deploy: bbd0256291
This commit is contained in:
chapinb
parent
47e320972b
commit
107caaa6ae
|
|
@ -1,4 +1,4 @@
|
|||
# Sphinx build info version 1
|
||||
# This file hashes the configuration used when building these files. When it is not found, a full rebuild will be done.
|
||||
config: 68742d456087727ed42422957f408af7
|
||||
config: bba2bba94c5da3a0f35a41a0438a5a1d
|
||||
tags: 645f666f9bcd5a90fca523b33c5a78b7
|
||||
|
|
|
|||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
|
@ -1,4 +1,4 @@
|
|||
Section 1 - Essential Scripts
|
||||
Chapter 1 - Essential Scripts
|
||||
==============================
|
||||
.. toctree::
|
||||
:maxdepth: 2
|
||||
|
|
@ -6,27 +6,27 @@ Section 1 - Essential Scripts
|
|||
|
||||
Section 1.1 - Argparse Example
|
||||
--------------------------------
|
||||
.. automodule:: pyforhandbook.section_01.argparse_example
|
||||
.. automodule:: pyforhandbook.ch01_essentials.argparse_example
|
||||
:members:
|
||||
|
||||
Section 1.2 - Logging Example
|
||||
--------------------------------
|
||||
.. automodule:: pyforhandbook.section_01.logging_example
|
||||
.. automodule:: pyforhandbook.ch01_essentials.logging_example
|
||||
:members:
|
||||
|
||||
Section 1.3 - Open Files
|
||||
------------------------
|
||||
.. automodule:: pyforhandbook.section_01.open_files
|
||||
.. automodule:: pyforhandbook.ch01_essentials.open_files
|
||||
:members:
|
||||
|
||||
Section 1.4 - CSV Example
|
||||
--------------------------------
|
||||
.. automodule:: pyforhandbook.section_01.csv_example
|
||||
.. automodule:: pyforhandbook.ch01_essentials.csv_example
|
||||
:members:
|
||||
|
||||
Section 1.5 - Directory Recursion
|
||||
---------------------------------
|
||||
.. automodule:: pyforhandbook.section_01.recursion_example
|
||||
.. automodule:: pyforhandbook.ch01_essentials.recursion_example
|
||||
:members:
|
||||
|
||||
Indices and tables
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
Section 2 - Registry Parsing
|
||||
Chapter 2 - Registry Parsing
|
||||
==============================
|
||||
.. toctree::
|
||||
:maxdepth: 2
|
||||
|
|
@ -6,12 +6,12 @@ Section 2 - Registry Parsing
|
|||
|
||||
Section 2.1 - Opening a Hive
|
||||
--------------------------------
|
||||
.. automodule:: pyforhandbook.section_02.yarp_base
|
||||
.. automodule:: pyforhandbook.ch02_registry.yarp_base
|
||||
:members:
|
||||
|
||||
Section 2.2 - Parsing Hive Values
|
||||
----------------------------------
|
||||
.. automodule:: pyforhandbook.section_02.yarp_ntuser
|
||||
.. automodule:: pyforhandbook.ch02_registry.yarp_ntuser
|
||||
:members:
|
||||
|
||||
Indices and tables
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
Section 3 - Windows Event Log Parsing
|
||||
Chapter 3 - Windows Event Log Parsing
|
||||
=====================================
|
||||
.. toctree::
|
||||
:maxdepth: 2
|
||||
|
|
@ -6,7 +6,7 @@ Section 3 - Windows Event Log Parsing
|
|||
|
||||
Section 3.1 - Using python-evtx
|
||||
----------------------------------
|
||||
.. automodule:: pyforhandbook.section_03.using_python_evtx
|
||||
.. automodule:: pyforhandbook.ch03_event_logs.using_python_evtx
|
||||
:members:
|
||||
|
||||
Indices and tables
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
Section 6 - Sqlite & MacOS/Mobile/Browsers
|
||||
Chapter 6 - Sqlite & MacOS/Mobile/Browsers
|
||||
==========================================
|
||||
.. toctree::
|
||||
:maxdepth: 2
|
||||
|
|
@ -6,7 +6,7 @@ Section 6 - Sqlite & MacOS/Mobile/Browsers
|
|||
|
||||
Section 6.1 - Opening Sqlite
|
||||
--------------------------------
|
||||
.. automodule:: pyforhandbook.section_06.opening_sqlite
|
||||
.. automodule:: pyforhandbook.ch06_databases.opening_sqlite
|
||||
:members:
|
||||
|
||||
Indices and tables
|
||||
|
|
@ -5,18 +5,18 @@
|
|||
|
||||
The Python Forensics Handbook
|
||||
=============================
|
||||
---------------------------------------------
|
||||
A guide for developing Python scripts in DFIR
|
||||
---------------------------------------------
|
||||
--------------------------------------------------------
|
||||
A reference guide for developing Python scripts in DFIR
|
||||
--------------------------------------------------------
|
||||
|
||||
.. toctree::
|
||||
:maxdepth: 1
|
||||
:caption: Table of Contents:
|
||||
|
||||
section1
|
||||
section2
|
||||
section3
|
||||
section6
|
||||
ch01_essentials
|
||||
ch02_registry
|
||||
ch03_event_logs
|
||||
ch06_databases
|
||||
|
||||
Handbook Sections
|
||||
==============================
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
var DOCUMENTATION_OPTIONS = {
|
||||
URL_ROOT: document.getElementById("documentation_options").getAttribute('data-url_root'),
|
||||
VERSION: '0.1.0',
|
||||
VERSION: '0.1.1',
|
||||
LANGUAGE: 'None',
|
||||
COLLAPSE_INDEX: false,
|
||||
BUILDER: 'html',
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
|
||||
<title>Section 1 - Essential Scripts — Python Forensics Handbook 0.1.0 documentation</title>
|
||||
<title>Chapter 1 - Essential Scripts — Python Forensics Handbook 0.1.1 documentation</title>
|
||||
|
||||
|
||||
|
||||
|
|
@ -36,7 +36,7 @@
|
|||
|
||||
<link rel="index" title="Index" href="genindex.html" />
|
||||
<link rel="search" title="Search" href="search.html" />
|
||||
<link rel="next" title="Section 2 - Registry Parsing" href="section2.html" />
|
||||
<link rel="next" title="Chapter 2 - Registry Parsing" href="ch02_registry.html" />
|
||||
<link rel="prev" title="The Python Forensics Handbook" href="index.html" />
|
||||
|
||||
<!-- Global site tag (gtag.js) - Google Analytics -->
|
||||
|
|
@ -72,7 +72,7 @@
|
|||
|
||||
|
||||
<div class="version">
|
||||
0.1.0
|
||||
0.1.1
|
||||
</div>
|
||||
|
||||
|
||||
|
|
@ -99,28 +99,28 @@
|
|||
|
||||
<p class="caption"><span class="caption-text">Table of Contents:</span></p>
|
||||
<ul class="current">
|
||||
<li class="toctree-l1 current"><a class="current reference internal" href="#">Section 1 - Essential Scripts</a><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-pyforhandbook.section_01.argparse_example">Section 1.1 - Argparse Example</a><ul>
|
||||
<li class="toctree-l1 current"><a class="current reference internal" href="#">Chapter 1 - Essential Scripts</a><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-pyforhandbook.ch01_essentials.argparse_example">Section 1.1 - Argparse Example</a><ul>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#argparse-configuration">Argparse configuration</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-pyforhandbook.section_01.logging_example">Section 1.2 - Logging Example</a><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-pyforhandbook.ch01_essentials.logging_example">Section 1.2 - Logging Example</a><ul>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#logging-configuration">Logging configuration</a></li>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#docstring-references">Docstring References</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-pyforhandbook.section_01.open_files">Section 1.3 - Open Files</a><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-pyforhandbook.ch01_essentials.open_files">Section 1.3 - Open Files</a><ul>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#open-files-with-proper-encoding">Open files with proper encoding</a></li>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#id1">Docstring References</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-pyforhandbook.section_01.csv_example">Section 1.4 - CSV Example</a><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-pyforhandbook.ch01_essentials.csv_example">Section 1.4 - CSV Example</a><ul>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#list-of-dictionaries-to-csv">List of dictionaries to CSV</a></li>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#list-of-ordered-lists-to-csv">List of ordered lists to CSV</a></li>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#id2">Docstring References</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-pyforhandbook.section_01.recursion_example">Section 1.5 - Directory Recursion</a><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-pyforhandbook.ch01_essentials.recursion_example">Section 1.5 - Directory Recursion</a><ul>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#list-a-directory">List a directory</a></li>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#list-a-directory-recursively">List a directory recursively</a></li>
|
||||
</ul>
|
||||
|
|
@ -128,9 +128,9 @@
|
|||
<li class="toctree-l2"><a class="reference internal" href="#indices-and-tables">Indices and tables</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="section2.html">Section 2 - Registry Parsing</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="section3.html">Section 3 - Windows Event Log Parsing</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="section6.html">Section 6 - Sqlite & MacOS/Mobile/Browsers</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="ch02_registry.html">Chapter 2 - Registry Parsing</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="ch03_event_logs.html">Chapter 3 - Windows Event Log Parsing</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="ch06_databases.html">Chapter 6 - Sqlite & MacOS/Mobile/Browsers</a></li>
|
||||
</ul>
|
||||
|
||||
|
||||
|
|
@ -177,13 +177,13 @@
|
|||
|
||||
<li><a href="index.html" class="icon icon-home"></a> »</li>
|
||||
|
||||
<li>Section 1 - Essential Scripts</li>
|
||||
<li>Chapter 1 - Essential Scripts</li>
|
||||
|
||||
|
||||
<li class="wy-breadcrumbs-aside">
|
||||
|
||||
|
||||
<a href="_sources/section1.rst.txt" rel="nofollow"> View page source</a>
|
||||
<a href="_sources/ch01_essentials.rst.txt" rel="nofollow"> View page source</a>
|
||||
|
||||
|
||||
</li>
|
||||
|
|
@ -196,12 +196,12 @@
|
|||
<div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
|
||||
<div itemprop="articleBody">
|
||||
|
||||
<div class="section" id="section-1-essential-scripts">
|
||||
<h1>Section 1 - Essential Scripts<a class="headerlink" href="#section-1-essential-scripts" title="Permalink to this headline">¶</a></h1>
|
||||
<div class="section" id="chapter-1-essential-scripts">
|
||||
<h1>Chapter 1 - Essential Scripts<a class="headerlink" href="#chapter-1-essential-scripts" title="Permalink to this headline">¶</a></h1>
|
||||
<div class="toctree-wrapper compound">
|
||||
</div>
|
||||
<div class="section" id="module-pyforhandbook.section_01.argparse_example">
|
||||
<span id="section-1-1-argparse-example"></span><h2>Section 1.1 - Argparse Example<a class="headerlink" href="#module-pyforhandbook.section_01.argparse_example" title="Permalink to this headline">¶</a></h2>
|
||||
<div class="section" id="module-pyforhandbook.ch01_essentials.argparse_example">
|
||||
<span id="section-1-1-argparse-example"></span><h2>Section 1.1 - Argparse Example<a class="headerlink" href="#module-pyforhandbook.ch01_essentials.argparse_example" title="Permalink to this headline">¶</a></h2>
|
||||
<p>Example for setting up arguments for your command line utility.</p>
|
||||
<p>Example Usage:</p>
|
||||
<blockquote>
|
||||
|
|
@ -225,29 +225,35 @@ module has many more features documented at
|
|||
<span class="c1"># description and epilog. The `formatter_class` instructs</span>
|
||||
<span class="c1"># argparse to show default values set for parameters.</span>
|
||||
<span class="n">parser</span> <span class="o">=</span> <span class="n">argparse</span><span class="o">.</span><span class="n">ArgumentParser</span><span class="p">(</span>
|
||||
<span class="n">description</span><span class="o">=</span><span class="s1">'Sample Argparse'</span><span class="p">,</span>
|
||||
<span class="n">description</span><span class="o">=</span><span class="s2">"Sample Argparse"</span><span class="p">,</span>
|
||||
<span class="n">formatter_class</span><span class="o">=</span><span class="n">argparse</span><span class="o">.</span><span class="n">ArgumentDefaultsHelpFormatter</span><span class="p">,</span>
|
||||
<span class="n">epilog</span><span class="o">=</span><span class="sa">f</span><span class="s2">"Built by </span><span class="si">{</span><span class="n">__author__</span><span class="si">}</span><span class="s2">, v.</span><span class="si">{</span><span class="n">__date__</span><span class="si">}</span><span class="s2">"</span>
|
||||
<span class="n">epilog</span><span class="o">=</span><span class="sa">f</span><span class="s2">"Built by </span><span class="si">{</span><span class="n">__author__</span><span class="si">}</span><span class="s2">, v.</span><span class="si">{</span><span class="n">__date__</span><span class="si">}</span><span class="s2">"</span><span class="p">,</span>
|
||||
<span class="p">)</span>
|
||||
|
||||
<span class="c1"># The simplest form of adding an argument, the name of the</span>
|
||||
<span class="c1"># parameter and a description of its form.</span>
|
||||
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'INPUT_FILE'</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s2">"Input file to parse"</span><span class="p">)</span>
|
||||
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'OUTPUT_FOLDER'</span><span class="p">,</span>
|
||||
<span class="n">help</span><span class="o">=</span><span class="s2">"Folder to store output"</span><span class="p">)</span>
