diff --git a/mvt/ios/modules/mixed/sms.py b/mvt/ios/modules/mixed/sms.py index eecc1c4..6491343 100644 --- a/mvt/ios/modules/mixed/sms.py +++ b/mvt/ios/modules/mixed/sms.py @@ -44,7 +44,7 @@ class SMS(IOSExtraction): def serialize(self, record: dict) -> Union[dict, list]: text = record["text"].replace("\n", "\\n") sms_data = f"{record['service']}: {record['guid']} \"{text}\" from {record['phone_number']} ({record['account']})" - sms_data = [ + records = [ { "timestamp": record["isodate"], "module": self.__class__.__name__, @@ -54,7 +54,7 @@ class SMS(IOSExtraction): ] # If the message was read, we add an extra event. if record["isodate_read"]: - sms_data.append( + records.append( { "timestamp": record["isodate_read"], "module": self.__class__.__name__, @@ -62,7 +62,7 @@ class SMS(IOSExtraction): "data": sms_data, } ) - return sms_data + return records def check_indicators(self) -> None: for message in self.results: diff --git a/tests/artifacts/ios_backup/3d/3d0d7e5fb2ce288813306e4d4636395e047a3d28 b/tests/artifacts/ios_backup/3d/3d0d7e5fb2ce288813306e4d4636395e047a3d28 index b067ce7..f18450e 100644 Binary files a/tests/artifacts/ios_backup/3d/3d0d7e5fb2ce288813306e4d4636395e047a3d28 and b/tests/artifacts/ios_backup/3d/3d0d7e5fb2ce288813306e4d4636395e047a3d28 differ diff --git a/tests/ios_backup/test_sms.py b/tests/ios_backup/test_sms.py index 84ac0b5..243f630 100644 --- a/tests/ios_backup/test_sms.py +++ b/tests/ios_backup/test_sms.py @@ -17,7 +17,7 @@ class TestSMSModule: m = SMS(target_path=get_ios_backup_folder()) run_module(m) assert len(m.results) == 1 - assert len(m.timeline) == 1 + assert len(m.timeline) == 2 assert len(m.detected) == 0 def test_detection(self, indicator_file):