powerlog_airdrop.txt

# --------------------------------------------------------------------------------
#       Copyright (c) 2018-2020 Sarah Edwards (Station X Labs, LLC, 
#       @iamevltwin, mac4n6.com). All rights reserved.

#       This software is provided "as is," without warranty of any kind,
#       express or implied.  In no event shall the author or contributors
#       be held liable for any damages arising in any way from the use of
#       this software.

#       The contents of this file are DUAL-LICENSED.  You may modify and/or
#       redistribute this software according to the terms of one of the
#       following two licenses (at your option):

#       LICENSE 1 ("BSD-like with acknowledgment clause"):

#       Permission is granted to anyone to use this software for any purpose,
#       including commercial applications, and to alter it and redistribute
#       it freely, subject to the following restrictions:

#       1. Redistributions of source code must retain the above copyright
#          notice, disclaimer, and this list of conditions.
#       2. Redistributions in binary form must reproduce the above copyright
#          notice, disclaimer, and this list of conditions in the documenta-
#          tion and/or other materials provided with the distribution.
#       3. All advertising, training, and documentation materials mentioning 
#          features or use of this software must display the following 
#          acknowledgment. Character-limited social media may abbreviate this 
#          acknowledgment to include author and APOLLO name ie: "This new 
#          feature brought to you by @iamevltwin's APOLLO". Please make an 
#          effort credit the appropriate authors on specific APOLLO modules.
#          The spirit of this clause is to give public acknowledgment to 
#          researchers where credit is due.

#             This product includes software developed by Sarah Edwards 
#             (Station X Labs, LLC, @iamevltwin, mac4n6.com) and other 
#             contributors as part of APOLLO (Apple Pattern of Life Lazy 
#             Output'er). 


#       LICENSE 2 (GNU GPL v3 or later):

#       This file is part of APOLLO (Apple Pattern of Life Lazy Output'er).

#       APOLLO is free software: you can redistribute it and/or modify
#       it under the terms of the GNU General Public License as published by
#       the Free Software Foundation, either version 3 of the License, or
#       (at your option) any later version.

#       APOLLO is distributed in the hope that it will be useful,
#       but WITHOUT ANY WARRANTY; without even the implied warranty of
#       MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#       GNU General Public License for more details.

#       You should have received a copy of the GNU General Public License
#       along with APOLLO.  If not, see <https://www.gnu.org/licenses/>.
# --------------------------------------------------------------------------------


[Module Metadata]
AUTHOR=Sarah Edwards/mac4n6.com/@iamevltwin
MODULE_NOTES=Airdrop Connection infomation

[Database Metadata]
DATABASE=CurrentPowerlog.PLSQL
PLATFORM=IOS
VERSIONS=9,10,11,12,13,14

[Query Metadata]
QUERY_NAME=powerlog_airdrop
ACTIVITY=Airdrop Connection
KEY_TIMESTAMP=ADJUSTED_TIMESTAMP

[SQL Query 9,10,11,12,13,14]
QUERY=
	SELECT
		DATETIME(AIRDROP_TIMESTAMP + SYSTEM, 'UNIXEPOCH') AS ADJUSTED_TIMESTAMP,
		STATE,
		SUBEVENT,
		BUNDLEID AS BUNDLE_ID,
		PID,
		DATETIME(AIRDROP_TIMESTAMP, 'UNIXEPOCH') AS ORIGINAL_AIRDROP_TIMESTAMP,
		DATETIME(TIME_OFFSET_TIMESTAMP, 'UNIXEPOCH') AS OFFSET_TIMESTAMP,
		SYSTEM AS TIME_OFFSET,
		AIRDROP_ID AS "PLXPCAGENT_EVENTFORWARD_AIRDROP TABLE ID"
	FROM
		(
		SELECT
			BUNDLEID,
			AIRDROP_ID,
			AIRDROP_TIMESTAMP,
			TIME_OFFSET_TIMESTAMP,
			MAX(TIME_OFFSET_ID) AS MAX_ID,
			SYSTEM,
			PID,
			SUBEVENT,
			STATE
		FROM
			(
		SELECT
			PLXPCAGENT_EVENTFORWARD_AIRDROP.TIMESTAMP AS AIRDROP_TIMESTAMP,
			PLXPCAGENT_EVENTFORWARD_AIRDROP.BUNDLEID,
			PLXPCAGENT_EVENTFORWARD_AIRDROP.PID,
			PLXPCAGENT_EVENTFORWARD_AIRDROP.SUBEVENT,
			PLXPCAGENT_EVENTFORWARD_AIRDROP.STATE,
			PLXPCAGENT_EVENTFORWARD_AIRDROP.ID AS "AIRDROP_ID",
			PLSTORAGEOPERATOR_EVENTFORWARD_TIMEOFFSET.TIMESTAMP AS TIME_OFFSET_TIMESTAMP,
			PLSTORAGEOPERATOR_EVENTFORWARD_TIMEOFFSET.ID AS TIME_OFFSET_ID,
			PLSTORAGEOPERATOR_EVENTFORWARD_TIMEOFFSET.SYSTEM,
			BUNDLEID 
		FROM
			PLXPCAGENT_EVENTFORWARD_AIRDROP 
		LEFT JOIN
			PLSTORAGEOPERATOR_EVENTFORWARD_TIMEOFFSET 
			)
		AS AIRDROPSTATE 
		GROUP BY
			AIRDROP_ID 
		)