Magnet AXIOM 3 Custom Artifact

5 years ago · 086f2c544e
parent b0265712f7
commit 086f2c544e
3 changed files with 459 additions and 0 deletions
--- a/Photos.xml
+++ b/Photos.xml
@ -0,0 +1,302 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Artifacts version="2.0">
+  <Artifact type="SqliteArtifact" name="IOS 8+ photos.sqlite" version="1" platform="Ios">
+    <Source type="FileName">Photos.sqlite</Source>
+    <Query>
+-- IOS 8+ - Camera Roll\Media\PhotoData\Photos.sqlite
+
+-- Referencess:
+--
+-- https://github.com/geiszla/iOSLib/wiki/ZGENERICASSET-contents
+-- https://github.com/geiszla/iOSLib/wiki/ZADDITIONALASSETATTRIBUTES-contents
+-- https://forensenellanebbia.blogspot.com/2015/10/apple-ios-recently-deleted-images.html
+-- SIDECAR https://en.wikipedia.org/wiki/Sidecar_file
+--
+-- Live Photo is a video-picture hybrid file with both animated MOV and static JPG combined. 
+-- https://appletoolbox.com/live-photos-on-iphone-complete-guide/ 
+-- 
+-- OriginalFilename is the filename used when this was shared in another app
+-- Filename is the IOS converted filename after the above image was saved on the device(iPhone)
+--
+-- Z_PK = Primary Key (unique identifier) for the entity,
+-- Z_ENT = is the entity ID (every entity of a particular type has the same entity ID)
+-- Z_OPT = number of times an entity has been changed
+--
+-- https://linuxsleuthing.blogspot.com/2013/05/ios6-photo-streams-recover-deleted.html
+-- https://discussions.apple.com/thread/8184861 
+
+
+select 
+	zgenericasset.Z_PK as 'zpk',
+	case zgenericasset.ZSAVEDASSETTYPE
+			when 0 then 'Saved from other source'
+			when 2 then 'Photo Streams Data'
+			when 3 then 'Made/saved with this device'
+			when 4 then 'Default row'
+			when 7 then 'Deleted'
+			else zgenericasset.ZSAVEDASSETTYPE
+			end as 'AssetType',
+	zgenericasset.ZDIRECTORY as 'Directory',
+	zgenericasset.ZFILENAME as 'FileName',
+	ZADDITIONALASSETATTRIBUTES.ZORIGINALFILENAME as 'OriginalFilename',
+	ZADDITIONALASSETATTRIBUTES.ZORIGINALFILESIZE as 'OriginalSize',
+--  zgenericasset.ZORIGINALCOLORSPACE as 'ColorSpace',
+	zgenericasset.ZUNIFORMTYPEIDENTIFIER as 'FormType',
+	ZSIDECARFILE.ZFILENAME as ' SidecarFilename',
+	ZSIDECARFILE.ZORIGINALFILENAME as 'SidecarOriginalF',
+	ZSIDECARFILE.ZCOMPRESSEDSIZE as ' CompressedSize',
+	ZSIDECARFILE.ZUNIFORMTYPEIDENTIFIER as 'SidecarFormType',
+	ZIMAGEURLDATA as 'ImageURLdata',
+	ZTHUMBNAILURLDATA as 'ThumbnailURLdata',
+--  case zgenericasset.ZLATITUDE 
+	-- 	when -180.0
+	--	then ''
+	--	else zgenericasset.ZLATITUDE
+	--	end as ' Latitude',
+-- case zgenericasset.ZLONGITUDE 
+	-- 	when -180.0
+	--	then ''
+	--	else zgenericasset.ZLONGITUDE
+	--	end as ' Longitude',
+	case ZCLOUDDOWNLOADREQUESTS
+		when 0 then 'No'
+		when 1 then 'Yes'
+		end as 'CLOUDDOWNLOADREQUESTS',
+	case ZCLOUDISDELETABLE 
+			when 1 then 'Yes'
+			end as 'CLOUDISDELETABLE',
+	case ZCLOUDISMYASSET  
+			when 1 then 'Yes'
+			end as 'CLOUDISMYASSET',
+	case ZCLOUDLOCALSTATE 
+		when 0 then 'Local'
+		when 1 then 'Remote'
+		end as 'CLOUDLOCALSTATE',		
+	case ZFAVORITE   
+			when 0 then 'No'
+			when 1 then 'Yes'
+			end as 'Favorite',		
+	case ZHASADJUSTMENTS    
+			when 0 then 'No'
+			when 1 then 'Yes'
+			end as 'Modified',
+	ZWIDTH||' x '||ZHEIGHT as 'Dimenasions',
+	ZADDITIONALASSETATTRIBUTES.ZEMBEDDEDTHUMBNAILWIDTH||' x '||ZADDITIONALASSETATTRIBUTES.ZEMBEDDEDTHUMBNAILHEIGHT as 'EmbeddedThumbnail',
