Metadata-Version: 2.4
Name: dleapp
Version: 1.1.1
Summary: Digital forensics parser for DJI drone artifacts
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: bcrypt==3.2.0
Requires-Dist: beautifulsoup4==4.8.2
Requires-Dist: bencoding
Requires-Dist: blackboxprotobuf
Requires-Dist: fitdecode==0.10.0
Requires-Dist: folium==0.14.0
Requires-Dist: geopy==2.3.0
Requires-Dist: packaging==20.1
Requires-Dist: pillow
Requires-Dist: polyline==2.0.0
Requires-Dist: protobuf==3.10.0
Requires-Dist: PyCryptodome
Requires-Dist: pytz
Requires-Dist: simplekml
Requires-Dist: wheel
Requires-Dist: xlsxwriter==3.1.1
Requires-Dist: xmltodict
Requires-Dist: libewf-python
Requires-Dist: pytsk3
Dynamic: license-file

![DLEAPP](assets/DLEAPP_logo.png)

# Drone Logs Events And Protobuf Parser

DLEAPP (Drone Logs, Events and Protobuf Parser) is a plugin-based forensic parser for DJI drone data, built on the ALEAPP architecture. Given an acquired filesystem or directory, it recursively locates known DJI artifacts and converts them into structured reports of flight events, timestamps, and GPS data.

## Requirements

**Python 3.10 or above**

### Dependencies

Dependencies for your python environment are listed in `requirements.txt`. Install them using the below command. Ensure
the `py` part is correct for your environment, eg `py`, `python`, or `python3`, etc.

`py -m pip install -r requirements.txt`
or
`pip3 install -r requirements.txt`

## Usage
This process is executed in a Linux environment, please adjust the needs due to this limitation.
### CLI

```
$ python3 dleapp.py -t <raw | ewf> -i <path_to_extraction> -o <path_for_report_output>
```
### GUI

```
$ python3 dleappGUI.py
```

To launch the GUI after installing DLEAPP as a package, run:

```
$ dleapp --gui
```
both `--gui` and `--GUI` are accepted.

### Help

```
$ python3 dleapp.py --help
```

## Contributing artifact plugins

Each plugin is a Python source file which should be added to the `scripts/artifacts` folder which will be loaded dynamically each time DLEAPP is run.

The plugin source file must contain a dictionary named `__artifacts_v2__` at the very beginning of the module, which defines the artifacts that the plugin processes. The keys in the `__artifacts_v2__` dictionary should be IDs for the artifact(s) which must be unique within DLEAPP. The values should be dictionaries containing the following keys:

- `name`: The name of the artifact as a string.
- `description`: A description of the artifact as a string.
- `author`: The author of the plugin as a string.
- `version`: The version of the artifact as a string.
- `date`: The date of the last update to the artifact as a string.
- `requirements`: Any requirements for processing the artifact as a string.
- `category`: The category of the artifact as a string.
- `notes`: Any additional notes as a string.
- `paths`: A tuple of strings containing glob search patterns to match the path of the data that the plugin expects for the artifact.
- `function`: The name of the function which is the entry point for the artifact's processing as a string.

For example:

```python
__artifacts_v2__ = {
    "cool_artifact_1": {
        "name": "Cool Artifact 1",
        "description": "Extracts cool data from database files",
        "author": "@username",
        "version": "0.1",
        "date": "2022-10-25",
        "requirements": "none",
        "category": "Really cool artifacts",
        "notes": "",
        "paths": ('*/com.android.cooldata/databases/database*.db',),
        "function": "get_cool_data1"
    },
    "cool_artifact_2": {
        "name": "Cool Artifact 2",
        "description": "Extracts cool data from XML files",
        "author": "@username",
        "version": "0.1",
        "date": "2022-10-25",
        "requirements": "none",
        "category": "Really cool artifacts",
        "notes": "",
        "paths": ('*/com.android.cooldata/files/cool.xml',),
        "function": "get_cool_data2"
    }
}
```

The functions referenced as entry points in the `__artifacts__` dictionary must take the following arguments:

- An iterable of the files found which are to be processed (as strings)
- The path of DLEAPP's output folder(as a string)
- The seeker (of type FileSeekerBase) which found the files
- A Boolean value indicating whether or not the plugin is expected to wrap text

For example:

```python
def get_cool_data1(files_found, report_folder, seeker, wrap_text):
    pass  # do processing here
```

Plugins are generally expected to provide output in DLEAPP's HTML output format, TSV, and optionally submit records to
the timeline. Functions for generating this output can be found in the `artifact_report` and `ilapfuncs` modules.
At a high level, an example might resemble:

```python
__artifacts_v2__ = {
    "cool_artifact_1": {
        "name": "Cool Artifact 1",
        "description": "Extracts cool data from database files",
        "author": "@username",  # Replace with the actual author's username or name
        "version": "0.1",  # Version number
        "date": "2022-10-25",  # Date of the latest version
        "requirements": "none",
        "category": "Really cool artifacts",
        "notes": "",
        "paths": ('*/com.android.cooldata/databases/database*.db',),
        "function": "get_cool_data1"
    }
}

import datetime
from scripts.artifact_report import ArtifactHtmlReport
import scripts.ilapfuncs

def get_cool_data1(files_found, report_folder, seeker, wrap_text):
    # let's pretend we actually got this data from somewhere:
    rows = [
     (datetime.datetime.now(), "Cool data col 1, value 1", "Cool data col 1, value 2", "Cool data col 1, value 3"),
     (datetime.datetime.now(), "Cool data col 2, value 1", "Cool data col 2, value 2", "Cool data col 2, value 3"),
    ]

    headers = ["Timestamp", "Data 1", "Data 2", "Data 3"]

    # HTML output:
    report = ArtifactHtmlReport("Cool stuff")
    report_name = "Cool DFIR Data"
    report.start_artifact_report(report_folder, report_name)
    report.add_script()
    report.write_artifact_data_table(headers, rows, files_found[0])  # assuming only the first file was processed
    report.end_artifact_report()

    # TSV output:
    scripts.ilapfuncs.tsv(report_folder, headers, rows, report_name, files_found[0])  # assuming first file only

    # Timeline:
    scripts.ilapfuncs.timeline(report_folder, report_name, rows, headers)

```

## Acknowledgements

This tool is an idea from Mr. Alexis and his contributor with collaboration with our lecturer.
