From e3de9fb22e6316e2a4e12b6be1059cd7d0ac78e9 Mon Sep 17 00:00:00 2001 From: zhaoyilun Date: Thu, 9 Jul 2026 22:26:03 +0800 Subject: [PATCH] docs: index n12-pre zyl evidence sources --- .../2026-07-09-n12-pre-zyl-index.md | 111 ++++++++++++++++++ 1 file changed, 111 insertions(+) create mode 100644 docs/source-discovery/2026-07-09-n12-pre-zyl-index.md diff --git a/docs/source-discovery/2026-07-09-n12-pre-zyl-index.md b/docs/source-discovery/2026-07-09-n12-pre-zyl-index.md new file mode 100644 index 0000000..edad0e1 --- /dev/null +++ b/docs/source-discovery/2026-07-09-n12-pre-zyl-index.md @@ -0,0 +1,111 @@ +# N12-pre zyl Evidence Index + +Date: 2026-07-09 +Evidence id: `zyl-qqfile-20260709` +Archive: `runs/offline-evidence-intake/zyl-qqfile-20260709/archives/zyl.rar` +SHA256: `126CC72F21293829FED374321A2AFE6E067959B63A76981BCB6678C64E887173` +Archive type: RAR5 +Archive listing summary: 3931 files, 439 folders +Source metadata: `runs/offline-evidence-intake/zyl-qqfile-20260709/metadata/archive-list.txt` + +## Current conclusion + +The N12-pre package contains a strong local-data candidate for Stage C read tools: + +1. `MsgLib.db` files under `zyl\iSphere\...\Account\...` and `zyl\Impp\Account\...`. +2. `importal\localcache` communication logs: `Smark.SendReceive`, `SaveToDB`, `PacketReader.ProcessPacket`, and `LoginInfo`. +3. `importal\` document/cache directories that can later be mapped to message DB or log references for file receive/download. + +The first Stage C source candidate should be the latest visible iSphere DB for account `90005981`, with IMPP DB and communication logs as comparison/fallback evidence. + +## Candidate counts from archive list + +| Candidate family | Count / summary | Evidence examples | +| --- | --- | --- | +| `MsgLib.db` total | 14 files | 12 under `zyl\iSphere\...\Account\...`, 2 under `zyl\Impp\Account\...` | +| SQLite runtime files | 4 files | `System.Data.SQLite.dll` and `System.Data.SQLite.xml` under both `zyl\iSphere` and `zyl\Impp` | +| `LoginInfo` logs | 18 log files | account/session context | +| `PacketReader.ProcessPacket` logs | 19 log files | packet/message processing trace | +| `SaveToDB` logs | 15 log files | DB persistence trace | +| `Smark.SendReceive` logs | 24 log files | send/receive transport trace; largest observed file is 10,486,426 bytes | +| Hashed `zyl\importal\` file-cache entries | 11 files plus hashed folders | likely document/file receive cache candidates | + +## Candidate source families + +| Family | Evidence path examples | Why it matters | Initial action | +| --- | --- | --- | --- | +| SQLite runtime | `zyl\iSphere\System.Data.SQLite.dll`; `zyl\Impp\System.Data.SQLite.dll` | Confirms bundled SQLite usage around message libraries | record versions and inspect dependent DB files | +| iSphere message DB | `zyl\iSphere\8c5e81a7f6dd1169.10083\27000000\Account\90005981\MsgLib.db`; `zyl\iSphere\8c5e81a7f6dd1169.10083\27000000\Account\duyanming0731\MsgLib.db` | Strong candidate for `isphere_receive_messages`, contacts, groups, and attachment references | extract selected DB copies and inspect schema | +| IMPP message DB | `zyl\Impp\Account\90005981\MsgLib.db`; `zyl\Impp\Account\27091282\MsgLib.db` | Older or parallel candidate source for message history | compare schema with iSphere DB | +| Local communication logs | `zyl\importal\localcache\8c5e81a7f6dd1169.10083\27000000\Log\90005981\Smark.SendReceive\2026-07-07_1.log`; `zyl\importal\localcache\8c5e81a7f6dd1169.10083\27000000\Log\90005981\SaveToDB\2026-07-07_1.log`; `zyl\importal\localcache\8c5e81a7f6dd1169.10083\27000000\Log\90005981\PacketReader.ProcessPacket\2026-07-07_1.log` | Candidate execution trace for message receive/save behavior | inspect log structure and timestamp alignment | +| Login/info logs | `zyl\importal\localcache\8c5e81a7f6dd1169.10083\27000000\Log\90005981\LoginInfo\2026-07-07_1.log` | Candidate account/session context for source mapping | inspect field names and account identifiers | +| Received/document cache | `zyl\importal\256914c029af44bd96665abd69ddd500\*.xlsx`; `zyl\importal\4a33b65a33c14149b440724bfc3d912e\g.docx`; `zyl\importal\4fa0846abdbb4331a956cb056be9566a\*.pdf` | Candidate file receive/download cache for `isphere_receive_files` | map hashed directories to DB/log references | + +## `MsgLib.db` candidates + +| Priority | Modified time | Size bytes | Archive path | Notes | +| --- | --- | ---: | --- | --- | +| 1 | 2026-07-07 15:41:45 | 2,839,552 | `zyl\iSphere\8c5e81a7f6dd1169.10083\27000000\Account\90005981\MsgLib.db` | latest visible iSphere DB and matches same-day logs | +| 2 | 2022-04-24 08:52:20 | 2,776,064 | `zyl\Impp\Account\90005981\MsgLib.db` | parallel/older DB for same account id | +| 3 | 2022-01-25 09:51:17 | 12,198,912 | `zyl\Impp\Account\27091282\MsgLib.db` | largest IMPP message DB, useful for schema comparison | +| 4 | 2026-05-15 17:29:01 | 346,112 | `zyl\iSphere\8c5e81a7f6dd1169.10083\27000000\Account\duyanming0731\MsgLib.db` | recent named-account DB for schema comparison | +| 5 | 2026-06-22 14:03:56 | 333,824 | `zyl\iSphere\8c5e81a7f6dd1169.10083\27000000\Account\mayanlong1912\MsgLib.db` | recent named-account DB for schema comparison | +| 6 | 2026-06-25 10:59:33 | 69,632 | `zyl\iSphere\8c5e81a7f6dd1169.10083\27000000\Account\xuguopeng101X\MsgLib.db` | recent named-account DB for small-schema comparison | +| 7 | 2025-06-20 17:37:32 | 239,616 | `zyl\iSphere\8c5e81a7f6dd1169.10083\27000000\Account\zhangzhenghu2730\MsgLib.db` | message DB candidate | +| 8 | 2025-10-23 15:10:42 | 204,800 | `zyl\iSphere\8c5e81a7f6dd1169.10083\27000000\Account\maxiaojie7418\MsgLib.db` | message DB candidate | +| 9 | 2024-01-27 19:17:55 | 206,848 | `zyl\iSphere\8c5e81a7f6dd1169.10083\27000000\Account\dumei0466\MsgLib.db` | message DB candidate | +| 10 | 2025-10-10 17:14:12 | 108,544 | `zyl\iSphere\8c5e81a7f6dd1169.10083\27000000\Account\90016309\MsgLib.db` | numeric-account DB candidate | +| 11 | 2025-10-28 09:49:12 | 75,776 | `zyl\iSphere\8c5e81a7f6dd1169.10083\27000000\Account\90017948\MsgLib.db` | numeric-account DB candidate | +| 12 | 2023-03-31 15:09:48 | 394,240 | `zyl\iSphere\8c5e81a7f6dd1169.10083\27000000\Account\90003887\MsgLib.db` | older numeric-account DB candidate | +| 13 | 2022-06-14 14:54:19 | 282,624 | `zyl\iSphere\8c5e81a7f6dd1169.10083\27000000\Account\90005184\MsgLib.db` | older numeric-account DB candidate | +| 14 | 2025-06-18 14:07:17 | 191,488 | `zyl\iSphere\8c5e81a7f6dd1169.10083\27000000\Account\lixing0316\MsgLib.db` | message DB candidate | + +## Same-day account `90005981` log candidates + +| Log family | Modified time | Size bytes | Archive path | Why it matters | +| --- | --- | ---: | --- | --- | +| `LoginInfo` | 2026-07-07 15:30:05 | 750 | `zyl\importal\localcache\8c5e81a7f6dd1169.10083\27000000\Log\90005981\LoginInfo\2026-07-07_1.log` | account/session context for the latest DB | +| `SaveToDB` | 2026-07-07 15:30:09 | 9,704 | `zyl\importal\localcache\8c5e81a7f6dd1169.10083\27000000\Log\90005981\SaveToDB\2026-07-07_1.log` | trace of persistence into local DB | +| `PacketReader.ProcessPacket` | 2026-07-07 15:41:45 | 244,606 | `zyl\importal\localcache\8c5e81a7f6dd1169.10083\27000000\Log\90005981\PacketReader.ProcessPacket\2026-07-07_1.log` | packet processing trace near DB timestamp | +| `Smark.SendReceive` | 2026-07-07 15:43:08 | 827,884 | `zyl\importal\localcache\8c5e81a7f6dd1169.10083\27000000\Log\90005981\Smark.SendReceive\2026-07-07_1.log` | send/receive trace near DB timestamp | +| `Default` | 2026-07-07 15:33:47 | 98,056 | `zyl\importal\localcache\8c5e81a7f6dd1169.10083\27000000\Log\90005981\Default\2026-07-07_1.log` | general client runtime context | +| `Default/ErrorFaltal` | 2026-07-07 15:32:51 | 57,408 | `zyl\importal\localcache\8c5e81a7f6dd1169.10083\27000000\Log\90005981\Default\ErrorFaltal\2026-07-07_1.log` | error/runtime context for the same date | + +## Received/document cache candidates + +The archive contains hashed `zyl\importal\` directories with document-like files. The visible examples include: + +| Archive path pattern | Observed file type | MCP relevance | +| --- | --- | --- | +| `zyl\importal\256914c029af44bd96665abd69ddd500\*.xlsx` | spreadsheet | candidate received-file cache | +| `zyl\importal\4a33b65a33c14149b440724bfc3d912e\g.docx` | Word document | candidate received-file cache | +| `zyl\importal\4fa0846abdbb4331a956cb056be9566a\*.pdf` | PDF | candidate received-file cache | +| `zyl\importal\69003b4a95b5461fbe6fba38de74bc62\*.doc` | Word document | candidate received-file cache | +| `zyl\importal\c4f11655e8d24e96b3a0eb2e3727bba0\*.docx` | Word document | candidate received-file cache | +| `zyl\importal\cd0cd63034824bbaa81e1136da9dc236\*.pdf` | PDF | candidate received-file cache | + +These hashed directories become useful after the DB/log inspection identifies message attachment or file-cache references. + +## First extraction target list + +| Priority | Archive path | Destination under runs | Reason | +| --- | --- | --- | --- | +| 1 | `zyl\iSphere\8c5e81a7f6dd1169.10083\27000000\Account\90005981\MsgLib.db` | `runs/offline-evidence-intake/zyl-qqfile-20260709/extracted/msgdb-isphere-90005981/` | latest visible iSphere message DB candidate | +| 2 | `zyl\Impp\Account\90005981\MsgLib.db` | `runs/offline-evidence-intake/zyl-qqfile-20260709/extracted/msgdb-impp-90005981/` | compare older or parallel IMPP DB candidate | +| 3 | `zyl\Impp\Account\27091282\MsgLib.db` | `runs/offline-evidence-intake/zyl-qqfile-20260709/extracted/msgdb-impp-27091282/` | largest observed message DB for schema comparison | +| 4 | `zyl\importal\localcache\8c5e81a7f6dd1169.10083\27000000\Log\90005981\Smark.SendReceive\2026-07-07_1.log` | `runs/offline-evidence-intake/zyl-qqfile-20260709/extracted/log-smark-90005981-20260707/` | message send/receive trace candidate | +| 5 | `zyl\importal\localcache\8c5e81a7f6dd1169.10083\27000000\Log\90005981\SaveToDB\2026-07-07_1.log` | `runs/offline-evidence-intake/zyl-qqfile-20260709/extracted/log-savetodb-90005981-20260707/` | DB write trace candidate | +| 6 | `zyl\importal\localcache\8c5e81a7f6dd1169.10083\27000000\Log\90005981\PacketReader.ProcessPacket\2026-07-07_1.log` | `runs/offline-evidence-intake/zyl-qqfile-20260709/extracted/log-packetreader-90005981-20260707/` | packet processing trace candidate | +| 7 | `zyl\importal\localcache\8c5e81a7f6dd1169.10083\27000000\Log\90005981\LoginInfo\2026-07-07_1.log` | `runs/offline-evidence-intake/zyl-qqfile-20260709/extracted/log-logininfo-90005981-20260707/` | account/session context candidate | + +## Stage B2 questions + +1. What are the table names and column names inside `MsgLib.db`? +2. Which tables contain message body, sender, receiver/conversation id, timestamp, and attachment/file references? +3. Are contact and group display names stored in the same DB or only inferable from conversation/message rows? +4. Do `SaveToDB` and `Smark.SendReceive` logs reveal DB table mapping or message ids that can be matched to `MsgLib.db`? +5. Which DB/log field maps to the `docs/mcp-core-tools-contract.md` output for `isphere_receive_messages`? + +## Decision after index + +Proceed to `docs/source-discovery/capability-source-matrix.md` after the first extraction target list has confirmed message DB and log candidates. The likely first Stage C implementation slice is `isphere_receive_messages` backed by `zyl\iSphere\...\Account\90005981\MsgLib.db`, subject to schema inspection.