|
||||
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s2">"INPUT_FILE"</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s2">"Input file to parse"</span><span class="p">)</span>
|
||||
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s2">"OUTPUT_FOLDER"</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s2">"Folder to store output"</span><span class="p">)</span>
|
||||
|
||||
<span class="c1"># An optional argument with multiple methods of specifying</span>
|
||||
<span class="c1"># the parameter. Includes a default value</span>
|
||||
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'-l'</span><span class="p">,</span> <span class="s1">'--log'</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s2">"Path to log file"</span><span class="p">,</span>
|
||||
<span class="n">default</span><span class="o">=</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">join</span><span class="p">(</span>
|
||||
<span class="n">PurePath</span><span class="p">(</span><span class="vm">__file__</span><span class="p">)</span><span class="o">.</span><span class="n">parent</span><span class="p">,</span>
|
||||
<span class="n">PurePath</span><span class="p">(</span><span class="vm">__file__</span><span class="p">)</span><span class="o">.</span><span class="n">name</span><span class="o">.</span><span class="n">rsplit</span><span class="p">(</span><span class="s1">'.'</span><span class="p">,</span> <span class="mi">1</span><span class="p">)[</span><span class="mi">0</span><span class="p">]</span> <span class="o">+</span> <span class="s1">'.log'</span><span class="p">))</span>
|
||||
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span>
|
||||
<span class="s2">"-l"</span><span class="p">,</span>
|
||||
<span class="s2">"--log"</span><span class="p">,</span>
|
||||
<span class="n">help</span><span class="o">=</span><span class="s2">"Path to log file"</span><span class="p">,</span>
|
||||
<span class="n">default</span><span class="o">=</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span>
|
||||
<span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">join</span><span class="p">(</span>
|
||||
<span class="n">PurePath</span><span class="p">(</span><span class="vm">__file__</span><span class="p">)</span><span class="o">.</span><span class="n">parent</span><span class="p">,</span>
|
||||
<span class="n">PurePath</span><span class="p">(</span><span class="vm">__file__</span><span class="p">)</span><span class="o">.</span><span class="n">name</span><span class="o">.</span><span class="n">rsplit</span><span class="p">(</span><span class="s2">"."</span><span class="p">,</span> <span class="mi">1</span><span class="p">)[</span><span class="mi">0</span><span class="p">]</span> <span class="o">+</span> <span class="s2">".log"</span><span class="p">,</span>
|
||||
<span class="p">)</span>
|
||||
<span class="p">),</span>
|
||||
<span class="p">)</span>
|
||||
|
||||
<span class="c1"># An optional argument which does not accept a value, instead</span>
|
||||
<span class="c1"># just modifies functionality.</span>
|
||||
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'-v'</span><span class="p">,</span> <span class="s1">'--verbose'</span><span class="p">,</span> <span class="n">action</span><span class="o">=</span><span class="s1">'store_true'</span><span class="p">,</span>
|
||||
<span class="n">help</span><span class="o">=</span><span class="s1">'Include debug log messages'</span><span class="p">)</span>
|
||||
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span>
|
||||
<span class="s2">"-v"</span><span class="p">,</span> <span class="s2">"--verbose"</span><span class="p">,</span> <span class="n">action</span><span class="o">=</span><span class="s2">"store_true"</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s2">"Include debug log messages"</span>
|
||||
<span class="p">)</span>
|
||||
|
||||
<span class="c1"># Once we've specified our arguments we can parse them for</span>
|
||||
<span class="c1"># reference</span>
|
||||
|
|
@ -259,8 +265,8 @@ module has many more features documented at
|
|||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="section" id="module-pyforhandbook.section_01.logging_example">
|
||||
<span id="section-1-2-logging-example"></span><h2>Section 1.2 - Logging Example<a class="headerlink" href="#module-pyforhandbook.section_01.logging_example" title="Permalink to this headline">¶</a></h2>
|
||||
<div class="section" id="module-pyforhandbook.ch01_essentials.logging_example">
|
||||
<span id="section-1-2-logging-example"></span><h2>Section 1.2 - Logging Example<a class="headerlink" href="#module-pyforhandbook.ch01_essentials.logging_example" title="Permalink to this headline">¶</a></h2>
|
||||
<p>Example for writing logging information to the console and a
|
||||
log file.</p>
|
||||
<p>Example Usage:</p>
|
||||
|
|
@ -280,64 +286,82 @@ to write content to STDOUT uninterrupted. Additionally, you can
|
|||
set different logging levels for the two handlers - generally you
|
||||
keep debugging information in the log file while writing more
|
||||
critical messages to the console in STDERR.</p>
|
||||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="k">def</span> <span class="nf">setup_logging</span><span class="p">():</span>
|
||||
<span class="sd">"""Function to setup logging configuration and test it."""</span>
|
||||
<span class="c1"># Allow us to modify the `logger` variable within a function</span>
|
||||
<span class="k">global</span> <span class="n">logger</span>
|
||||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="k">def</span> <span class="nf">setup_logging</span><span class="p">(</span><span class="n">logging_obj</span><span class="p">,</span> <span class="n">verbose</span><span class="o">=</span><span class="kc">False</span><span class="p">):</span>
|
||||
<span class="sd">"""Function to setup logging configuration and test it.</span>
|
||||
|
||||
<span class="c1"># Set logger object, uses module's name</span>
|
||||
<span class="n">logger</span> <span class="o">=</span> <span class="n">logging</span><span class="o">.</span><span class="n">getLogger</span><span class="p">(</span><span class="n">name</span><span class="o">=</span><span class="vm">__name__</span><span class="p">)</span>
|
||||
<span class="sd"> Args:</span>
|
||||
<span class="sd"> logging_obj: A logging instance, returned from logging.getLogger().</span>
|
||||
<span class="sd"> verbose: Whether or not to enable the debug level in STDERR output.</span>
|
||||
|
||||
<span class="c1"># Set default logger level to DEBUG. You can change this later</span>
|
||||
<span class="n">logger</span><span class="o">.</span><span class="n">setLevel</span><span class="p">(</span><span class="n">logging</span><span class="o">.</span><span class="n">DEBUG</span><span class="p">)</span>
|
||||
<span class="sd"> Examples:</span>
|
||||
<span class="sd"> >>> sample_logger = logging.getLogger(name=__name__)</span>
|
||||
<span class="sd"> >>> sample_logger = setup_logging(sample_logger)</span>
|
||||
<span class="sd"> >>> sample_logger.debug("This is a debug message")</span>
|
||||
<span class="sd"> >>> sample_logger.info("This is an info message")</span>
|
||||
<span class="sd"> >>> sample_logger.warning("This is a warning message")</span>
|
||||
<span class="sd"> >>> sample_logger.error("This is a error message")</span>
|
||||
<span class="sd"> >>> sample_logger.critical("This is a critical message")</span>
|
||||
<span class="sd"> """</span>
|
||||
<span class="n">logging_obj</span><span class="o">.</span><span class="n">setLevel</span><span class="p">(</span><span class="n">logging</span><span class="o">.</span><span class="n">DEBUG</span><span class="p">)</span>
|
||||
|
||||
<span class="c1"># Logging formatter. Best to keep consistent for most usecases</span>
|
||||
<span class="c1"># Logging formatter. Best to keep consistent for most use cases</span>
|
||||
<span class="n">log_format</span> <span class="o">=</span> <span class="n">logging</span><span class="o">.</span><span class="n">Formatter</span><span class="p">(</span>
|
||||
<span class="s1">'</span><span class="si">%(asctime)s</span><span class="s1"> </span><span class="si">%(filename)s</span><span class="s1"> </span><span class="si">%(levelname)s</span><span class="s1"> </span><span class="si">%(module)s</span><span class="s1"> '</span>
|
||||
<span class="s1">'</span><span class="si">%(funcName)s</span><span class="s1"> </span><span class="si">%(lineno)d</span><span class="s1"> </span><span class="si">%(message)s</span><span class="s1">'</span><span class="p">)</span>
|
||||
<span class="s2">"</span><span class="si">%(asctime)s</span><span class="s2"> </span><span class="si">%(filename)s</span><span class="s2"> </span><span class="si">%(levelname)s</span><span class="s2"> </span><span class="si">%(module)s</span><span class="s2"> "</span>
|
||||
<span class="s2">"</span><span class="si">%(funcName)s</span><span class="s2"> </span><span class="si">%(lineno)d</span><span class="s2"> </span><span class="si">%(message)s</span><span class="s2">"</span>
|
||||
<span class="p">)</span>
|
||||
|
||||
<span class="c1"># Setup STDERR logging, allowing you uninterrupted</span>
|
||||
<span class="c1"># STDOUT redirection</span>
|
||||
<span class="n">stderr_handle</span> <span class="o">=</span> <span class="n">logging</span><span class="o">.</span><span class="n">StreamHandler</span><span class="p">(</span><span class="n">stream</span><span class="o">=</span><span class="n">sys</span><span class="o">.</span><span class="n">stderr</span><span class="p">)</span>
|
||||
<span class="n">stderr_handle</span><span class="o">.</span><span class="n">setLevel</span><span class="p">(</span><span class="n">logging</span><span class="o">.</span><span class="n">INFO</span><span class="p">)</span>
|
||||
<span class="k">if</span> <span class="n">verbose</span><span class="p">:</span>
|
||||
<span class="n">stderr_handle</span><span class="o">.</span><span class="n">setLevel</span><span class="p">(</span><span class="n">logging</span><span class="o">.</span><span class="n">DEBUG</span><span class="p">)</span>
|
||||
<span class="k">else</span><span class="p">:</span>
|
||||
<span class="n">stderr_handle</span><span class="o">.</span><span class="n">setLevel</span><span class="p">(</span><span class="n">logging</span><span class="o">.</span><span class="n">INFO</span><span class="p">)</span>
|
||||
<span class="n">stderr_handle</span><span class="o">.</span><span class="n">setFormatter</span><span class="p">(</span><span class="n">log_format</span><span class="p">)</span>
|
||||
|
||||
<span class="c1"># Setup file logging</span>
|
||||
<span class="n">file_handle</span> <span class="o">=</span> <span class="n">logging</span><span class="o">.</span><span class="n">FileHandler</span><span class="p">(</span><span class="s1">'sample.log'</span><span class="p">,</span> <span class="s1">'a'</span><span class="p">)</span>
|
||||
<span class="n">file_handle</span> <span class="o">=</span> <span class="n">logging</span><span class="o">.</span><span class="n">FileHandler</span><span class="p">(</span><span class="s2">"sample.log"</span><span class="p">,</span> <span class="s2">"a"</span><span class="p">)</span>
|
||||
<span class="n">file_handle</span><span class="o">.</span><span class="n">setLevel</span><span class="p">(</span><span class="n">logging</span><span class="o">.</span><span class="n">DEBUG</span><span class="p">)</span>
|
||||
<span class="n">file_handle</span><span class="o">.</span><span class="n">setFormatter</span><span class="p">(</span><span class="n">log_format</span><span class="p">)</span>
|
||||
|
||||
<span class="c1"># Add handles</span>
|
||||
<span class="n">logger</span><span class="o">.</span><span class="n">addHandler</span><span class="p">(</span><span class="n">stderr_handle</span><span class="p">)</span>
|
||||
<span class="n">logger</span><span class="o">.</span><span class="n">addHandler</span><span class="p">(</span><span class="n">file_handle</span><span class="p">)</span>
|
||||
<span class="n">logging_obj</span><span class="o">.</span><span class="n">addHandler</span><span class="p">(</span><span class="n">stderr_handle</span><span class="p">)</span>
|
||||
<span class="n">logging_obj</span><span class="o">.</span><span class="n">addHandler</span><span class="p">(</span><span class="n">file_handle</span><span class="p">)</span>
|
||||
|
||||
<span class="c1"># Sample log messages</span>
|
||||
<span class="n">logger</span><span class="o">.</span><span class="n">debug</span><span class="p">(</span><span class="s2">"This is a debug message"</span><span class="p">)</span>
|
||||
<span class="n">logger</span><span class="o">.</span><span class="n">info</span><span class="p">(</span><span class="s2">"This is an info message"</span><span class="p">)</span>
|
||||
<span class="n">logger</span><span class="o">.</span><span class="n">warning</span><span class="p">(</span><span class="s2">"This is a warning message"</span><span class="p">)</span>
|
||||
<span class="n">logger</span><span class="o">.</span><span class="n">error</span><span class="p">(</span><span class="s2">"This is a error message"</span><span class="p">)</span>
|
||||
<span class="n">logger</span><span class="o">.</span><span class="n">critical</span><span class="p">(</span><span class="s2">"This is a critical message"</span><span class="p">)</span>
|
||||
|
||||
<span class="k">def</span> <span class="nf">sample_function</span><span class="p">():</span>
|
||||
<span class="sd">"""Sample function to demonstrate logging formatting."""</span>
|
||||
<span class="n">logger</span><span class="o">.</span><span class="n">info</span><span class="p">(</span><span class="s2">"Called from a function"</span><span class="p">)</span>
|
||||
|
||||
<span class="n">sample_function</span><span class="p">()</span>
|
||||
<span class="k">return</span> <span class="n">logging_obj</span>
|
||||
</pre></div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="section" id="docstring-references">
|
||||
<h3>Docstring References<a class="headerlink" href="#docstring-references" title="Permalink to this headline">¶</a></h3>
|
||||
<dl class="py function">
|
||||
<dt id="pyforhandbook.section_01.logging_example.setup_logging">
|
||||
<code class="sig-name descname">setup_logging</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.section_01.logging_example.setup_logging" title="Permalink to this definition">¶</a></dt>
|
||||
<dt id="pyforhandbook.ch01_essentials.logging_example.setup_logging">
|
||||
<code class="sig-name descname">setup_logging</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">logging_obj</span></em>, <em class="sig-param"><span class="n">verbose</span><span class="o">=</span><span class="default_value">False</span></em><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.ch01_essentials.logging_example.setup_logging" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>Function to setup logging configuration and test it.</p>
|
||||
<dl class="field-list simple">
|
||||
<dt class="field-odd">Parameters</dt>
|
||||
<dd class="field-odd"><ul class="simple">
|
||||
<li><p><strong>logging_obj</strong> – A logging instance, returned from logging.getLogger().</p></li>
|
||||
<li><p><strong>verbose</strong> – Whether or not to enable the debug level in STDERR output.</p></li>
|
||||
</ul>
|
||||
</dd>
|
||||
</dl>
|
||||
<p class="rubric">Examples</p>
|
||||
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">>>> </span><span class="n">sample_logger</span> <span class="o">=</span> <span class="n">logging</span><span class="o">.</span><span class="n">getLogger</span><span class="p">(</span><span class="n">name</span><span class="o">=</span><span class="vm">__name__</span><span class="p">)</span>
|
||||
<span class="gp">>>> </span><span class="n">sample_logger</span> <span class="o">=</span> <span class="n">setup_logging</span><span class="p">(</span><span class="n">sample_logger</span><span class="p">)</span>
|
||||
<span class="gp">>>> </span><span class="n">sample_logger</span><span class="o">.</span><span class="n">debug</span><span class="p">(</span><span class="s2">"This is a debug message"</span><span class="p">)</span>
|
||||
<span class="gp">>>> </span><span class="n">sample_logger</span><span class="o">.</span><span class="n">info</span><span class="p">(</span><span class="s2">"This is an info message"</span><span class="p">)</span>
|
||||
<span class="gp">>>> </span><span class="n">sample_logger</span><span class="o">.</span><span class="n">warning</span><span class="p">(</span><span class="s2">"This is a warning message"</span><span class="p">)</span>
|
||||
<span class="gp">>>> </span><span class="n">sample_logger</span><span class="o">.</span><span class="n">error</span><span class="p">(</span><span class="s2">"This is a error message"</span><span class="p">)</span>
|
||||
<span class="gp">>>> </span><span class="n">sample_logger</span><span class="o">.</span><span class="n">critical</span><span class="p">(</span><span class="s2">"This is a critical message"</span><span class="p">)</span>
|
||||
</pre></div>
|
||||
</div>
|
||||
</dd></dl>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
<div class="section" id="module-pyforhandbook.section_01.open_files">
|
||||
<span id="section-1-3-open-files"></span><h2>Section 1.3 - Open Files<a class="headerlink" href="#module-pyforhandbook.section_01.open_files" title="Permalink to this headline">¶</a></h2>
|
||||
<div class="section" id="module-pyforhandbook.ch01_essentials.open_files">
|
||||
<span id="section-1-3-open-files"></span><h2>Section 1.3 - Open Files<a class="headerlink" href="#module-pyforhandbook.ch01_essentials.open_files" title="Permalink to this headline">¶</a></h2>
|
||||
<p>Example for reading data from encoded text files.</p>
|
||||
<p>Demonstrates how to handle setting the proper encoding for
|
||||
UTF-8, UTF-16-LE, and UTF-16-BE with the ability to easily
|
||||
|
|
@ -364,18 +388,17 @@ common text file encodings. Feel free to build and share on this.</p>
|
|||
<span class="sd"> input_file (str): Path to file to open</span>
|
||||
<span class="sd"> """</span>
|
||||
|
||||
<span class="n">test_encoding</span> <span class="o">=</span> <span class="nb">open</span><span class="p">(</span><span class="n">input_file</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span>
|
||||
<span class="n">test_encoding</span> <span class="o">=</span> <span class="nb">open</span><span class="p">(</span><span class="n">input_file</span><span class="p">,</span> <span class="s2">"rb"</span><span class="p">)</span>
|
||||
<span class="n">bom</span> <span class="o">=</span> <span class="n">test_encoding</span><span class="o">.</span><span class="n">read</span><span class="p">(</span><span class="mi">2</span><span class="p">)</span>
|
||||
<span class="n">file_encoding</span> <span class="o">=</span> <span class="s1">'utf-8'</span>
|
||||
<span class="k">if</span> <span class="n">bom</span> <span class="o">==</span> <span class="sa">b</span><span class="s1">'FEFF'</span><span class="p">:</span>
|
||||
<span class="n">file_encoding</span> <span class="o">=</span> <span class="s1">'utf-16-le'</span>
|
||||
<span class="k">elif</span> <span class="n">bom</span> <span class="o">==</span> <span class="sa">b</span><span class="s1">'FFFE'</span><span class="p">:</span>
|
||||
<span class="n">file_encoding</span> <span class="o">=</span> <span class="s1">'utf-16-be'</span>
|
||||
<span class="n">file_encoding</span> <span class="o">=</span> <span class="s2">"utf-8"</span>
|
||||
<span class="k">if</span> <span class="n">bom</span> <span class="o">==</span> <span class="sa">b</span><span class="s2">"FEFF"</span><span class="p">:</span>
|
||||
<span class="n">file_encoding</span> <span class="o">=</span> <span class="s2">"utf-16-le"</span>
|
||||
<span class="k">elif</span> <span class="n">bom</span> <span class="o">==</span> <span class="sa">b</span><span class="s2">"FFFE"</span><span class="p">:</span>
|
||||
<span class="n">file_encoding</span> <span class="o">=</span> <span class="s2">"utf-16-be"</span>
|
||||
|
||||
<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">input_file</span><span class="p">,</span> <span class="s1">'r'</span><span class="p">,</span> <span class="n">encoding</span><span class="o">=</span><span class="n">file_encoding</span><span class="p">)</span> <span class="k">as</span> <span class="n">fopen</span><span class="p">:</span>
|
||||
<span class="k">for</span> <span class="n">raw_line</span> <span class="ow">in</span> <span class="n">fopen</span><span class="p">:</span>
|
||||
<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">input_file</span><span class="p">,</span> <span class="s2">"r"</span><span class="p">,</span> <span class="n">encoding</span><span class="o">=</span><span class="n">file_encoding</span><span class="p">)</span> <span class="k">as</span> <span class="n">open_input_file</span><span class="p">:</span>
|
||||
<span class="k">for</span> <span class="n">raw_line</span> <span class="ow">in</span> <span class="n">open_input_file</span><span class="p">:</span>
|
||||
<span class="n">line</span> <span class="o">=</span> <span class="n">raw_line</span><span class="o">.</span><span class="n">strip</span><span class="p">()</span>
|
||||
|
||||
<span class="nb">print</span><span class="p">(</span><span class="n">line</span><span class="p">)</span>
|
||||
</pre></div>
|
||||
</div>
|
||||
|
|
@ -383,8 +406,8 @@ common text file encodings. Feel free to build and share on this.</p>
|
|||
<div class="section" id="id1">
|
||||
<h3>Docstring References<a class="headerlink" href="#id1" title="Permalink to this headline">¶</a></h3>
|
||||
<dl class="py function">
|
||||
<dt id="pyforhandbook.section_01.open_files.open_file">
|
||||
<code class="sig-name descname">open_file</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">input_file</span></em><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.section_01.open_files.open_file" title="Permalink to this definition">¶</a></dt>
|
||||
<dt id="pyforhandbook.ch01_essentials.open_files.open_file">
|
||||
<code class="sig-name descname">open_file</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">input_file</span></em><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.ch01_essentials.open_files.open_file" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>Opens an encoded text file and prints the contents</p>
|
||||
<dl class="field-list simple">
|
||||
<dt class="field-odd">Parameters</dt>
|
||||
|
|
@ -395,8 +418,8 @@ common text file encodings. Feel free to build and share on this.</p>
|
|||
|
||||
</div>
|
||||
</div>
|
||||
<div class="section" id="module-pyforhandbook.section_01.csv_example">
|
||||
<span id="section-1-4-csv-example"></span><h2>Section 1.4 - CSV Example<a class="headerlink" href="#module-pyforhandbook.section_01.csv_example" title="Permalink to this headline">¶</a></h2>
|
||||
<div class="section" id="module-pyforhandbook.ch01_essentials.csv_example">
|
||||
<span id="section-1-4-csv-example"></span><h2>Section 1.4 - CSV Example<a class="headerlink" href="#module-pyforhandbook.ch01_essentials.csv_example" title="Permalink to this headline">¶</a></h2>
|
||||
<p>Example for writing datasets into CSV files.</p>
|
||||
<p>Demonstrates source datasets comprised of lists of dictionaries
|
||||
and lists of lists as separate functions. Example data is
|
||||
|
|
@ -424,7 +447,7 @@ multiple dictionaries to a CSV file. You can optionally provide
|
|||
an ordered list of headers to filter what rows to show, or let the
|
||||
function use the keys of the first dictionary in the list to
|
||||
generate the header information. The latter option may produce
|
||||
a new order each iteration and is not prefered if you can
|
||||
a new order each iteration and is not preferred if you can
|
||||
determine the headers in advance.</p>
|
||||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="k">def</span> <span class="nf">write_csv_dicts</span><span class="p">(</span><span class="n">outfile</span><span class="p">,</span> <span class="n">data</span><span class="p">,</span> <span class="n">headers</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
|
||||
<span class="sd">"""Writes a list of dictionaries to a CSV file.</span>
|
||||
|
|
@ -434,18 +457,24 @@ determine the headers in advance.</p>
|
|||
<span class="sd"> data (list): List of dictionaries to write to file</span>
|
||||
<span class="sd"> headers (list): Header row to use. If empty, will use the</span>
|
||||
<span class="sd"> first dictionary in the `data` list.</span>
|
||||
|
||||
<span class="sd"> Example:</span>
|
||||
<span class="sd"> >>> list_of_dicts = [</span>
|
||||
<span class="sd"> >>> {'name': 'apple', 'quantity': 10, 'location': 'VT'},</span>
|
||||
<span class="sd"> >>> {'name': 'orange', 'quantity': 5, 'location': 'FL'}</span>
|
||||
<span class="sd"> >>> ]</span>
|
||||
<span class="sd"> >>> write_csv_dicts('dict_test.csv', list_of_dicts)</span>
|
||||
<span class="sd"> """</span>
|
||||
|
||||
<span class="k">if</span> <span class="ow">not</span> <span class="n">headers</span><span class="p">:</span>
|
||||
<span class="c1"># Use the first line of data</span>
|
||||
<span class="n">headers</span> <span class="o">=</span> <span class="p">[</span><span class="nb">str</span><span class="p">(</span><span class="n">x</span><span class="p">)</span> <span class="k">for</span> <span class="n">x</span> <span class="ow">in</span> <span class="n">data</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">keys</span><span class="p">()]</span>
|
||||
|
||||
<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">outfile</span><span class="p">,</span> <span class="s1">'w'</span><span class="p">,</span> <span class="n">newline</span><span class="o">=</span><span class="s2">""</span><span class="p">)</span> <span class="k">as</span> <span class="n">open_file</span><span class="p">:</span>
|
||||
<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">outfile</span><span class="p">,</span> <span class="s2">"w"</span><span class="p">,</span> <span class="n">newline</span><span class="o">=</span><span class="s2">""</span><span class="p">)</span> <span class="k">as</span> <span class="n">open_file</span><span class="p">:</span>
|
||||
<span class="c1"># Write only provided headers, ignore others</span>
|
||||
<span class="n">csvfile</span> <span class="o">=</span> <span class="n">csv</span><span class="o">.</span><span class="n">DictWriter</span><span class="p">(</span><span class="n">open_file</span><span class="p">,</span> <span class="n">headers</span><span class="p">,</span>
|
||||
<span class="n">extrasaction</span><span class="o">=</span><span class="s1">'ignore'</span><span class="p">)</span>
|
||||
<span class="n">csvfile</span><span class="o">.</span><span class="n">writeheader</span><span class="p">()</span>
|
||||
<span class="n">csvfile</span><span class="o">.</span><span class="n">writerows</span><span class="p">(</span><span class="n">data</span><span class="p">)</span>
|
||||
<span class="n">csv_file</span> <span class="o">=</span> <span class="n">csv</span><span class="o">.</span><span class="n">DictWriter</span><span class="p">(</span><span class="n">open_file</span><span class="p">,</span> <span class="n">headers</span><span class="p">,</span> <span class="n">extrasaction</span><span class="o">=</span><span class="s2">"ignore"</span><span class="p">)</span>
|
||||
<span class="n">csv_file</span><span class="o">.</span><span class="n">writeheader</span><span class="p">()</span>
|
||||
<span class="n">csv_file</span><span class="o">.</span><span class="n">writerows</span><span class="p">(</span><span class="n">data</span><span class="p">)</span>
|
||||
</pre></div>
|
||||
</div>
|
||||
</div>
|
||||
|
|
@ -474,25 +503,33 @@ columns to the CSV.</p>
|
|||
<span class="sd"> data (list): List of lists to write to file</span>
|
||||
<span class="sd"> headers (list): Header row to use. If empty, will use the</span>
|
||||
<span class="sd"> first list in the `data` list.</span>
|
||||
|
||||
<span class="sd"> Examples:</span>
|
||||
<span class="sd"> >>> fields = ['name', 'quantity', 'location']</span>
|
||||
<span class="sd"> >>> list_of_lists = [</span>
|
||||
<span class="sd"> >>> ['apple', 10, 'VT'],</span>
|
||||
<span class="sd"> >>> ['orange', 5, 'FL']</span>
|
||||
<span class="sd"> >>> ]</span>
|
||||
<span class="sd"> >>> write_csv_lists('list_test.csv', list_of_lists, headers=fields)</span>
|
||||
<span class="sd"> """</span>
|
||||
|
||||
<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">outfile</span><span class="p">,</span> <span class="s1">'w'</span><span class="p">,</span> <span class="n">newline</span><span class="o">=</span><span class="s2">""</span><span class="p">)</span> <span class="k">as</span> <span class="n">open_file</span><span class="p">:</span>
|
||||
<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">outfile</span><span class="p">,</span> <span class="s2">"w"</span><span class="p">,</span> <span class="n">newline</span><span class="o">=</span><span class="s2">""</span><span class="p">)</span> <span class="k">as</span> <span class="n">open_file</span><span class="p">:</span>
|
||||
<span class="c1"># Write only provided headers, ignore others</span>
|
||||
<span class="n">csvfile</span> <span class="o">=</span> <span class="n">csv</span><span class="o">.</span><span class="n">writer</span><span class="p">(</span><span class="n">open_file</span><span class="p">)</span>
|
||||
<span class="n">csv_file</span> <span class="o">=</span> <span class="n">csv</span><span class="o">.</span><span class="n">writer</span><span class="p">(</span><span class="n">open_file</span><span class="p">)</span>
|
||||
<span class="k">for</span> <span class="n">count</span><span class="p">,</span> <span class="n">entry</span> <span class="ow">in</span> <span class="nb">enumerate</span><span class="p">(</span><span class="n">data</span><span class="p">):</span>
|
||||
<span class="k">if</span> <span class="n">count</span> <span class="o">==</span> <span class="mi">0</span> <span class="ow">and</span> <span class="n">headers</span><span class="p">:</span>
|
||||
<span class="c1"># If headers are defined, write them, otherwise</span>
|
||||
<span class="c1"># continue as they will be written anyways</span>
|
||||
<span class="n">csvfile</span><span class="o">.</span><span class="n">writerow</span><span class="p">(</span><span class="n">headers</span><span class="p">)</span>
|
||||
<span class="n">csvfile</span><span class="o">.</span><span class="n">writerow</span><span class="p">(</span><span class="n">entry</span><span class="p">)</span>
|
||||
<span class="n">csv_file</span><span class="o">.</span><span class="n">writerow</span><span class="p">(</span><span class="n">headers</span><span class="p">)</span>
|
||||
<span class="n">csv_file</span><span class="o">.</span><span class="n">writerow</span><span class="p">(</span><span class="n">entry</span><span class="p">)</span>
|
||||
</pre></div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="section" id="id2">
|
||||
<h3>Docstring References<a class="headerlink" href="#id2" title="Permalink to this headline">¶</a></h3>
|
||||
<dl class="py function">
|
||||
<dt id="pyforhandbook.section_01.csv_example.write_csv_dicts">
|
||||
<code class="sig-name descname">write_csv_dicts</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">outfile</span></em>, <em class="sig-param"><span class="n">data</span></em>, <em class="sig-param"><span class="n">headers</span><span class="o">=</span><span class="default_value">None</span></em><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.section_01.csv_example.write_csv_dicts" title="Permalink to this definition">¶</a></dt>
|
||||
<dt id="pyforhandbook.ch01_essentials.csv_example.write_csv_dicts">
|
||||
<code class="sig-name descname">write_csv_dicts</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">outfile</span></em>, <em class="sig-param"><span class="n">data</span></em>, <em class="sig-param"><span class="n">headers</span><span class="o">=</span><span class="default_value">None</span></em><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.ch01_essentials.csv_example.write_csv_dicts" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>Writes a list of dictionaries to a CSV file.</p>
|
||||
<dl class="field-list simple">
|
||||
<dt class="field-odd">Parameters</dt>
|
||||
|
|
@ -504,11 +541,19 @@ first dictionary in the <cite>data</cite> list.</p></li>
|
|||
</ul>
|
||||
</dd>
|
||||
</dl>
|
||||
<p class="rubric">Example</p>
|
||||
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">>>> </span><span class="n">list_of_dicts</span> <span class="o">=</span> <span class="p">[</span>
|
||||
<span class="gp">>>> </span> <span class="p">{</span><span class="s1">'name'</span><span class="p">:</span> <span class="s1">'apple'</span><span class="p">,</span> <span class="s1">'quantity'</span><span class="p">:</span> <span class="mi">10</span><span class="p">,</span> <span class="s1">'location'</span><span class="p">:</span> <span class="s1">'VT'</span><span class="p">},</span>
|
||||
<span class="gp">>>> </span> <span class="p">{</span><span class="s1">'name'</span><span class="p">:</span> <span class="s1">'orange'</span><span class="p">,</span> <span class="s1">'quantity'</span><span class="p">:</span> <span class="mi">5</span><span class="p">,</span> <span class="s1">'location'</span><span class="p">:</span> <span class="s1">'FL'</span><span class="p">}</span>
|
||||
<span class="gp">>>> </span><span class="p">]</span>
|
||||
<span class="gp">>>> </span><span class="n">write_csv_dicts</span><span class="p">(</span><span class="s1">'dict_test.csv'</span><span class="p">,</span> <span class="n">list_of_dicts</span><span class="p">)</span>
|
||||
</pre></div>
|
||||
</div>
|
||||
</dd></dl>
|
||||
|
||||
<dl class="py function">
|
||||
<dt id="pyforhandbook.section_01.csv_example.write_csv_lists">
|
||||
<code class="sig-name descname">write_csv_lists</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">outfile</span></em>, <em class="sig-param"><span class="n">data</span></em>, <em class="sig-param"><span class="n">headers</span><span class="o">=</span><span class="default_value">None</span></em><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.section_01.csv_example.write_csv_lists" title="Permalink to this definition">¶</a></dt>
|
||||
<dt id="pyforhandbook.ch01_essentials.csv_example.write_csv_lists">
|
||||
<code class="sig-name descname">write_csv_lists</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">outfile</span></em>, <em class="sig-param"><span class="n">data</span></em>, <em class="sig-param"><span class="n">headers</span><span class="o">=</span><span class="default_value">None</span></em><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.ch01_essentials.csv_example.write_csv_lists" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>Writes a list of lists to a CSV file.</p>
|
||||
<dl class="field-list simple">
|
||||
<dt class="field-odd">Parameters</dt>
|
||||
|
|
@ -520,12 +565,21 @@ first list in the <cite>data</cite> list.</p></li>
|
|||
</ul>
|
||||
</dd>
|
||||
</dl>
|
||||
<p class="rubric">Examples</p>
|
||||
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">>>> </span><span class="n">fields</span> <span class="o">=</span> <span class="p">[</span><span class="s1">'name'</span><span class="p">,</span> <span class="s1">'quantity'</span><span class="p">,</span> <span class="s1">'location'</span><span class="p">]</span>
|
||||
<span class="gp">>>> </span><span class="n">list_of_lists</span> <span class="o">=</span> <span class="p">[</span>
|
||||
<span class="gp">>>> </span> <span class="p">[</span><span class="s1">'apple'</span><span class="p">,</span> <span class="mi">10</span><span class="p">,</span> <span class="s1">'VT'</span><span class="p">],</span>
|
||||
<span class="gp">>>> </span> <span class="p">[</span><span class="s1">'orange'</span><span class="p">,</span> <span class="mi">5</span><span class="p">,</span> <span class="s1">'FL'</span><span class="p">]</span>
|
||||
<span class="gp">>>> </span><span class="p">]</span>
|
||||
<span class="gp">>>> </span><span class="n">write_csv_lists</span><span class="p">(</span><span class="s1">'list_test.csv'</span><span class="p">,</span> <span class="n">list_of_lists</span><span class="p">,</span> <span class="n">headers</span><span class="o">=</span><span class="n">fields</span><span class="p">)</span>
|
||||
</pre></div>
|
||||
</div>
|
||||
</dd></dl>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
<div class="section" id="module-pyforhandbook.section_01.recursion_example">
|
||||
<span id="section-1-5-directory-recursion"></span><h2>Section 1.5 - Directory Recursion<a class="headerlink" href="#module-pyforhandbook.section_01.recursion_example" title="Permalink to this headline">¶</a></h2>
|
||||
<div class="section" id="module-pyforhandbook.ch01_essentials.recursion_example">
|
||||
<span id="section-1-5-directory-recursion"></span><h2>Section 1.5 - Directory Recursion<a class="headerlink" href="#module-pyforhandbook.ch01_essentials.recursion_example" title="Permalink to this headline">¶</a></h2>
|
||||
<p>File recursion example.</p>
|
||||
<p>Demonstration of iterating through a directory to interact with
|
||||
files.</p>
|
||||
|
|
@ -544,7 +598,16 @@ folders within a single directory. From here you can further
|
|||
interact with individual files and folders or iterate recursively
|
||||
by calling the function on identified subdirectories.</p>
|
||||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="k">def</span> <span class="nf">list_directory</span><span class="p">(</span><span class="n">path</span><span class="p">):</span>
|
||||
<span class="sd">"""List all file and folder entries in `path`."""</span>
|
||||
<span class="sd">"""List all file and folder entries in `path`.</span>
|
||||
|
||||
<span class="sd"> Args:</span>
|
||||
<span class="sd"> path (str): A directory within a mounted file system. May be relative or</span>
|
||||
<span class="sd"> absolute.</span>
|
||||
|
||||
<span class="sd"> Examples:</span>
|
||||
<span class="sd"> >>> list_directory('.')</span>
|
||||
|
||||
<span class="sd"> """</span>
|
||||
<span class="nb">print</span><span class="p">(</span><span class="sa">f</span><span class="s2">"Files and folders in '</span><span class="si">{</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="n">path</span><span class="p">)</span><span class="si">}</span><span class="s2">':"</span><span class="p">)</span>
|
||||
<span class="c1"># Quick and easy method for listing items within a single</span>
|
||||
<span class="c1"># folder.</span>
|
||||
|
|
@ -564,6 +627,21 @@ handling the processing of files. This sample shows a method of
|
|||
counting the number of files, subdirectories, and files ending in
|
||||
“.py” as an example.</p>
|
||||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="k">def</span> <span class="nf">iterate_files</span><span class="p">(</span><span class="n">path</span><span class="p">):</span>
|
||||
<span class="sd">"""Recursively iterate over a path, findings all files within the folder</span>
|
||||
<span class="sd"> and its subdirectories.</span>
|
||||
|
||||
<span class="sd"> Args:</span>
|
||||
<span class="sd"> path (str): A directory within a mounted file system. May be relative or</span>
|
||||
<span class="sd"> absolute.</span>
|
||||
|
||||
<span class="sd"> Examples:</span>
|
||||
<span class="sd"> >>> number_of_py_files = 0</span>
|
||||
<span class="sd"> >>> for f in iterate_files('../'):</span>
|
||||
<span class="sd"> ... if f.endswith('.py'):</span>
|
||||
<span class="sd"> ... number_of_py_files += 1</span>
|
||||
<span class="sd"> >>> print(f"\t{number_of_py_files} python files found "</span>
|
||||
<span class="sd"> ... f"in {os.path.abspath('../')}")</span>
|
||||
<span class="sd"> """</span>
|
||||
<span class="c1"># Though `os.walk()` exposes a list of directories in the</span>
|
||||
<span class="c1"># current `root`, it is rarely used since we are generally</span>
|
||||
<span class="c1"># interested in the files found within the subdirectories.</span>
|
||||
|
|
@ -572,19 +650,50 @@ counting the number of files, subdirectories, and files ending in
|
|||
<span class="k">for</span> <span class="n">root</span><span class="p">,</span> <span class="n">dirs</span><span class="p">,</span> <span class="n">files</span> <span class="ow">in</span> <span class="n">os</span><span class="o">.</span><span class="n">walk</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="n">path</span><span class="p">)):</span>
|
||||
<span class="c1"># Both `dirs` and `files` are lists containing all entries</span>
|
||||
<span class="c1"># at the current `root`.</span>
|
||||
<span class="k">for</span> <span class="n">fentry</span> <span class="ow">in</span> <span class="n">files</span><span class="p">:</span>
|
||||
<span class="k">for</span> <span class="n">file_name</span> <span class="ow">in</span> <span class="n">files</span><span class="p">:</span>
|
||||
<span class="c1"># To effectively reference a file, you should include</span>
|
||||
<span class="c1"># the below line which creates a full path reference</span>
|
||||
<span class="c1"># to the specific file, regardless of how nested it is</span>
|
||||
<span class="n">file_entry</span> <span class="o">=</span> <span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">root</span><span class="p">,</span> <span class="n">fentry</span><span class="p">)</span>
|
||||
<span class="c1"># We can then hand `file_entry` off to other functions.</span>
|
||||
<span class="k">yield</span> <span class="n">file_entry</span>
|
||||
<span class="k">yield</span> <span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">root</span><span class="p">,</span> <span class="n">file_name</span><span class="p">)</span>
|
||||
</pre></div>
|
||||
</div>
|
||||
<dl class="py function">
|
||||
<dt id="pyforhandbook.section_01.recursion_example.list_directory">
|
||||
<code class="sig-name descname">list_directory</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">path</span></em><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.section_01.recursion_example.list_directory" title="Permalink to this definition">¶</a></dt>
|
||||
<dt id="pyforhandbook.ch01_essentials.recursion_example.iterate_files">
|
||||
<code class="sig-name descname">iterate_files</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">path</span></em><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.ch01_essentials.recursion_example.iterate_files" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>Recursively iterate over a path, findings all files within the folder
|
||||
and its subdirectories.</p>
|
||||
<dl class="field-list simple">
|
||||
<dt class="field-odd">Parameters</dt>
|
||||
<dd class="field-odd"><p><strong>path</strong> (<em>str</em>) – A directory within a mounted file system. May be relative or
|
||||
absolute.</p>
|
||||
</dd>
|
||||
</dl>
|
||||
<p class="rubric">Examples</p>
|
||||
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">>>> </span><span class="n">number_of_py_files</span> <span class="o">=</span> <span class="mi">0</span>
|
||||
<span class="gp">>>> </span><span class="k">for</span> <span class="n">f</span> <span class="ow">in</span> <span class="n">iterate_files</span><span class="p">(</span><span class="s1">'../'</span><span class="p">):</span>
|
||||
<span class="gp">... </span> <span class="k">if</span> <span class="n">f</span><span class="o">.</span><span class="n">endswith</span><span class="p">(</span><span class="s1">'.py'</span><span class="p">):</span>
|
||||
<span class="gp">... </span> <span class="n">number_of_py_files</span> <span class="o">+=</span> <span class="mi">1</span>
|
||||
<span class="gp">>>> </span><span class="nb">print</span><span class="p">(</span><span class="sa">f</span><span class="s2">" </span><span class="si">{</span><span class="n">number_of_py_files</span><span class="si">}</span><span class="s2"> python files found "</span>
|
||||
<span class="gp">... </span> <span class="sa">f</span><span class="s2">"in </span><span class="si">{</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="s1">'../'</span><span class="p">)</span><span class="si">}</span><span class="s2">"</span><span class="p">)</span>
|
||||
</pre></div>
|
||||
</div>
|
||||
</dd></dl>
|
||||
|
||||
<dl class="py function">
|
||||
<dt id="pyforhandbook.ch01_essentials.recursion_example.list_directory">
|
||||
<code class="sig-name descname">list_directory</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">path</span></em><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.ch01_essentials.recursion_example.list_directory" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>List all file and folder entries in <cite>path</cite>.</p>
|
||||
<dl class="field-list simple">
|
||||
<dt class="field-odd">Parameters</dt>
|
||||
<dd class="field-odd"><p><strong>path</strong> (<em>str</em>) – A directory within a mounted file system. May be relative or
|
||||
absolute.</p>
|
||||
</dd>
|
||||
</dl>
|
||||
<p class="rubric">Examples</p>
|
||||
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">>>> </span><span class="n">list_directory</span><span class="p">(</span><span class="s1">'.'</span><span class="p">)</span>
|
||||
</pre></div>
|
||||
</div>
|
||||
</dd></dl>
|
||||
|
||||
</div>
|
||||
|
|
@ -607,7 +716,7 @@ counting the number of files, subdirectories, and files ending in
|
|||
|
||||
<div class="rst-footer-buttons" role="navigation" aria-label="footer navigation">
|
||||
|
||||
<a href="section2.html" class="btn btn-neutral float-right" title="Section 2 - Registry Parsing" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right"></span></a>
|
||||
<a href="ch02_registry.html" class="btn btn-neutral float-right" title="Chapter 2 - Registry Parsing" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right"></span></a>
|
||||
|
||||
|
||||
<a href="index.html" class="btn btn-neutral float-left" title="The Python Forensics Handbook" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left"></span> Previous</a>
|
||||
|
|
@ -7,7 +7,7 @@
|
|||
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
|
||||
<title>Section 2 - Registry Parsing — Python Forensics Handbook 0.1.0 documentation</title>
|
||||
<title>Chapter 2 - Registry Parsing — Python Forensics Handbook 0.1.1 documentation</title>
|
||||
|
||||
|
||||
|
||||
|
|
@ -36,8 +36,8 @@
|
|||
|
||||
<link rel="index" title="Index" href="genindex.html" />
|
||||
<link rel="search" title="Search" href="search.html" />
|
||||
<link rel="next" title="Section 3 - Windows Event Log Parsing" href="section3.html" />
|
||||
<link rel="prev" title="Section 1 - Essential Scripts" href="section1.html" />
|
||||
<link rel="next" title="Chapter 3 - Windows Event Log Parsing" href="ch03_event_logs.html" />
|
||||
<link rel="prev" title="Chapter 1 - Essential Scripts" href="ch01_essentials.html" />
|
||||
|
||||
<!-- Global site tag (gtag.js) - Google Analytics -->
|
||||
<script async src="https://www.googletagmanager.com/gtag/js?id=UA-17386833-12"></script>
|
||||
|
|
@ -72,7 +72,7 @@
|
|||
|
||||
|
||||
<div class="version">
|
||||
0.1.0
|
||||
0.1.1
|
||||
</div>
|
||||
|
||||
|
||||
|
|
@ -99,14 +99,14 @@
|
|||
|
||||
<p class="caption"><span class="caption-text">Table of Contents:</span></p>
|
||||
<ul class="current">
|
||||
<li class="toctree-l1"><a class="reference internal" href="section1.html">Section 1 - Essential Scripts</a></li>
|
||||
<li class="toctree-l1 current"><a class="current reference internal" href="#">Section 2 - Registry Parsing</a><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-pyforhandbook.section_02.yarp_base">Section 2.1 - Opening a Hive</a><ul>
|
||||
<li class="toctree-l1"><a class="reference internal" href="ch01_essentials.html">Chapter 1 - Essential Scripts</a></li>
|
||||
<li class="toctree-l1 current"><a class="current reference internal" href="#">Chapter 2 - Registry Parsing</a><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-pyforhandbook.ch02_registry.yarp_base">Section 2.1 - Opening a Hive</a><ul>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#opening-a-registry-hive">Opening a Registry Hive</a></li>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#docstring-references">Docstring References</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-pyforhandbook.section_02.yarp_ntuser">Section 2.2 - Parsing Hive Values</a><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-pyforhandbook.ch02_registry.yarp_ntuser">Section 2.2 - Parsing Hive Values</a><ul>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#creating-a-hive-specific-parser">Creating a Hive Specific Parser</a></li>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#reading-hive-string-values">Reading Hive String Values</a></li>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#reading-hive-binary-values">Reading Hive Binary Values</a></li>
|
||||
|
|
@ -116,8 +116,8 @@
|
|||
<li class="toctree-l2"><a class="reference internal" href="#indices-and-tables">Indices and tables</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="section3.html">Section 3 - Windows Event Log Parsing</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="section6.html">Section 6 - Sqlite & MacOS/Mobile/Browsers</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="ch03_event_logs.html">Chapter 3 - Windows Event Log Parsing</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="ch06_databases.html">Chapter 6 - Sqlite & MacOS/Mobile/Browsers</a></li>
|
||||
</ul>
|
||||
|
||||
|
||||
|
|
@ -164,13 +164,13 @@
|
|||
|
||||
<li><a href="index.html" class="icon icon-home"></a> »</li>
|
||||
|
||||
<li>Section 2 - Registry Parsing</li>
|
||||
<li>Chapter 2 - Registry Parsing</li>
|
||||
|
||||
|
||||
<li class="wy-breadcrumbs-aside">
|
||||
|
||||
|
||||
<a href="_sources/section2.rst.txt" rel="nofollow"> View page source</a>
|
||||
<a href="_sources/ch02_registry.rst.txt" rel="nofollow"> View page source</a>
|
||||
|
||||
|
||||
</li>
|
||||
|
|
@ -183,12 +183,12 @@
|
|||
<div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
|
||||
<div itemprop="articleBody">
|
||||
|
||||
<div class="section" id="section-2-registry-parsing">
|
||||
<h1>Section 2 - Registry Parsing<a class="headerlink" href="#section-2-registry-parsing" title="Permalink to this headline">¶</a></h1>
|
||||
<div class="section" id="chapter-2-registry-parsing">
|
||||
<h1>Chapter 2 - Registry Parsing<a class="headerlink" href="#chapter-2-registry-parsing" title="Permalink to this headline">¶</a></h1>
|
||||
<div class="toctree-wrapper compound">
|
||||
</div>
|
||||
<div class="section" id="module-pyforhandbook.section_02.yarp_base">
|
||||
<span id="section-2-1-opening-a-hive"></span><h2>Section 2.1 - Opening a Hive<a class="headerlink" href="#module-pyforhandbook.section_02.yarp_base" title="Permalink to this headline">¶</a></h2>
|
||||
<div class="section" id="module-pyforhandbook.ch02_registry.yarp_base">
|
||||
<span id="section-2-1-opening-a-hive"></span><h2>Section 2.1 - Opening a Hive<a class="headerlink" href="#module-pyforhandbook.ch02_registry.yarp_base" title="Permalink to this headline">¶</a></h2>
|
||||
<p>Using the <cite>yarp</cite> library to open Windows registry hives using a class
|
||||
structure that is very portable and flexible.</p>
|
||||
<p>Example Usage:</p>
|
||||
|
|
@ -208,9 +208,10 @@ This library not only allows us to open a single offline hive, but also
|
|||
leverage any available transaction logs to include additional information
|
||||
otherwise available on the Window’s system. This class handles both the opening
|
||||
of the primary hive and attempted recovery of the transaction logs.</p>
|
||||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="k">class</span> <span class="nc">RegistryBase</span><span class="p">():</span>
|
||||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="k">class</span> <span class="nc">RegistryBase</span><span class="p">:</span>
|
||||
<span class="sd">"""Base class containing common registry parsing code. Will open a hive</span>
|
||||
<span class="sd"> and attempt recovery using available transaction logs"""</span>
|
||||
|
||||
<span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">reg_file</span><span class="p">):</span>
|
||||
<span class="sd">"""Base __init__ method, responsible for opening a hive."""</span>
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">reg_file</span> <span class="o">=</span> <span class="n">reg_file</span>
|
||||
|
|
@ -231,10 +232,10 @@ of the primary hive and attempted recovery of the transaction logs.</p>
|
|||
<span class="n">hive_path</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">hive</span><span class="o">.</span><span class="n">registry_file</span><span class="o">.</span><span class="n">file_object</span><span class="o">.</span><span class="n">name</span>
|
||||
<span class="n">tx_logs</span> <span class="o">=</span> <span class="n">RegistryHelpers</span><span class="o">.</span><span class="n">DiscoverLogFiles</span><span class="p">(</span><span class="n">hive_path</span><span class="p">)</span>
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">tx_log_files</span> <span class="o">=</span> <span class="p">[]</span>
|
||||
<span class="k">for</span> <span class="n">tx_path</span> <span class="ow">in</span> <span class="p">[</span><span class="s1">'log_path'</span><span class="p">,</span> <span class="s1">'log1_path'</span><span class="p">,</span> <span class="s1">'log2_path'</span><span class="p">]:</span>
|
||||
<span class="k">for</span> <span class="n">tx_path</span> <span class="ow">in</span> <span class="p">[</span><span class="s2">"log_path"</span><span class="p">,</span> <span class="s2">"log1_path"</span><span class="p">,</span> <span class="s2">"log2_path"</span><span class="p">]:</span>
|
||||
<span class="n">log_obj</span> <span class="o">=</span> <span class="kc">None</span>
|
||||
<span class="k">if</span> <span class="nb">getattr</span><span class="p">(</span><span class="n">tx_logs</span><span class="p">,</span> <span class="n">tx_path</span><span class="p">,</span> <span class="kc">None</span><span class="p">):</span>
|
||||
<span class="n">log_obj</span> <span class="o">=</span> <span class="nb">open</span><span class="p">(</span><span class="nb">getattr</span><span class="p">(</span><span class="n">tx_logs</span><span class="p">,</span> <span class="n">tx_path</span><span class="p">),</span> <span class="s1">'rb'</span><span class="p">)</span>
|
||||
<span class="n">log_obj</span> <span class="o">=</span> <span class="nb">open</span><span class="p">(</span><span class="nb">getattr</span><span class="p">(</span><span class="n">tx_logs</span><span class="p">,</span> <span class="n">tx_path</span><span class="p">),</span> <span class="s2">"rb"</span><span class="p">)</span>
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">tx_log_files</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">log_obj</span><span class="p">)</span>
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">hive</span><span class="o">.</span><span class="n">recover_auto</span><span class="p">(</span><span class="o">*</span><span class="bp">self</span><span class="o">.</span><span class="n">tx_log_files</span><span class="p">)</span>
|
||||
|
||||
|
|
@ -251,13 +252,13 @@ of the primary hive and attempted recovery of the transaction logs.</p>
|
|||
<div class="section" id="docstring-references">
|
||||
<h3>Docstring References<a class="headerlink" href="#docstring-references" title="Permalink to this headline">¶</a></h3>
|
||||
<dl class="py class">
|
||||
<dt id="pyforhandbook.section_02.yarp_base.RegistryBase">
|
||||
<em class="property">class </em><code class="sig-name descname">RegistryBase</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">reg_file</span></em><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.section_02.yarp_base.RegistryBase" title="Permalink to this definition">¶</a></dt>
|
||||
<dt id="pyforhandbook.ch02_registry.yarp_base.RegistryBase">
|
||||
<em class="property">class </em><code class="sig-name descname">RegistryBase</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">reg_file</span></em><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.ch02_registry.yarp_base.RegistryBase" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>Base class containing common registry parsing code. Will open a hive
|
||||
and attempt recovery using available transaction logs</p>
|
||||
<dl class="py method">
|
||||
<dt id="pyforhandbook.section_02.yarp_base.RegistryBase.close">
|
||||
<code class="sig-name descname">close</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.section_02.yarp_base.RegistryBase.close" title="Permalink to this definition">¶</a></dt>
|
||||
<dt id="pyforhandbook.ch02_registry.yarp_base.RegistryBase.close">
|
||||
<code class="sig-name descname">close</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.ch02_registry.yarp_base.RegistryBase.close" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>Properly close a hive.</p>
|
||||
</dd></dl>
|
||||
|
||||
|
|
@ -265,8 +266,8 @@ and attempt recovery using available transaction logs</p>
|
|||
|
||||
</div>
|
||||
</div>
|
||||
<div class="section" id="module-pyforhandbook.section_02.yarp_ntuser">
|
||||
<span id="section-2-2-parsing-hive-values"></span><h2>Section 2.2 - Parsing Hive Values<a class="headerlink" href="#module-pyforhandbook.section_02.yarp_ntuser" title="Permalink to this headline">¶</a></h2>
|
||||
<div class="section" id="module-pyforhandbook.ch02_registry.yarp_ntuser">
|
||||
<span id="section-2-2-parsing-hive-values"></span><h2>Section 2.2 - Parsing Hive Values<a class="headerlink" href="#module-pyforhandbook.ch02_registry.yarp_ntuser" title="Permalink to this headline">¶</a></h2>
|
||||
<p>Using the <cite>yarp</cite> library to parse NTUSER.DAT Windows registry hives
|
||||
using a class structure that is very portable and flexible. Parses the
|
||||
MountPoints2 and TrustRecords keys for with string and binary values.</p>
|
||||
|
|
@ -290,7 +291,7 @@ this class we store a few useful details including fixed values used by other
|
|||
methods and metadata about the class.</p>
|
||||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span> <span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">reg_path</span><span class="p">):</span>
|
||||
<span class="nb">super</span><span class="p">()</span><span class="o">.</span><span class="fm">__init__</span><span class="p">(</span><span class="n">reg_path</span><span class="p">)</span>
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">hive_type</span> <span class="o">=</span> <span class="s1">'NTUSER.DAT'</span>
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">hive_type</span> <span class="o">=</span> <span class="s2">"NTUSER.DAT"</span>
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">macro_enabled_val</span> <span class="o">=</span> <span class="mi">2147483647</span>
|
||||
</pre></div>
|
||||
</div>
|
||||
|
|
@ -299,21 +300,23 @@ methods and metadata about the class.</p>
|
|||
<h3>Reading Hive String Values<a class="headerlink" href="#reading-hive-string-values" title="Permalink to this headline">¶</a></h3>
|
||||
<p>With an open hive, we can begin to parse values from a known key location
|
||||
within the hive. This method allows us to specify a key path and inspect each
|
||||
of the subkeys. For each of the subkeys, we can then get the names and data
|
||||
of the sub-keys. For each of the sub-keys, we can then get the names and data
|
||||
associated with each value in the key. Additionally we could - if needed -
|
||||
continue to recurse on subkeys here. Instead we return this cursory information
|
||||
continue to recurse on sub-keys here. Instead we return this cursory information
|
||||
for the caller to display as they wish. Since the values within MountPoints2
|
||||
store string data, we don’t need to perform further parsing of the record.</p>
|
||||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span> <span class="k">def</span> <span class="nf">parse_mountpoints2</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span> <span class="k">def</span> <span class="nf">parse_mount_points2</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="sd">"""Demonstration of parsing values from a key by path."""</span>
|
||||
<span class="n">key_path</span> <span class="o">=</span> <span class="p">(</span><span class="s1">'Software</span><span class="se">\\</span><span class="s1">Microsoft</span><span class="se">\\</span><span class="s1">Windows</span><span class="se">\\</span><span class="s1">CurrentVersion'</span>
|
||||
<span class="s1">'</span><span class="se">\\</span><span class="s1">Explorer</span><span class="se">\\</span><span class="s1">MountPoints2'</span><span class="p">)</span>
|
||||
<span class="n">key_path</span> <span class="o">=</span> <span class="p">(</span>
|
||||
<span class="s2">"Software</span><span class="se">\\</span><span class="s2">Microsoft</span><span class="se">\\</span><span class="s2">Windows</span><span class="se">\\</span><span class="s2">CurrentVersion"</span>
|
||||
<span class="s2">"</span><span class="se">\\</span><span class="s2">Explorer</span><span class="se">\\</span><span class="s2">MountPoints2"</span>
|
||||
<span class="p">)</span>
|
||||
<span class="k">for</span> <span class="n">mp</span> <span class="ow">in</span> <span class="bp">self</span><span class="o">.</span><span class="n">hive</span><span class="o">.</span><span class="n">find_key</span><span class="p">(</span><span class="n">key_path</span><span class="p">)</span><span class="o">.</span><span class="n">subkeys</span><span class="p">():</span>
|
||||
<span class="n">mp_data</span> <span class="o">=</span> <span class="p">{}</span>
|
||||
<span class="n">mp_data</span><span class="p">[</span><span class="s1">'name'</span><span class="p">]</span> <span class="o">=</span> <span class="n">mp</span><span class="o">.</span><span class="n">name</span><span class="p">()</span><span class="o">.</span><span class="n">replace</span><span class="p">(</span><span class="s1">'#'</span><span class="p">,</span> <span class="s1">'</span><span class="se">\\</span><span class="s1">'</span><span class="p">)</span>
|
||||
<span class="n">mp_data</span><span class="p">[</span><span class="s1">'values'</span><span class="p">]</span> <span class="o">=</span> <span class="p">{</span><span class="n">x</span><span class="o">.</span><span class="n">name</span><span class="p">():</span> <span class="n">x</span><span class="o">.</span><span class="n">data</span><span class="p">()</span> <span class="k">for</span> <span class="n">x</span> <span class="ow">in</span> <span class="n">mp</span><span class="o">.</span><span class="n">values</span><span class="p">()}</span>
|
||||
<span class="n">mp_data</span><span class="p">[</span><span class="s1">'last_written'</span><span class="p">]</span> <span class="o">=</span> <span class="n">mp</span><span class="o">.</span><span class="n">last_written_timestamp</span><span class="p">()</span>
|
||||
<span class="k">yield</span> <span class="n">mp_data</span>
|
||||
<span class="k">yield</span> <span class="p">{</span>
|
||||
<span class="s2">"name"</span><span class="p">:</span> <span class="n">mp</span><span class="o">.</span><span class="n">name</span><span class="p">()</span><span class="o">.</span><span class="n">replace</span><span class="p">(</span><span class="s2">"#"</span><span class="p">,</span> <span class="s2">"</span><span class="se">\\</span><span class="s2">"</span><span class="p">),</span>
|
||||
<span class="s2">"values"</span><span class="p">:</span> <span class="p">{</span><span class="n">x</span><span class="o">.</span><span class="n">name</span><span class="p">():</span> <span class="n">x</span><span class="o">.</span><span class="n">data</span><span class="p">()</span> <span class="k">for</span> <span class="n">x</span> <span class="ow">in</span> <span class="n">mp</span><span class="o">.</span><span class="n">values</span><span class="p">()},</span>
|
||||
<span class="s2">"last_written"</span><span class="p">:</span> <span class="n">mp</span><span class="o">.</span><span class="n">last_written_timestamp</span><span class="p">(),</span>
|
||||
<span class="p">}</span>
|
||||
</pre></div>
|
||||
</div>
|
||||
</div>
|
||||
|
|
@ -327,24 +330,27 @@ If found, we then parse the binary data (retrieved with the same <cite>.data()</
|
|||
method) using Struct to extract a timestamp and integer marking whether a
|
||||
trusted macro was used. These parsed attributes are then returned to the caller
|
||||
to be displayed.</p>
|
||||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span> <span class="k">def</span> <span class="nf">parse_trustrecords</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span> <span class="k">def</span> <span class="nf">parse_trust_records</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="sd">"""Demonstration of parsing binary values within a key."""</span>
|
||||
<span class="n">trust_record_path</span> <span class="o">=</span> <span class="s1">'Software</span><span class="se">\\</span><span class="s1">Microsoft</span><span class="se">\\</span><span class="s1">Office</span><span class="se">\\</span><span class="si">{OFFICE_VERSION}</span><span class="s1">'</span> \
|
||||
<span class="s1">'</span><span class="se">\\</span><span class="s1">Word</span><span class="se">\\</span><span class="s1">Security</span><span class="se">\\</span><span class="s1">Trusted Documents</span><span class="se">\\</span><span class="s1">TrustRecords'</span>
|
||||
<span class="n">trust_record_path</span> <span class="o">=</span> <span class="p">(</span>
|
||||
<span class="s2">"Software</span><span class="se">\\</span><span class="s2">Microsoft</span><span class="se">\\</span><span class="s2">Office</span><span class="se">\\</span><span class="si">{OFFICE_VERSION}</span><span class="s2">"</span>
|
||||
<span class="s2">"</span><span class="se">\\</span><span class="s2">Word</span><span class="se">\\</span><span class="s2">Security</span><span class="se">\\</span><span class="s2">Trusted Documents</span><span class="se">\\</span><span class="s2">TrustRecords"</span>
|
||||
<span class="p">)</span>
|
||||
<span class="k">for</span> <span class="n">office_version</span> <span class="ow">in</span> <span class="bp">self</span><span class="o">.</span><span class="n">parse_office_versions</span><span class="p">():</span>
|
||||
<span class="n">trust_rec_key</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">hive</span><span class="o">.</span><span class="n">find_key</span><span class="p">(</span>
|
||||
<span class="n">trust_record_path</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">OFFICE_VERSION</span><span class="o">=</span><span class="n">office_version</span><span class="p">))</span>
|
||||
<span class="n">trust_record_path</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">OFFICE_VERSION</span><span class="o">=</span><span class="n">office_version</span><span class="p">)</span>
|
||||
<span class="p">)</span>
|
||||
<span class="k">if</span> <span class="ow">not</span> <span class="n">trust_rec_key</span><span class="p">:</span>
|
||||
<span class="k">continue</span>
|
||||
|
||||
<span class="k">for</span> <span class="n">rec</span> <span class="ow">in</span> <span class="n">trust_rec_key</span><span class="o">.</span><span class="n">values</span><span class="p">():</span>
|
||||
<span class="n">date_val</span><span class="p">,</span> <span class="n">macro_enabled</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s1">'q12xI'</span><span class="p">,</span> <span class="n">rec</span><span class="o">.</span><span class="n">data</span><span class="p">())</span>
|
||||
<span class="n">ms</span> <span class="o">=</span> <span class="n">date_val</span><span class="o">/</span><span class="mf">10.0</span>
|
||||
<span class="n">date_val</span><span class="p">,</span> <span class="n">macro_enabled</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">"q12xI"</span><span class="p">,</span> <span class="n">rec</span><span class="o">.</span><span class="n">data</span><span class="p">())</span>
|
||||
<span class="n">ms</span> <span class="o">=</span> <span class="n">date_val</span> <span class="o">/</span> <span class="mf">10.0</span>
|
||||
<span class="n">dt_date</span> <span class="o">=</span> <span class="n">datetime</span><span class="p">(</span><span class="mi">1601</span><span class="p">,</span> <span class="mi">1</span><span class="p">,</span> <span class="mi">1</span><span class="p">)</span> <span class="o">+</span> <span class="n">timedelta</span><span class="p">(</span><span class="n">microseconds</span><span class="o">=</span><span class="n">ms</span><span class="p">)</span>
|
||||
<span class="k">yield</span> <span class="p">{</span>
|
||||
<span class="s1">'doc'</span><span class="p">:</span> <span class="n">rec</span><span class="o">.</span><span class="n">name</span><span class="p">(),</span>
|
||||
<span class="s1">'dt'</span><span class="p">:</span> <span class="n">dt_date</span><span class="o">.</span><span class="n">isoformat</span><span class="p">(),</span>
|
||||
<span class="s1">'macro'</span><span class="p">:</span> <span class="n">macro_enabled</span> <span class="o">==</span> <span class="bp">self</span><span class="o">.</span><span class="n">macro_enabled_val</span>
|
||||
<span class="s2">"doc"</span><span class="p">:</span> <span class="n">rec</span><span class="o">.</span><span class="n">name</span><span class="p">(),</span>
|
||||
<span class="s2">"dt"</span><span class="p">:</span> <span class="n">dt_date</span><span class="o">.</span><span class="n">isoformat</span><span class="p">(),</span>
|
||||
<span class="s2">"macro"</span><span class="p">:</span> <span class="n">macro_enabled</span> <span class="o">==</span> <span class="bp">self</span><span class="o">.</span><span class="n">macro_enabled_val</span><span class="p">,</span>
|
||||
<span class="p">}</span>
|
||||
</pre></div>
|
||||
</div>
|
||||
|
|
@ -352,18 +358,18 @@ to be displayed.</p>
|
|||
<div class="section" id="id1">
|
||||
<h3>Docstring References<a class="headerlink" href="#id1" title="Permalink to this headline">¶</a></h3>
|
||||
<dl class="py class">
|
||||
<dt id="pyforhandbook.section_02.yarp_ntuser.NTUSER">
|
||||
<em class="property">class </em><code class="sig-name descname">NTUSER</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">reg_path</span></em><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.section_02.yarp_ntuser.NTUSER" title="Permalink to this definition">¶</a></dt>
|
||||
<dt id="pyforhandbook.ch02_registry.yarp_ntuser.NTUSER">
|
||||
<em class="property">class </em><code class="sig-name descname">NTUSER</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">reg_path</span></em><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.ch02_registry.yarp_ntuser.NTUSER" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>Class to handle the parsing of the NTUSER.DAT hive.</p>
|
||||
<dl class="py method">
|
||||
<dt id="pyforhandbook.section_02.yarp_ntuser.NTUSER.parse_mountpoints2">
|
||||
<code class="sig-name descname">parse_mountpoints2</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.section_02.yarp_ntuser.NTUSER.parse_mountpoints2" title="Permalink to this definition">¶</a></dt>
|
||||
<dt id="pyforhandbook.ch02_registry.yarp_ntuser.NTUSER.parse_mount_points2">
|
||||
<code class="sig-name descname">parse_mount_points2</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.ch02_registry.yarp_ntuser.NTUSER.parse_mount_points2" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>Demonstration of parsing values from a key by path.</p>
|
||||
</dd></dl>
|
||||
|
||||
<dl class="py method">
|
||||
<dt id="pyforhandbook.section_02.yarp_ntuser.NTUSER.parse_office_versions">
|
||||
<code class="sig-name descname">parse_office_versions</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.section_02.yarp_ntuser.NTUSER.parse_office_versions" title="Permalink to this definition">¶</a></dt>
|
||||
<dt id="pyforhandbook.ch02_registry.yarp_ntuser.NTUSER.parse_office_versions">
|
||||
<code class="sig-name descname">parse_office_versions</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.ch02_registry.yarp_ntuser.NTUSER.parse_office_versions" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>Get Office versions within an open Registry hive.</p>
|
||||
<dl class="field-list simple">
|
||||
<dt class="field-odd">Yields</dt>
|
||||
|
|
@ -373,8 +379,8 @@ to be displayed.</p>
|
|||
</dd></dl>
|
||||
|
||||
<dl class="py method">
|
||||
<dt id="pyforhandbook.section_02.yarp_ntuser.NTUSER.parse_trustrecords">
|
||||
<code class="sig-name descname">parse_trustrecords</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.section_02.yarp_ntuser.NTUSER.parse_trustrecords" title="Permalink to this definition">¶</a></dt>
|
||||
<dt id="pyforhandbook.ch02_registry.yarp_ntuser.NTUSER.parse_trust_records">
|
||||
<code class="sig-name descname">parse_trust_records</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.ch02_registry.yarp_ntuser.NTUSER.parse_trust_records" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>Demonstration of parsing binary values within a key.</p>
|
||||
</dd></dl>
|
||||
|
||||
|
|
@ -400,10 +406,10 @@ to be displayed.</p>
|
|||
|
||||
<div class="rst-footer-buttons" role="navigation" aria-label="footer navigation">
|
||||
|
||||
<a href="section3.html" class="btn btn-neutral float-right" title="Section 3 - Windows Event Log Parsing" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right"></span></a>
|
||||
<a href="ch03_event_logs.html" class="btn btn-neutral float-right" title="Chapter 3 - Windows Event Log Parsing" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right"></span></a>
|
||||
|
||||
|
||||
<a href="section1.html" class="btn btn-neutral float-left" title="Section 1 - Essential Scripts" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left"></span> Previous</a>
|
||||
<a href="ch01_essentials.html" class="btn btn-neutral float-left" title="Chapter 1 - Essential Scripts" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left"></span> Previous</a>
|
||||
|
||||
</div>
|
||||
|
||||
|
|
@ -7,7 +7,7 @@
|
|||
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
|
||||
<title>Section 3 - Windows Event Log Parsing — Python Forensics Handbook 0.1.0 documentation</title>
|
||||
<title>Chapter 3 - Windows Event Log Parsing — Python Forensics Handbook 0.1.1 documentation</title>
|
||||
|
||||
|
||||
|
||||
|
|
@ -36,8 +36,8 @@
|
|||
|
||||
<link rel="index" title="Index" href="genindex.html" />
|
||||
<link rel="search" title="Search" href="search.html" />
|
||||
<link rel="next" title="Section 6 - Sqlite & MacOS/Mobile/Browsers" href="section6.html" />
|
||||
<link rel="prev" title="Section 2 - Registry Parsing" href="section2.html" />
|
||||
<link rel="next" title="Chapter 6 - Sqlite & MacOS/Mobile/Browsers" href="ch06_databases.html" />
|
||||
<link rel="prev" title="Chapter 2 - Registry Parsing" href="ch02_registry.html" />
|
||||
|
||||
<!-- Global site tag (gtag.js) - Google Analytics -->
|
||||
<script async src="https://www.googletagmanager.com/gtag/js?id=UA-17386833-12"></script>
|
||||
|
|
@ -72,7 +72,7 @@
|
|||
|
||||
|
||||
<div class="version">
|
||||
0.1.0
|
||||
0.1.1
|
||||
</div>
|
||||
|
||||
|
||||
|
|
@ -99,10 +99,10 @@
|
|||
|
||||
<p class="caption"><span class="caption-text">Table of Contents:</span></p>
|
||||
<ul class="current">
|
||||
<li class="toctree-l1"><a class="reference internal" href="section1.html">Section 1 - Essential Scripts</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="section2.html">Section 2 - Registry Parsing</a></li>
|
||||
<li class="toctree-l1 current"><a class="current reference internal" href="#">Section 3 - Windows Event Log Parsing</a><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-pyforhandbook.section_03.using_python_evtx">Section 3.1 - Using python-evtx</a><ul>
|
||||
<li class="toctree-l1"><a class="reference internal" href="ch01_essentials.html">Chapter 1 - Essential Scripts</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="ch02_registry.html">Chapter 2 - Registry Parsing</a></li>
|
||||
<li class="toctree-l1 current"><a class="current reference internal" href="#">Chapter 3 - Windows Event Log Parsing</a><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-pyforhandbook.ch03_event_logs.using_python_evtx">Section 3.1 - Using python-evtx</a><ul>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#open-windows-event-logs-evtx">Open Windows Event Logs (EVTX)</a></li>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#iterate-over-record-xml-data-evtx">Iterate over record XML data (EVTX)</a></li>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#filtering-records-within-events-logs">Filtering records within events logs</a></li>
|
||||
|
|
@ -112,7 +112,7 @@
|
|||
<li class="toctree-l2"><a class="reference internal" href="#indices-and-tables">Indices and tables</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="section6.html">Section 6 - Sqlite & MacOS/Mobile/Browsers</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="ch06_databases.html">Chapter 6 - Sqlite & MacOS/Mobile/Browsers</a></li>
|
||||
</ul>
|
||||
|
||||
|
||||
|
|
@ -159,13 +159,13 @@
|
|||
|
||||
<li><a href="index.html" class="icon icon-home"></a> »</li>
|
||||
|
||||
<li>Section 3 - Windows Event Log Parsing</li>
|
||||
<li>Chapter 3 - Windows Event Log Parsing</li>
|
||||
|
||||
|
||||
<li class="wy-breadcrumbs-aside">
|
||||
|
||||
|
||||
<a href="_sources/section3.rst.txt" rel="nofollow"> View page source</a>
|
||||
<a href="_sources/ch03_event_logs.rst.txt" rel="nofollow"> View page source</a>
|
||||
|
||||
|
||||
</li>
|
||||
|
|
@ -178,12 +178,12 @@
|
|||
<div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
|
||||
<div itemprop="articleBody">
|
||||
|
||||
<div class="section" id="section-3-windows-event-log-parsing">
|
||||
<h1>Section 3 - Windows Event Log Parsing<a class="headerlink" href="#section-3-windows-event-log-parsing" title="Permalink to this headline">¶</a></h1>
|
||||
<div class="section" id="chapter-3-windows-event-log-parsing">
|
||||
<h1>Chapter 3 - Windows Event Log Parsing<a class="headerlink" href="#chapter-3-windows-event-log-parsing" title="Permalink to this headline">¶</a></h1>
|
||||
<div class="toctree-wrapper compound">
|
||||
</div>
|
||||
<div class="section" id="module-pyforhandbook.section_03.using_python_evtx">
|
||||
<span id="section-3-1-using-python-evtx"></span><h2>Section 3.1 - Using python-evtx<a class="headerlink" href="#module-pyforhandbook.section_03.using_python_evtx" title="Permalink to this headline">¶</a></h2>
|
||||
<div class="section" id="module-pyforhandbook.ch03_event_logs.using_python_evtx">
|
||||
<span id="section-3-1-using-python-evtx"></span><h2>Section 3.1 - Using python-evtx<a class="headerlink" href="#module-pyforhandbook.ch03_event_logs.using_python_evtx" title="Permalink to this headline">¶</a></h2>
|
||||
<p>Example for opening EVTX files, iterating over events, and filtering events.</p>
|
||||
<p>Demonstrates how to open an EVTX file and get basic details about the event log.
