phase15_power_timeline_v2.py

#!/usr/bin/env python3
"""
Phase 15 - Power & Device Lifecycle Timeline (Refactored)
Extract boot events, battery depletions, and factory resets
"""

import csv
from pathlib import Path
from datetime import datetime
import sys

sys.path.insert(0, str(Path(__file__).parent))
from config import EXTRACTED, get_aleapp_tsv_dir, get_output_dir, PhaseOutput, calculate_sha256


def main():
    output = PhaseOutput(15, "power_timeline")
    out_dir = get_output_dir("power_timeline")
    tsv_dir = get_aleapp_tsv_dir()
    
    md = [f"# Phase 15 – Power & Device Lifecycle Timeline\n\n"]
    md.append(f"**Erstellt:** {datetime.now().strftime('%Y-%m-%d %H:%M')}  \n\n---\n\n")
    
    events = []
    
    md.append("## 1. Power Off/Reset Events\n\n")
    
    power_file = tsv_dir / "Power Off Reset.tsv" if tsv_dir else None
    
    if power_file and power_file.exists():
        output.add_source(power_file, "ALEAPP Power Off Reset TSV export")
        with open(power_file, 'r') as f:
            reader = csv.DictReader(f, delimiter='\t')
            
            for row in reader:
                ts = row.get("Timestamp (Local)", "")
                action = row.get("Action", "")
                reason = row.get("Reason", "")
                
                if ts:
                    events.append({
                        'timestamp': ts,
                        'type': 'power_event',
                        'action': action,
                        'reason': reason
                    })
                    
                    output.add_timeline_event(ts[:19], action, reason, "Power Off Reset.tsv")
    
    md.append(f"**Events gefunden:** {len(events)}\n\n")
    output.set_summary("power_events", len(events))
    
    if events:
        md.append("| Zeitstempel | Aktion | Grund |\n|---|---|---|\n")
        
        for evt in sorted(events, key=lambda x: x['timestamp'])[:50]:
            md.append(f"| {evt['timestamp'][:19]} | {evt['action']} | {evt['reason']} |\n")
    
    md.append("\n## 2. Samsung Wipe History\n\n")
    
    wipe_file = tsv_dir / "Samsung Wipe History.tsv" if tsv_dir else None
    wipe_events = []
    
    if wipe_file and wipe_file.exists():
        output.add_source(wipe_file, "ALEAPP Samsung Wipe History TSV export")
        with open(wipe_file, 'r') as f:
            reader = csv.DictReader(f, delimiter='\t')
            
            for row in reader:
                wipe_type = row.get("Wipe", "")
                rtc_ts = row.get("Timestamp", "")
                req_ts = row.get("Request Timestamp", "")
                
                wipe_events.append({
                    'type': wipe_type,
                    'rtc_timestamp': rtc_ts,
                    'request_timestamp': req_ts
                })
                
                if req_ts:
                    output.add_timeline_event(req_ts[:19], "factory_reset", wipe_type, "Samsung Wipe History.tsv")
                    output.add_finding("factory_reset", wipe_type, req_ts[:19], "Samsung wipe event")
    
    md.append(f"**Wipe-Events gefunden:** {len(wipe_events)}\n\n")
    output.set_summary("wipe_events", len(wipe_events))
    
    if wipe_events:
        md.append("| Typ | RTC-Timestamp | Request Timestamp |\n|---|---|---|\n")
        
        for evt in wipe_events:
            md.append(f"| {evt['type']} | {evt['rtc_timestamp']} | {evt['request_timestamp']} |\n")
    
    md.append("\n## 3. Last Boot Time\n\n")
    
    boot_file = tsv_dir / "Last Boot Time.tsv" if tsv_dir else None
    last_boot = None
    
    if boot_file and boot_file.exists():
        output.add_source(boot_file, "ALEAPP Last Boot Time TSV export")
        with open(boot_file, 'r') as f:
            reader = csv.DictReader(f, delimiter='\t')
            
            for row in reader:
                ts = row.get("Timestamp", "")
                if ts:
                    last_boot = ts
                    output.add_timeline_event(ts[:19], "device_boot", "Last boot time", "Last Boot Time.tsv")
                    output.set_summary("last_boot", ts[:19])
    
    if last_boot:
        md.append(f"**Letzter Boot:** {last_boot}\n\n")
    else:
        md.append("**Keine Boot-Zeit gefunden**\n\n")
    
    md.append("\n## 4. Factory Reset Events\n\n")
    
    reset_file = tsv_dir / "Factory Reset.tsv" if tsv_dir else None
    reset_events = []
    
    if reset_file and reset_file.exists():
        output.add_source(reset_file, "ALEAPP Factory Reset TSV export")
        with open(reset_file, 'r') as f:
            reader = csv.DictReader(f, delimiter='\t')
            
            for row in reader:
                ts = row.get("Timestamp", "")
                reset_events.append({'timestamp': ts})
    
    md.append(f"**Factory Reset-Events:** {len(reset_events)}\n\n")
    output.set_summary("factory_resets", len(reset_events))
    
    if reset_events:
        md.append("| Zeitstempel |\n|---|\n")
        for evt in reset_events:
            md.append(f"| {evt['timestamp']} |\n")
    
    md.append("\n---\n\n")
    md.append(f"**Report erstellt:** {datetime.now().isoformat()}\n")
    
    report_path = out_dir / "power_timeline_report.md"
    report_path.write_text("".join(md))
    
    outputs = output.write()
    
    print(f"[OK] Phase 15 Complete")
    print(f"     JSON: {list(outputs.keys())[0]}")
    print(f"     Markdown: {report_path}")


if __name__ == "__main__":
    main()