From 69ec99dfe7c2cae575932b618fcb7b5c14009906 Mon Sep 17 00:00:00 2001
From: Costas K <11378310+kacos2000@users.noreply.github.com>
Date: Sun, 4 Aug 2019 13:24:39 +0300
Subject: [PATCH] Add files via upload

---
 Opera_History.sql | 53 ++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 52 insertions(+), 1 deletion(-)

diff --git a/Opera_History.sql b/Opera_History.sql
index 305ff0c..df783f2 100644
--- a/Opera_History.sql
+++ b/Opera_History.sql
@@ -2,6 +2,7 @@
 --
 -- REFERENCES:
 -- https://www.foxtonforensics.com/blog/post/analysing-synchronised-browser-history
+-- https://dfir.blog/chrome-values-lookup-tables/amp/
 
 select 
 urls.id as 'url_id',
@@ -14,6 +15,56 @@ segment_usage.visit_count,
 downloads.current_path 'CurrentPath',
 downloads.received_bytes as 'ReceivedBytes',
 downloads.total_bytes as 'TotalBytes',
+case downloads.danger_type
+	when 0 then "Not Dangerous"
+	when 1 then "Dangerous"
+	when 2 then "Dangerous URL"
+	when 3 then "Dangerous Content"
+	when 4 then "Content May Be Malicious"
+	when 5 then "Uncommon Content"
+	when 6 then "Dangerous But User Validated"
+	when 7 then "Dangerous Host"
+	when 8 then "Potentially Unwanted"
+	when 9 then "Whitelisted by Policy"
+	end as 'DangerType',
+ case downloads.interrupt_reason
+	when 0 then "Success"
+	when 1 then "File Error"
+	when 2 then "Access Denied"
+	when 3 then "Disk Full"
+	when 5 then "Path Too Long"
+	when 6 then "File Too Large"
+	when 7 then "Virus"
+	when 10 then "Temporary Problem"
+	when 11 then "Blocked"
+	when 12 then "Security Check Failed"
+	when 13 then "Resume Error"
+	when 20 then "Network Error"
+	when 21 then "Operation Timed Out"
+	when 22 then "Connection Lost"
+	when 23 then "Server Down"
+	when 30 then "Server Error"
+	when 31 then "Range Request Error"
+	when 32 then "Server Precondition Error"
+	when 33 then "Unable to get file"
+	when 34 then "Server Unauthorized"
+	when 35 then "Server Certificate Problem"
+	when 36 then "Server Access Forbidden"
+	when 37 then "Server Unreachable"
+	when 38 then "Content Length Mismatch"
+	when 39 then "Cross Origin Redirect"
+	when 40 then "Cancelled"
+	when 41 then "Browser Shutdown"
+	when 50 then "Browser Crashed"
+	end as 'InterruptReason',
+case downloads.state
+	when 0 then "In Progress"
+	when 1 then "Complete"
+	when 2 then "Cancelled"
+	when 3 then "Interrupted"
+	when 4 then "Interrupted"
+	end as 'State',
+	
 case downloads.opened 
 	when 0 then 'No'
 	when 1 then 'Yes'
@@ -50,5 +101,5 @@ left join segments on urls.id = segments.url_id
 left join segment_usage on segments.id =  segment_usage.segment_id
 left join keyword_search_terms on keyword_search_terms.url_id = urls.id
 left join downloads_url_chains on downloads_url_chains.url = urls.url
-left join downloads on downloads.id = downloads_url_chains.id
+left join downloads on downloads.tab_url = urls.url 
 order by count desc, lastvisit desc
\ No newline at end of file