Kik parser

[OneSixForensics]

The existing kikReturns.py and kikProfilepic.py parsers no longer work with the current Kik legal return format. This PR replaces both with a complete, tested parser (kik.py) for the new format, along with sidebar icon support in report_icons.py.

New Return Format

Kik legal returns are now delivered as package.zip with the following structure:

package/
├── content/
│   ├── medias/          ← Base64-named JPEG and MP4 files
│   ├── data-text.csv    ← Direct message text
│   └── data-media.csv   ← Media message metadata
├── logs/
│   ├── binds.csv
│   ├── block_user.csv
│   ├── chat_platform_sent.csv
│   ├── chat_platform_sent_received.csv
│   ├── chat_sent.csv
│   ├── chat_sent_received.csv
│   ├── friends_added.csv
│   ├── group_receive.csv
│   └── group_send_msg_platform.csv
├── chats.html
├── group-legend-<username>_<id>.csv
└── subscriber-data-<username>_<id>.pdf

Artifacts (13 total)

Artifact | Source -- | -- Kik - Subscriber Info | subscriber-data-*.pdf Kik - Subscriber Profile Pics | subscriber-data-*.pdf Kik - Subscriber Events | subscriber-data-*.pdf Kik - Group Legend | group-legend-*.csv Kik - Chat Messages (Text) | content/data-text.csv Kik - Chat Messages (Media) | content/data-media.csv + medias/ Kik - Sent Chats (Log) | logs/chat_sent.csv Kik - Sent & Received Chats (Log) | logs/chat_sent_received.csv Kik - Platform Chat Sent (Log) | logs/chat_platform_sent.csv Kik - Platform Chat Sent & Received (Log) | logs/chat_platform_sent_received.csv Kik - Group Messages Received (Log) | logs/group_receive.csv Kik - Group Messages Sent (Log) | logs/group_send_msg_platform.csv Kik - Friends Added (Log) | logs/friends_added.csv Kik - Blocked Users (Log) | logs/block_user.csv Kik - Binds (Log) | logs/binds.csv

Notable Features

• Subscriber PDF parsed with regex — extracts name, email, username, registration timestamp, client version, device info, IP, and profile pic URLs with MD5 hashes
• Media files rendered inline in the HTML report via <img>/<video> tags
• Profile pic URLs rendered as clickable hyperlinks alongside Original and Scaled MD5 hashes
• All millisecond epoch timestamps (sent_at_ts, epoch) converted to human-readable UTC with ms precision preserved
• IP addresses, device types, and JIDs surfaced as named columns throughout
• Schema validation with graceful raw fallback on every artifact if Kik changes their format
• Windows extended-length path (\\?\) handling
• report_icons.py updated with KIK category for proper sidebar icons

Dependencies

Requires pdfminer.six (already added to requirements.txt) for subscriber PDF parsing. All other artifacts function without it — a missing pdfminer installation logs a clear message and skips PDF parsing only.

Testing

Tested against a live ICAC Kik legal return. All 13 artifacts parse successfully.

I had a great time in class this week, thanks again!

Kyle Christopherson