TypeError: 'datetime.datetime' object is not subscriptable in iTunesBackupInfo.py when purchaseDate is a plist date type

The issue is in scripts/artifacts/iTunesBackupInfo.py around line 124. First, locate the itunes_backup_installed_applications function and the download_info dictionary. Check the type of purchaseDate: if it's a datetime.datetime, format it with strftime; if it's a string, slice off the trailing 'Z' and replace 'T' with a space. Test by running the script on an iTunes backup that triggers the error, or create a unit test that mocks both data types.

Description

itunes_backup_installed_applications in scripts/artifacts/iTunesBackupInfo.py crashes when an app's iTunesMetadata → com.apple.iTunesStore.downloadInfo → purchaseDate value is decoded by plistlib as a native datetime.datetime object rather than an ISO-8601 string.

The code assumes purchaseDate is always a string and slices off the trailing Z:

purchase_date = download_info.get('purchaseDate', '')
if purchase_date:
    purchase_date = purchase_date[:-1].replace('T', ' ')

datetime.datetime objects aren't subscriptable, so this raises a TypeError and halts the whole parse run.

This appears to depend on how the specific backup encoded the <date> tag in the embedded iTunesMetadata plist — some backups store it as a string, others as a proper plist date, which plistlib.loads() auto-converts to datetime.datetime. I hit this consistently on an old iOS 12.3 iTunes backup.

Steps to Reproduce

1. Parse an iTunes backup (iOS 12.3 in my case) via CLI: python ileapp.py -t itunes -i <path> -o <path>
2. itunes_backup_installed_applications runs and crashes on the first app whose iTunesMetadata encodes purchaseDate as a plist date type.

Traceback

Traceback (most recent call last):
  File "C:\iLEAPP\ileapp.py", line 607, in <module>
    main()
  File "C:\iLEAPP\ileapp.py", line 361, in main
    crunch_artifacts(selected_plugins, extracttype, input_path, out_params, wrap_text, loader, casedata, time_offset,
                      profile_filename, itunes_backup_password)
  File "C:\iLEAPP\ileapp.py", line 466, in crunch_artifacts
    loader["itunes_backup_installed_applications"].method([info_plist_path], report_folder, seeker, wrap_text, time_offset)
  File "C:\iLEAPP\scripts\ilapfuncs.py", line 534, in wrapper
    data_headers, data_list, source_path = func(Context)
  File "C:\iLEAPP\scripts\artifacts\iTunesBackupInfo.py", line 124, in itunes_backup_installed_applications
    purchase_date = purchase_date[:-1].replace('T', ' ')
TypeError: 'datetime.datetime' object is not subscriptable

Environment

• iLEAPP: running from source (main branch, as of ~Aug 2026)
• OS: Windows
• Python: 3.14
• Extraction type: iTunes backup (-t itunes)
• Source device iOS version: 12.3

Suggested Fix

Type-check before slicing, since purchase_date may already be a datetime.datetime:

purchase_date = download_info.get('purchaseDate', '')
if purchase_date:
    if isinstance(purchase_date, datetime.datetime):
        purchase_date = purchase_date.strftime('%Y-%m-%d %H:%M:%S')
    else:
        purchase_date = purchase_date[:-1].replace('T', ' ')

I've tested this locally against the failing backup and it resolves the crash while preserving existing behavior for backups where purchaseDate is a string.