+	ZADDITIONALASSETATTRIBUTES.ZEMBEDDEDTHUMBNAILOFFSET as 'EmbeddedThumbnailOffset',
+	ZADDITIONALASSETATTRIBUTES.ZEMBEDDEDTHUMBNAILLENGTH as 'ETNLength',
+	time(ZDURATION,'unixepoch') as 'Duration',
+	time(zgenericasset.ZVIDEOCPDURATIONVALUE,  'unixepoch') as 'CPDuration',
+	case ZORIENTATION    
+			when 1 then 'Horizontal (left)'
+			when 3 then 'Horizontal (right)'
+			when 6 then 'Vertical (up)'
+			when 8 then 'Vertical (down)'
+			else ZORIENTATION
+			end as 'Orientation',
+	case ZKIND    
+			when 0 then 'Photo'
+			when 1 then 'Video'
+			end as 'Kind',
+	case ZKINDSUBTYPE    
+			when 0 then 'Normal'
+			when 1 then 'Panorama'
+			when 100 then 'Default row'
+			when 101 then 'Slo-mo'
+			when 102 then 'Timelapse'
+			else ZKINDSUBTYPE
+			end as 'SubType',
+	case zgenericasset.ZTRASHEDSTATE     
+			when 1 then 'Deleted'
+			when 0 then 'Not Deleted'
+			else zgenericasset.ZTRASHEDSTATE
+			end as 'TrashState',
+	datetime('2001-01-01', ZTRASHEDDATE || ' seconds') as 'TrashedDate',
+	case ZCOMPLETE  
+			when 1 then 'Yes'
+			end as 'Complete',		
+	case ZVISIBILITYSTATE     
+			when 0 then 'Visible'
+			when 1 then 'Photo Streams Data'
+			when 2 then 'Burst'
+			else ZVISIBILITYSTATE
+			end as 'VisibilityState',
+	ZADDITIONALASSETATTRIBUTES.ZCREATORBUNDLEID as 'CreatorBundleID',
+	ZADDITIONALASSETATTRIBUTES.ZEDITORBUNDLEID as 'EditorBundleID',
+	ZUNMANAGEDADJUSTMENT.ZADJUSTMENTFORMATIDENTIFIER||' ('||ZUNMANAGEDADJUSTMENT.ZADJUSTMENTFORMATVERSION||')' as 'AdjustmentFormatIdentifier',
+	ZSIDECARFILE.ZCAPTUREDATE as 'SidecarCaptudeDate',
+	ZSIDECARFILE.ZMODIFICATIONDATE as 'SidecarModificationDate',
+	ZUNMANAGEDADJUSTMENT.ZADJUSTMENTTIMESTAMP as 'AdjustmentTimestamp',
+--  datetime('2001-01-01', zgenericasset.ZFACEADJUSTMENTVERSION as 'FaceAdjustmentVersion',
+	ZGENERICASSET.ZMODIFICATIONDATE as 'ModificationDate',
+	ZADDEDDATE as 'AddedDate',
+	ZDATECREATED as 'CreatedDate',
+	ZADDITIONALASSETATTRIBUTES.ZEXIFTIMESTAMPSTRING as 'EXIFtimestamp',
+	ZMOMENT.ZSTARTDATE as 'MomentStartDate',
+	ZMOMENT.ZENDDATE as 'MomentEndDate',
+	zgenericasset.ZLASTSHAREDDATE as 'LastSharedDate',
+	ZADDITIONALASSETATTRIBUTES.ZTIMEZONENAME||' ('||ZADDITIONALASSETATTRIBUTES.ZTIMEZONEOFFSET||')' as 'TimeZone',
+	ZMOMENT.ZAPPROXIMATELOCATIONDATA as 'ApproximateLocationData(bplist)',	
+	ZMOMENT.ZREVERSELOCATIONDATA as 'ReverseLocationData0(bplist)',	
+	case ZMOMENT.ZREVERSELOCATIONDATAISVALID 
+		when 0 then 'No'
+		when 1 then 'Yes'
+		end as 'LocationValid',	
+	ZMOMENTLIST.ZREVERSELOCATIONDATA as 'ReverseLocationData1(bplist)',		
+	case ZMOMENTLIST.ZREVERSELOCATIONDATAISVALID 
+		when 0 then 'No'
+		when 1 then 'Yes'
+		end as 'LocationValid1',
+--		case ZADDITIONALASSETATTRIBUTES.ZSHIFTEDLOCATIONISVALID -- Field does not exist in IOS 8.3
+--		when 0 then 'No'
+--		when 1 then 'Yes'
+--		end as 'ShiftedLocationValid,'
+		ZADDITIONALASSETATTRIBUTES.ZREVERSELOCATIONDATA as 'ReverseLocationData2'
+
+from zgenericasset
+	join Z_PRIMARYKEY on zgenericasset.z_ent = Z_PRIMARYKEY.z_ent
+	left join ZMOMENTLIST on zgenericasset.ZMOMENT = ZMOMENTLIST.Z_PK
+	left join ZMOMENT on ZGENERICASSET."ZMOMENT" = ZMOMENT.Z_PK
+	join ZADDITIONALASSETATTRIBUTES on ZGENERICASSET.ZADDITIONALATTRIBUTES = ZADDITIONALASSETATTRIBUTES.Z_PK
+	left join ZUNMANAGEDADJUSTMENT on ZADDITIONALASSETATTRIBUTES."ZUNMANAGEDADJUSTMENT" = ZUNMANAGEDADJUSTMENT.Z_PK
