/APOLLO

Apple Pattern of Life Lazy Output'er

Primary LanguagePython

Apple Pattern of Life Lazy Output'er (APOLLO)

BETA - FOR TESTING PURPOSES ONLY

  • This is your warning. I've tested a few modules but there is much more testing to be done.
  • Find a bug or a better query, let me know!
  • Extra warning on PowerLog modules, timestamps may be in the past and/or future - testing these.
  • Many more modules to come!
  • Python 3 (omg, finally!)

Dependencies

Usage

python apollo.py -o {csv, sql} -p {ios, mac, yolo} -v {8,9,10,11,12,yolo} -k <modules directory> <data directory>

Output Options (-o)

  • csv - CSV
  • sql - SQLite Database

KMZ Output(-k)

Platform Options (-p)

  • ios
  • mac [Offical support coming soon!]
  • yolo - Just parse whatever. Use for ARTEMIS parsing.

Version Options (-v)

  • iOS 8, 9, 10, 11, 12
  • yolo - Just parse whatever. Use for ARTEMIS parsing.

Getting Errors? Try This (Windows users, use eqivlent commands)

You may see that APOLLO reports back "0 databases" found when executed, most likely from CurrentPowerlog.PLSQL and locationd modules. Two common directories with databases that cause problems due to permissions (depends on how files were extracted from device):

  • /private/var/root/Library/Caches/locationd/
  • /private/var/containers/Shared/SystemGroup/[GUID]/Library/BatteryLife

Fix Permissions:

  • chmod -R 755 /private/var/containers/Shared/SystemGroup/[GUID_for BatteryLife Data]/
  • chmod -R 755 /private/var/root

Still not working?

  • Check database permissions - Use chmod to give some databases with "all blank" permissions some sort of permission. (Happens with many types of physical-logical extractions.)
  • Check database ownership - Use chown to take ownership of the files.

Thank You!

References