ALEAPP/scripts/artifacts/deviceHealthServices_Battery.py at 0ce503354d8d0aa67d7386118743dd98e4b40a0d · abrignoni/ALEAPP · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
__artifacts_v2__ = {
    "Turbo_Battery": {
        "name": "Turbo - Phone Battery",
        "description": "Parses battery percentage for devices from Device Health Services",
        "author": "@stark4n6",
        "version": "0.0.1",
        "creation_date": "2021-06-29",
        "last_update_date": "2025-03-08",
        "requirements": "none",
        "category": "Device Health Services",
        "notes": "",
        "paths": ('*/com.google.android.apps.turbo/databases/turbo.db*'),
        "output_types": "all",
        "artifact_icon": "battery-charging"
    },
    "Turbo_Bluetooth": {
        "name": "Turbo - Bluetooth Device Info",
        "description": "Parses bluetooth connected devices from Device Health Services",
        "author": "@stark4n6",
        "version": "0.0.1",
        "creation_date": "2021-06-29",
        "last_update_date": "2025-03-08",
        "requirements": "none",
        "category": "Device Health Services",
        "notes": "",
        "paths": ('*/com.google.android.apps.turbo/databases/bluetooth.db*'),
        "output_types": "all",
        "artifact_icon": "bluetooth"
    }
}

import sqlite3
import textwrap
import os

from packaging import version
from scripts.artifact_report import ArtifactHtmlReport
from scripts.ilapfuncs import artifact_processor, open_sqlite_db_readonly, convert_ts_human_to_utc, convert_utc_human_to_timezone, logfunc

@artifact_processor
def Turbo_Battery(files_found, report_folder, seeker, wrap_text):
    source_file_turbo = ''
    turbo_db = ''
    data_list = []

    for file_found in files_found:
        file_found = str(file_found)
        if file_found.lower().endswith('turbo.db'):
            turbo_db = str(file_found)
            source_file_turbo = os.path.basename(file_found)

            db = open_sqlite_db_readonly(turbo_db)
            cursor = db.cursor()
            cursor.execute('''
            select
            case timestamp_millis
                when 0 then ''
                else datetime(timestamp_millis/1000,'unixepoch')
            End as D_T,
            battery_level,
            case charge_type
                when 0 then ''
                when 1 then 'Charging Rapidly'
                when 2 then 'Charging Slowly'
                when 3 then 'Charging Wirelessly'
            End as C_Type,
            case battery_saver
                when 2 then ''
                when 1 then 'Enabled'
            End as B_Saver,
            timezone
            from battery_event
            ''')

            all_rows = cursor.fetchall()
            usageentries = len(all_rows)
            if usageentries > 0:
                for row in all_rows:
                    timestamp = row[0]
                    if timestamp is None:
                        pass
                    else:
                        try:
                            time_offset = row[4] if len(row) > 4 and row[4] else 'UTC'
                        except Exception as ex:
                            logfunc(f'Turbo_Battery: failed to read timezone ({ex}); defaulting to UTC.')
                            time_offset = 'UTC'

                        try:
                            timestamp = convert_utc_human_to_timezone(convert_ts_human_to_utc(timestamp), time_offset)
                        except Exception as ex:
                            logfunc(f'Turbo_Battery: timezone conversion failed ({ex}); falling back to UTC.')
                            timestamp = convert_ts_human_to_utc(timestamp)
                    data_list.append((timestamp,row[1],row[2],row[3],row[4],file_found))

            db.close()

    data_headers = (('Timestamp', 'datetime'),'Battery Level','Charge Type','Battery Saver','Timezone','Source')

    return data_headers, data_list, source_file_turbo

@artifact_processor
def Turbo_Bluetooth(files_found, report_folder, seeker, wrap_text):
    source_file_bluetooth = ''
    turbo_db = ''
    data_list = []

    if file_found.lower().endswith('bluetooth.db'):
        bluetooth_db = str(file_found)
        source_file_bluetooth = file_found.replace(seeker.directory, '')

        db = open_sqlite_db_readonly(bluetooth_db)
        cursor = db.cursor()
        cursor.execute('''
        select
        datetime(timestamp_millis/1000,'unixepoch'),
        bd_addr,
        device_identifier,
        battery_level,
        volume_level,
        time_zone
        from battery_event
        join device_address on battery_event.device_idx = device_address.device_idx
        ''')

        all_rows = cursor.fetchall()
        usageentries = len(all_rows)
        if usageentries > 0:
            for row in all_rows:
                timestamp = row[0]
                if timestamp is None:
                    pass
                else:
                    timestamp = convert_utc_human_to_timezone(convert_ts_human_to_utc(timestamp),time_offset)
                data_list.append((timestamp,row[1],row[2],row[3],row[4],row[5],file_found))
        db.close()

    data_headers = (('Timestamp','datetime'),'BT Device MAC Address','BT Device ID','Battery Level','Volume Level','Timezone','Source')

    return data_headers, data_list, source_file_bluetooth