+	left join ZSIDECARFILE on ZSIDECARFILE.ZASSET = ZGENERICASSET.Z_PK
+-- order by CreatedDate desc
+    </Query>
+    <Fragments>
+      <Fragment source="zpk" alias="pKey" datatype="Integer" category="None" />
+      <Fragment source="AssetType" alias="AssetType" datatype="String" category="None" />
+      <Fragment source="Directory" alias="Directory" datatype="String" category="None" />
+      <Fragment source="FilenName" alias="FilenName" datatype="String" category="None" />
+      <Fragment source="OriginalFilename" alias="OriginalFilename" datatype="String" category="None" />
+      <Fragment source="OriginalSize" alias="OriginalSize" datatype="Integer" category="None" />
+      <Fragment source="FormType" alias="FormType" datatype="String" category="None" />
+      <Fragment source="PayloadTimezone" alias="Payload-Timezone" datatype="String" category="None" />
+      <Fragment source="SidecarFilename" alias="SidecarFilename" datatype="String" category="None" />
+      <Fragment source="SidecarOriginalF" alias="Sidecar  Original Filename" datatype="String" category="None" />
+      <Fragment source="CompressedSize" alias="CompressedSize" datatype="Integer" category="None" />
+      <Fragment source="SidecarFormType" alias="SidecarFormType" datatype="String" category="None" />
+      <Fragment source="ImageURLdata" alias="ImageURLdata" datatype="String" category="None" />
+      <Fragment source="ThumbnailURLdata" alias="ThumbnailURLdata" datatype="String" category="None" />
+      <Fragment source="CLOUDDOWNLOADREQUESTS" alias="Cloud Download Requests" datatype="String" category="None" />
+      <Fragment source="CLOUDISDELETABLE" alias="Cloud id Deletable" datatype="String" category="None" />
+      <Fragment source="CLOUDISMYASSET" alias="Cloiud is my Asset" datatype="String" category="None" />
+      <Fragment source="CLOUDLOCALSTATE" alias="Cloud/Local" datatype="String" category="None" />
+      <Fragment source="Favorite" alias="Favorite" datatype="String" category="None" />
+      <Fragment source="Modified" alias="Modified" datatype="String" category="None" />
+      <Fragment source="Dimenasions" alias="Dimenasions (WxH)" datatype="String" category="None" />
+      <Fragment source="EmbeddedThumbnail" alias="EmbeddedT humbnail (WxH)" datatype="String" category="None" />
+      <Fragment source="EmbeddedThumbnailOffset" alias="EmbeddedThumbnailOffset" datatype="String" category="None" />
+      <Fragment source="ETNLength" alias="thumbLength" datatype="String" category="None" />
+      <Fragment source="Duration" alias="Duration" datatype="String" category="None" />
+      <Fragment source="Orientation" alias="Orientation" datatype="String" category="None" />
+      <Fragment source="Kind" alias="Kind" datatype="String" category="None" />
+      <Fragment source="SubType" alias="SubType" datatype="String" category="None" />
+      <Fragment source="TrashState" alias="TrashState" datatype="String" category="None" />
+      <Fragment source="Complete" alias="Complete" datatype="String" category="None" />
+      <Fragment source="VisibilityState" alias="Visibility" datatype="String" category="None" />
+      <Fragment source="CreatorBundleID" alias="CreatorBundleID" datatype="String" category="None" />
+      <Fragment source="EditorBundleID" alias="EditorBundleID" datatype="String" category="None" />
