Skip to content

[Bug] netusage artifact parser crashes on invalid timestamp values #1389

@Tokenzrey

Description

@Tokenzrey

The get_netusage function in netusage.py encounters a critical error when processing network usage data containing invalid or NULL timestamps in the SQLite database. The parser crashes with a ValueError, preventing the extraction of any network usage data, even if valid records exist.

Root Cause Analysis
The issue stems from the convert_ts_human_to_utc function being called on raw data from the SQLite query without error handling.

  1. The SQLite query uses datetime(...) which may return empty strings or unexpected formats for NULL/0 values.
  2. These values are passed to convert_ts_human_to_utc.
  3. datetime.strptime raises a ValueError (e.g., time data '' does not match format...) or TypeError.
  4. Since there are no try-except blocks around these conversion calls, the exception propagates and terminates the artifact parsing immediately.

Traceback

ValueError: time data '' does not match format '%Y-%m-%d %H:%M:%S'
Traceback (most recent call last):
  File "scripts/artifacts/netusage.py", line 56
    lastconnected = convert_utc_human_to_timezone(convert_ts_human_to_utc(row[0]),timezone_offset)
  File "scripts/ilapfuncs.py", line 1117, in convert_ts_human_to_utc
    dt = datetime.strptime(ts, '%Y-%m-%d %H:%M:%S')

Affected File

  • netusage.py (Lines 52-60 and 104-105 approx)

Steps to Reproduce

  1. Run iLEAPP against an iOS backup containing a netusage.sqlite database.
  2. Ensure the database contains rows where ZTIMESTAMP or ZFIRSTTIMESTAMP results in a NULL or invalid string when queried.
  3. Observe the crash during the "Network Usage" artifact parsing stage.

Expected Behavior
The parser should implement defensive programming: if a timestamp is invalid, it should be logged or set to a fallback value (e.g., "N/A"), allowing the parser to continue processing the remaining valid rows.

Proposed Fix
Wrap the timestamp conversion logic in try-except blocks to catch ValueError and TypeError, setting the value to 'N/A' upon failure.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions