diff --git a/plaso/data/formatters/ios.yaml b/plaso/data/formatters/ios.yaml index 79dc4ec007..015bf2f3b5 100644 --- a/plaso/data/formatters/ios.yaml +++ b/plaso/data/formatters/ios.yaml @@ -241,4 +241,4 @@ message: short_message: - 'Activity description: {activity_description}' short_source: 'PLIST' -source: 'Apple iOS Mobile Backup application plist' \ No newline at end of file +source: 'Apple iOS Mobile Backup application plist' diff --git a/plaso/data/timeliner.yaml b/plaso/data/timeliner.yaml index 6167cb1303..6f008acb63 100644 --- a/plaso/data/timeliner.yaml +++ b/plaso/data/timeliner.yaml @@ -1800,4 +1800,4 @@ data_type: 'ios:mobile:backup:entry' attribute_mappings: - name: 'activity_time' description: 'Activity Time' -place_holder_event: false \ No newline at end of file +place_holder_event: false diff --git a/plaso/parsers/plist_plugins/ios_mobilebackup.py b/plaso/parsers/plist_plugins/ios_mobilebackup.py index d84887aa2d..983a05e583 100644 --- a/plaso/parsers/plist_plugins/ios_mobilebackup.py +++ b/plaso/parsers/plist_plugins/ios_mobilebackup.py @@ -4,8 +4,8 @@ The plist contains history of opened applications in the Mobile Backup. """ -from dfdatetime import posix_time as dfdatetime_posix_time import datetime +from dfdatetime import posix_time as dfdatetime_posix_time from plaso.containers import events from plaso.lib import definitions @@ -49,7 +49,6 @@ def _getEventData(self, description, datetime_value): timestamp = int(timestamp * definitions.NANOSECONDS_PER_SECOND) event_data.activity_time = dfdatetime_posix_time.PosixTimeInNanoseconds( timestamp=timestamp) - return event_data # pylint: disable=arguments-differ @@ -63,15 +62,24 @@ def _ParsePlist(self, parser_mediator, match=None, **unused_kwargs): """ datetime_value = match.get('AccountEnabledDate', {}) - parser_mediator.ProduceEventData(self._getEventData("AccountEnabledDate", datetime_value)) + parser_mediator.ProduceEventData( + self._getEventData("AccountEnabledDate", datetime_value) + ) plist_key = match.get('BackupStateInfo', {}) for key, value in plist_key.items(): if key == "date": - parser_mediator.ProduceEventData(self._getEventData(f"BackupStateInfo - date", value)) + parser_mediator.ProduceEventData( + self._getEventData("BackupStateInfo - date", value) + ) elif key == "errors": for val in value: - parser_mediator.ProduceEventData(self._getEventData(f"BackupStateInfo - {val['localizedDescription']}", val['date'])) + parser_mediator.ProduceEventData( + self._getEventData( + f"BackupStateInfo - {val['localizedDescription']}", + val['date'] + ) + ) plist.PlistParser.RegisterPlugin(IOSMobileBackupPlistPlugin)