+      <Fragment source="AdjustmentFormatIdentifier" alias="Adjustment Format" datatype="String" category="None" />
+      <Fragment source="SidecarCaptudeDate" alias="Sidecar Captude Date" datatype="DateTime" dateformat="Apple Time" category="DateTime" />
+	  <Fragment source="SidecarModificationDate" alias="Sidecar Modification Date" datatype="DateTime" dateformat="Apple Time" category="DateTime" /> 
+	  <Fragment source="AdjustmentTimestamp" alias="Adjustment Timestamp" datatype="DateTime" dateformat="Apple Time" category="DateTime" /> 
+	  <Fragment source="ModificationDate" alias="Modification Date" datatype="DateTime" dateformat="Apple Time" category="DateTime" />
+	  <Fragment source="AddedDate" alias="AddedDate" datatype="DateTime" dateformat="Apple Time" category="DateTime" />
+	  <Fragment source="EXIFtimestamp" alias="EXIF timestamp" datatype="String" category="DateTime" /> 
+	  <Fragment source="MomentStartDate" alias="Moment Start Date" datatype="DateTime" dateformat="Apple Time" category="DateTime" /> 
+	  <Fragment source="MomentEndDate" alias="Moment End Date" datatype="DateTime" dateformat="Apple Time" category="DateTime" /> 
+	  <Fragment source="LastSharedDate" alias="Last Shared Date" datatype="DateTime" dateformat="Apple Time" category="DateTime" /> 
+	  <Fragment source="TimeZone" alias="TimeZone" datatype="String" category="None" /> 
+	  <Fragment source="ApproximateLocationData" alias="Approximate LocationData" datatype="Attachment" category="None" /> 
+	  <Fragment source="ReverseLocationData0" alias="Reverse LocationData" datatype="String" category="None" />
+      <Fragment source="LocationValid" alias="LocationValid" datatype="String" category="None" />
+	  <Fragment source="ReverseLocationData1" alias="Reverse LocationData 1" datatype="Attachment" category="None" />
+      <Fragment source="LocationValid1" alias="LocationValid" datatype="String" category="None" />
+	  <Fragment source="ReverseLocationData2" alias="Reverse LocationData 2" datatype="Attachment" category="None" />
+    </Fragments>
+  </Artifact>
+  <Artifact type="SqliteArtifact" name="IOS iPhotoLite.db" version="2.1" platform="Ios">
+    <Source type="FileName">iPhotoLite.db</Source>
+    <Query>
+	--IOS 9 (iphoto)
+	--\Camera Roll\Media\PhotoData\iPhotoSandboxLibrary\438665323315681\Database\iPhotoLite.db
+
+	select 
+		BLDBAlbum.uuid as 'AlbumUUID', -- Foldername
+		BLDBAlbumMediaJoin.type, -- value can also be seen in the Album.plist in the above folders
+		BLDBAlbum.name||' ('||BLDBAlbum.itemCount||')' as 'AlbumNamecount',
+		case BLDBAlbum.state 
+			when 1 
+			then 'Exists' 
+			end as 'AlbumState', 
+		case bldbmedia.state 
+			when 0 then 'Deleted'
+			end as 'MediaState',
+		bldbmedia.uuid 'MediaUUID',
+		bldbmedia.fileName,
+		bldbmedia.fileSize,
+		bldbmedia.type as 'imageType',
+		time(bldbmedia.duration,'unixepoch') as 'Duration',
+		bldbmedia.latitude,
+		bldbmedia.longitude,
+		bldbmedia.DateCreated as 'DateCreated',
+		case 
+			when bldbmedia.dateViewed != 0.0 
+			then bldbmedia.dateViewed 
+			end as 'DateViewed',
+		case 
+			when bldbmedia.dateAdjusted 
+			then bldbmedia.dateAdjusted 
+			end as 'DateAdjusted',
+		case 
+			when bldbmedia.dateModified 
+			then bldbmedia.dateModified 
+			end as 'DateModified',
+		bldbmedia.PixelWidth||' x '||bldbmedia.PixelHeight as 'Dimensions',
