Skip to content

Add Paraben Cross Use Export parser support#2876

Open
AburtoArielPM wants to merge 2 commits into
sepinf-inc:masterfrom
AburtoArielPM:feature/paraben-parser
Open

Add Paraben Cross Use Export parser support#2876
AburtoArielPM wants to merge 2 commits into
sepinf-inc:masterfrom
AburtoArielPM:feature/paraben-parser

Conversation

@AburtoArielPM
Copy link
Copy Markdown
Contributor

This PR introduces initial support for parsing Paraben E3 "Cross Use Export" data into IPED.

Overview:
Paraben allows exporting forensic data using the "Cross Use Export" option, which generates:

  • XML files describing the structure and metadata
  • Associated binary files containing the actual data

This parser:

  • Reads Paraben XML structures
  • Processes linked binary files
  • Extracts metadata and content into IPED items

Current supported artifacts:

  • Contacts
  • Call logs
  • SMS/MMS messages
  • Installed applications
  • Application permissions
  • Media files (images, videos, audio)
  • Documents

Implementation details:

  • Traverses Paraben XML nodes and reconstructs the logical structure
  • Maps extracted data into IPED items and metadata fields
  • Uses references from XML to locate and process associated binary files
  • Normalizes timestamps and metadata for compatibility with IPED

Tested on:

  • Android devices (versions 9, 10, 14)

Use case:
This integration allows ingesting Paraben forensic exports into IPED for digital evidence analysis.

Notes:
This is an initial implementation and may require further validation with different datasets.
Feedback, testing, and suggestions from the community are very welcome to improve compatibility and coverage.

Author:
Ariel Aburto
Puerto Madryn, Argentina
Contact: infmpfch@gmail.com

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant