(self, record: dict) -> Union[dict, list]:
text = record["text"].replace("\n", "\\n")
sms_data = f"{record['service']}: {record['guid']} \"{text}\" from {record['phone_number']} ({record['account']})"
return [
sms_data = [
{
"timestamp": record["isodate"],
"module": self.__class__.__name__,
"event": "sms_received",
"data": sms_data,
},
{
"timestamp": record["isodate_read"],
"module": self.__class__.__name__,
"event": "sms_read",
"data": sms_data,
},
]
# If the message was read, we add an extra event.
if record["isodate_read"]:
sms_data.append(
{
"timestamp": record["isodate_read"],
"module": self.__class__.__name__,
"event": "sms_read",
"data": sms_data,
}
)
return sms_data
def check_indicators(self) -> None:
for message in self.results:

View File

@ -17,7 +17,7 @@ class TestSMSModule:
m = SMS(target_path=get_ios_backup_folder())
run_module(m)
assert len(m.results) == 1
assert len(m.timeline) == 2 # SMS received and read events.
assert len(m.timeline) == 1
assert len(m.detected) == 0
def test_detection(self, indicator_file):