+		bldbmedia.assetPixelWidth||' x '||bldbmedia.assetPixelHeight as 'assetDimensions',
+		bldbmedia.originalPixelWidth||' x '||bldbmedia.originalPixelHeight as 'originalDimensions',
+		case bldbmedia.assetOrientation    
+				when 1 then 'Horizontal (left)'
+				when 3 then 'Horizontal (right)'
+				when 6 then 'Vertical (up)'
+				when 8 then 'Vertical (down)'
+				else bldbmedia.assetOrientation
+				end as 'AssetOrientation',
+		case bldbmedia.originalOrientation    
+				when 1 then 'Horizontal (left)'
+				when 3 then 'Horizontal (right)'
+				when 6 then 'Vertical (up)'
+				when 8 then 'Vertical (down)'
+				else bldbmedia.originalOrientation
+				end as 'OriginalOrientation'
+	from bldbmedia
+		join BLDBAlbumMediaJoin on BLDBMedia.primaryKey = BLDBAlbumMediaJoin.mediaKey
+		join BLDBAlbum on BLDBAlbumMediaJoin.albumKey = BLDBAlbum.primaryKey
+--	order by DateCreated desc 
+     </Query>
+    <Fragments>
+      <Fragment source="AlbumUUID" alias="Album UUID" datatype="String" category="None" />
+      <Fragment source="type" alias="Type" datatype="String" category="None" />
+      <Fragment source="AlbumNamecount" alias="AlbumName (count)" datatype="String" category="None" />
+      <Fragment source="AlbumState" alias="AlbumState" datatype="String" category="None" />
+      <Fragment source="MediaState" alias="MediaState" datatype="String" category="None" />
+      <Fragment source="MediaUUID" alias="Media UUID" datatype="String" category="None" />
+      <Fragment source="fileName" alias="FileName" datatype="String" category="None" />
+      <Fragment source="fileSize" alias="Filesize" datatype="Integer" category="None" />
+      <Fragment source="imageType" alias="ImageType" datatype="String" category="None" />
+      <Fragment source="Duration" alias="Duration" datatype="String" category="None" />
+      <Fragment source="latitude" alias="Latitude" datatype="Float" category="Latitude" />
+      <Fragment source="longitude" alias="Longitude " datatype="Float" category="Longitude" />
+      <Fragment source="DateCreated" alias="Date Created" datatype="DateTime" dateformat="Apple Time" category="DateTime" />
+      <Fragment source="DateViewed" alias="Date Viewed" datatype="DateTime" dateformat="Apple Time" category="DateTime" />
+      <Fragment source="DateAdjusted" alias="DateA djusted" datatype="DateTime" dateformat="Apple Time" category="DateTime" />
+      <Fragment source="DateModified" alias="Date Modified" datatype="DateTime" dateformat="Apple Time" category="DateTime" />
+      <Fragment source="Dimenasions" alias="Dimensions (WxH)" datatype="String" category="None" />
+      <Fragment source="assetDimensions" alias="Asset Dimensions (WxH)" datatype="String" category="None" />
+      <Fragment source="originalDimensions" alias="Original Dimensions (WxH)" datatype="String" category="None" />
+      <Fragment source="AssetOrientation" alias="Asset Orientation" datatype="String" category="None" />
+      <Fragment source="OriginalOrientation" alias="Original Orientation" datatype="String" category="None" />
+    </Fragments>
+  </Artifact> 
+  <Signature>
+  </Signature>
+</Artifacts>
--- a/healthdb_secure.xml
+++ b/healthdb_secure.xml
@ -0,0 +1,46 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Artifacts version="2.0">
+  <Artifact type="SqliteArtifact" name="IOS healthdb_secure" version="1" platform="Ios">
+    <Source type="FileName">healthdb_secure.sqlite</Source>
+    <Query>
+	select 
+		data_provenances.origin_device||' ('||data_provenances.source_version||')' as 'Device',
+		case samples.data_type  
+			when 3 then 'Weight'
+			when 5 then 'Heart Rate'
+			when 7 then 'Steps'
+			when 8 then 'Distance'
+			when 9 then 'Resting Energy'
+			when 10 then 'Active Energy'
+			when 12 then 'Flights Climbed'
+			when 67 then 'Weekly Calorie Goal'
+			when 70 then 'Watch On'
+			when 75 then 'Standing' 
+			when 76 then 'Activity'
+			when 79 then 'Workout'
+			when 83 then 'Some workouts'
+			else samples.data_type -- 20’s ~ 30’s = Nutrition
+			end as 'DataType',
+		quantity_samples.original_quantity||' '||unit_strings.unit_string as 'quantity',
+		quantity_samples.quantity as 'originalquantity',
+		samples.start_date as 'StartDate',
+		samples.end_date as 'EndDate'
+	from samples
+		left join activity_caches on activity_caches.data_id = samples.data_id
+		left join quantity_samples on quantity_samples.data_id = samples.data_id
+		left join correlations on samples.data_id = correlations.object
+		left join data_provenances on data_provenances.ROWID = quantity_samples.original_unit 
+		left join unit_strings on unit_strings.ROWID = quantity_samples.original_unit
+	</Query>
+    <Fragments>
+      <Fragment source="Device" alias="Device" datatype="String" category="None" />
+      <Fragment source="DataType" alias="DataType" datatype="String" category="None" />
+      <Fragment source="quantity" alias="Quantity" datatype="String" category="None" />
+      <Fragment source="originalquantity" alias="Original Value" datatype="String" category="None " />
+      <Fragment source="StartDate" alias="StartDate" datatype="DateTime" dateformat="UNIX Time (ms)" category="DateTime" />
+      <Fragment source="EndDate" alias="EndDate" datatype="DateTime" dateformat="UNIX Time (ms)" category="DateTime" />
+    </Fragments>
+  </Artifact> 
+  <Signature>
+  </Signature>
+</Artifacts>	
--- a/logs_db.xml
+++ b/logs_db.xml
@ -0,0 +1,111 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Artifacts version="2.0">
+  <Artifact type="SqliteArtifact" name="Android logs.db (Samsung Calls/messages)" version="1" platform="Android">
+    <Source type="FileName">logs.db</Source>
+    <Query>
+	-- sec = (Samsung Electronics Corporation)
+	-- \data\com.sec.android.provider.logsproviders\logs.db
+
+	Select 
+		logs._id as 'id',
+		logs.geocoded_location||' ('||logs.countryiso||')' as 'Location',
+		logs.name,
+		logs.number,
+		case logs.numbertype 
+			when 1 then 'Home'
+			when 2 then 'Mobile'
+			when 3 then 'Work'
+			when 4 then 'Fax_Work'
+			when 5 then 'Fax_Home'
+			when 6 then 'Pager'
+			when 7 then 'Other'
+			when 8 then 'Callback'
+			when 9 then 'Car'
+			when 10 then 'Company_Main'
+			when 11 then 'ISDN'
+			when 12 then 'Main'
+			when 13 then 'Other_Fax'
+			when 14 then 'Radio'
+			when 15 then 'Telex'
+			when 16 then 'TTY_TDD'
+			when 17 then 'Work_Mobile'
+			when 18 then 'Work_Pager'
+			when 19 then 'Assistant'
+			when 20 then 'MMS'
+			else logs.numbertype
+			end as 'numbertype',
+		case logs.presentation
+			when 1 then 'allowed' --Number is allowed to display for caller id
+			when 2 then 'restricted' --Number is blocked by user
+			when 3 then 'unknown'  --Number is not specified or unknown by network
+			when 4 then 'pay phone' --Number is a pay phone
+			else logs.presentation
+			end as 'CallerID',	
+		logs.date as 'lDate',
+		case 
+			when logs.duration != 0
+			then Time(logs.duration, 'unixepoch') 
+			end as 'Duration',--The duration of the call in seconds
+		case logs.type
+			when 1 then 'incoming' --incoming calls
+			when 2 then 'outgoing' --outgoing calls
+			when 3 then 'missed' --missed calls
+			when 4 then 'voicemail' --Call log type for voicemails
+			when 5 then 'rejected' --rejected by direct user action
+			when 6 then 'blocked' --calls blocked automatically
+			when 7 then 'answered externally' --call which was answered on another device
+			else logs.type
+		end as 'type',	
+		case 
+			when logs.logtype in (100)
+			then 'Call ('||logs.logtype||')'
+			when logs.logtype in (300)
+			then 'SMS ('||logs.logtype||')'
+			when logs.logtype in (400)
+			then 'Email ('||logs.logtype||')'
+			else 'Other ('||logs.logtype||')'
+			end as 'logtype',
+		logs.messageid,		
+		case logs.is_read
+			when 0 then 'No'
+			when 1 then 'Yes'
+			end as 'IsRead',
+		logs.m_subject as 'MessageSubject',
+		logs.m_content as 'MessageContent',
+		case logs."new"
+			when 1 then 'Yes'
+			end as 'New',
+		logs.contactid,
+		logs.raw_contact_id as 'rawcontactid',
+		logs.lookup_uri as 'lookupuri',
+		logs.photo_id as 'photoid',
+		logs.account_name||' ('||logs.account_id||')' as 'Account'
+	from logs
+	-- order by lDate desc
+	</Query>
+    <Fragments>
+      <Fragment source="id" alias="ID" datatype="Integer" category="None" />
+      <Fragment source="Location" alias="Location" datatype="String" category="None" />
+      <Fragment source="name" alias="Name" datatype="String" category="PersonIdentifier" />
+      <Fragment source="number" alias="Number" datatype="String" category="PersonIdentifier " />
+      <Fragment source="numbertype" alias="Number Type" datatype="String" category="None" />
+      <Fragment source="CallerID" alias="CallerID" datatype="String" category="None" />
+      <Fragment source="lDate" alias="Date" datatype="DateTime" dateformat="UNIX Time (ms)" category="DateTime" />
+      <Fragment source="Duration" alias="Duration" datatype="String" category="None" />
+      <Fragment source="type" alias="Type" datatype="String" category="None" />
+      <Fragment source="logtype" alias="Log Type" datatype="String" category="None" />
+      <Fragment source="messageid" alias="Message ID" datatype="Integer" category="None" />
+      <Fragment source="IsRead" alias="Is Read " datatype="String" category="None" />
+      <Fragment source="MessageSubject" alias="Message Subject" datatype="String" category="None" />
+      <Fragment source="MessageContent" alias="MessageC ontent" datatype="String" category="None" />
+	  <Fragment source="New" alias="New" datatype="String" category="None" />
+	  <Fragment source="contactid" alias="Contact Id" datatype="String" category="None" />
+      <Fragment source="rawcontactid" alias="Raw Contact Id" datatype="String" category="None" />
+      <Fragment source="lookupuri" alias="LookUp URI" datatype="String" category="None" />
+      <Fragment source="photoid" alias="Photo ID" datatype="String" category="None" />
+      <Fragment source="Account" alias="Account" datatype="String" category="None" />
+    </Fragments>
+  </Artifact> 
+  <Signature>
+  </Signature>
+</Artifacts>