|
||||
This section makes use of python-evtx, a python library for reading event log
|
||||
|
|
@ -220,13 +220,15 @@ header metadata parameters about the file.</p>
|
|||
|
||||
<span class="k">with</span> <span class="n">evtx</span><span class="o">.</span><span class="n">Evtx</span><span class="p">(</span><span class="n">input_file</span><span class="p">)</span> <span class="k">as</span> <span class="n">open_log</span><span class="p">:</span>
|
||||
<span class="n">header</span> <span class="o">=</span> <span class="n">open_log</span><span class="o">.</span><span class="n">get_file_header</span><span class="p">()</span>
|
||||
<span class="n">properties</span> <span class="o">=</span> <span class="n">OrderedDict</span><span class="p">([</span>
|
||||
<span class="p">(</span><span class="s1">'major_version'</span><span class="p">,</span> <span class="s1">'File version (major)'</span><span class="p">),</span>
|
||||
<span class="p">(</span><span class="s1">'minor_version'</span><span class="p">,</span> <span class="s1">'File version (minor)'</span><span class="p">),</span>
|
||||
<span class="p">(</span><span class="s1">'is_dirty'</span><span class="p">,</span> <span class="s1">'File is ditry'</span><span class="p">),</span>
|
||||
<span class="p">(</span><span class="s1">'is_full'</span><span class="p">,</span> <span class="s1">'File is full'</span><span class="p">),</span>
|
||||
<span class="p">(</span><span class="s1">'next_record_number'</span><span class="p">,</span> <span class="s1">'Next record number'</span><span class="p">)</span>
|
||||
<span class="p">])</span>
|
||||
<span class="n">properties</span> <span class="o">=</span> <span class="n">OrderedDict</span><span class="p">(</span>
|
||||
<span class="p">[</span>
|
||||
<span class="p">(</span><span class="s2">"major_version"</span><span class="p">,</span> <span class="s2">"File version (major)"</span><span class="p">),</span>
|
||||
<span class="p">(</span><span class="s2">"minor_version"</span><span class="p">,</span> <span class="s2">"File version (minor)"</span><span class="p">),</span>
|
||||
<span class="p">(</span><span class="s2">"is_dirty"</span><span class="p">,</span> <span class="s2">"File is dirty"</span><span class="p">),</span>
|
||||
<span class="p">(</span><span class="s2">"is_full"</span><span class="p">,</span> <span class="s2">"File is full"</span><span class="p">),</span>
|
||||
<span class="p">(</span><span class="s2">"next_record_number"</span><span class="p">,</span> <span class="s2">"Next record number"</span><span class="p">),</span>
|
||||
<span class="p">]</span>
|
||||
<span class="p">)</span>
|
||||
|
||||
<span class="k">for</span> <span class="n">key</span><span class="p">,</span> <span class="n">value</span> <span class="ow">in</span> <span class="n">properties</span><span class="o">.</span><span class="n">items</span><span class="p">():</span>
|
||||
<span class="nb">print</span><span class="p">(</span><span class="sa">f</span><span class="s2">"</span><span class="si">{</span><span class="n">value</span><span class="si">}</span><span class="s2">: </span><span class="si">{</span><span class="nb">getattr</span><span class="p">(</span><span class="n">header</span><span class="p">,</span> <span class="n">key</span><span class="p">)()</span><span class="si">}</span><span class="s2">"</span><span class="p">)</span>
|
||||
|
|
@ -270,7 +272,7 @@ object that you can interact with.</p>
|
|||
</div>
|
||||
<div class="section" id="filtering-records-within-events-logs">
|
||||
<h3>Filtering records within events logs<a class="headerlink" href="#filtering-records-within-events-logs" title="Permalink to this headline">¶</a></h3>
|
||||
<p>Now that we have <a class="reference internal" href="#pyforhandbook.section_03.using_python_evtx.get_events" title="pyforhandbook.section_03.using_python_evtx.get_events"><code class="xref py py-func docutils literal notranslate"><span class="pre">get_events()</span></code></a>, we can begin to perform operations on
|
||||
<p>Now that we have <a class="reference internal" href="#pyforhandbook.ch03_event_logs.using_python_evtx.get_events" title="pyforhandbook.ch03_event_logs.using_python_evtx.get_events"><code class="xref py py-func docutils literal notranslate"><span class="pre">get_events()</span></code></a>, we can begin to perform operations on
|
||||
the newly accessible data. In this function, we extract information from the
|
||||
LXML object, and use that to filter results based on Event ID and other fields
|
||||
within the results. You can easily extend this to support other fields,
|
||||
|
|
@ -320,10 +322,10 @@ then calculating the session durations</p></li>
|
|||
<span class="n">event_data</span> <span class="o">=</span> <span class="n">evt</span><span class="o">.</span><span class="n">find</span><span class="p">(</span><span class="s2">"EventData"</span><span class="p">,</span> <span class="n">evt</span><span class="o">.</span><span class="n">nsmap</span><span class="p">)</span>
|
||||
<span class="n">json_data</span> <span class="o">=</span> <span class="p">{}</span>
|
||||
<span class="k">for</span> <span class="n">data</span> <span class="ow">in</span> <span class="n">event_data</span><span class="o">.</span><span class="n">getchildren</span><span class="p">():</span>
|
||||
<span class="k">if</span> <span class="ow">not</span> <span class="n">fields</span> <span class="ow">or</span> <span class="n">data</span><span class="o">.</span><span class="n">attrib</span><span class="p">[</span><span class="s1">'Name'</span><span class="p">]</span> <span class="ow">in</span> <span class="n">fields</span><span class="p">:</span>
|
||||
<span class="k">if</span> <span class="ow">not</span> <span class="n">fields</span> <span class="ow">or</span> <span class="n">data</span><span class="o">.</span><span class="n">attrib</span><span class="p">[</span><span class="s2">"Name"</span><span class="p">]</span> <span class="ow">in</span> <span class="n">fields</span><span class="p">:</span>
|
||||
<span class="c1"># If we don't have a specified field filter list, print all</span>
|
||||
<span class="c1"># Otherwise filter for only those fields within the list</span>
|
||||
<span class="n">json_data</span><span class="p">[</span><span class="n">data</span><span class="o">.</span><span class="n">attrib</span><span class="p">[</span><span class="s1">'Name'</span><span class="p">]]</span> <span class="o">=</span> <span class="n">data</span><span class="o">.</span><span class="n">text</span>
|
||||
<span class="n">json_data</span><span class="p">[</span><span class="n">data</span><span class="o">.</span><span class="n">attrib</span><span class="p">[</span><span class="s2">"Name"</span><span class="p">]]</span> <span class="o">=</span> <span class="n">data</span><span class="o">.</span><span class="n">text</span>
|
||||
|
||||
<span class="k">yield</span> <span class="n">json_data</span>
|
||||
</pre></div>
|
||||
|
|
@ -332,8 +334,8 @@ then calculating the session durations</p></li>
|
|||
<div class="section" id="docstring-references">
|
||||
<h3>Docstring References<a class="headerlink" href="#docstring-references" title="Permalink to this headline">¶</a></h3>
|
||||
<dl class="py function">
|
||||
<dt id="pyforhandbook.section_03.using_python_evtx.filter_events_json">
|
||||
<code class="sig-name descname">filter_events_json</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">event_data</span></em>, <em class="sig-param"><span class="n">event_ids</span></em>, <em class="sig-param"><span class="n">fields</span><span class="o">=</span><span class="default_value">None</span></em><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.section_03.using_python_evtx.filter_events_json" title="Permalink to this definition">¶</a></dt>
|
||||
<dt id="pyforhandbook.ch03_event_logs.using_python_evtx.filter_events_json">
|
||||
<code class="sig-name descname">filter_events_json</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">event_data</span></em>, <em class="sig-param"><span class="n">event_ids</span></em>, <em class="sig-param"><span class="n">fields</span><span class="o">=</span><span class="default_value">None</span></em><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.ch03_event_logs.using_python_evtx.filter_events_json" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>Provide events where the event id is found within the provided list
|
||||
of event ids. If found, it will return a JSON formatted object per event.</p>
|
||||
<p>If a list of fields are provided, it will filter the resulting JSON event
|
||||
|
|
@ -342,7 +344,7 @@ object to contain only those fields.</p>
|
|||
<dt class="field-odd">Parameters</dt>
|
||||
<dd class="field-odd"><ul class="simple">
|
||||
<li><p><strong>event_data</strong> (<em>genertor</em>) – Iterable containing event data as XML. Preferably
|
||||
the result of the <a class="reference internal" href="#pyforhandbook.section_03.using_python_evtx.get_events" title="pyforhandbook.section_03.using_python_evtx.get_events"><code class="xref py py-func docutils literal notranslate"><span class="pre">get_events()</span></code></a> method.</p></li>
|
||||
the result of the <a class="reference internal" href="#pyforhandbook.ch03_event_logs.using_python_evtx.get_events" title="pyforhandbook.ch03_event_logs.using_python_evtx.get_events"><code class="xref py py-func docutils literal notranslate"><span class="pre">get_events()</span></code></a> method.</p></li>
|
||||
<li><p><strong>event_ids</strong> (<em>list</em>) – A list of event identifiers. Each element should be a
|
||||
string value, even though the identifier is an integer.</p></li>
|
||||
<li><p><strong>fields</strong> (<em>list</em>) – Collection of fields from the XML data to include in the
|
||||
|
|
@ -369,8 +371,8 @@ JSON output. Only supports top-level fields.</p></li>
|
|||
</dd></dl>
|
||||
|
||||
<dl class="py function">
|
||||
<dt id="pyforhandbook.section_03.using_python_evtx.get_events">
|
||||
<code class="sig-name descname">get_events</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">input_file</span></em>, <em class="sig-param"><span class="n">parse_xml</span><span class="o">=</span><span class="default_value">False</span></em><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.section_03.using_python_evtx.get_events" title="Permalink to this definition">¶</a></dt>
|
||||
<dt id="pyforhandbook.ch03_event_logs.using_python_evtx.get_events">
|
||||
<code class="sig-name descname">get_events</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">input_file</span></em>, <em class="sig-param"><span class="n">parse_xml</span><span class="o">=</span><span class="default_value">False</span></em><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.ch03_event_logs.using_python_evtx.get_events" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>Opens a Windows Event Log and returns XML information from
|
||||
the event record.</p>
|
||||
<dl class="field-list simple">
|
||||
|
|
@ -392,8 +394,8 @@ the event record.</p>
|
|||
</dd></dl>
|
||||
|
||||
<dl class="py function">
|
||||
<dt id="pyforhandbook.section_03.using_python_evtx.open_evtx">
|
||||
<code class="sig-name descname">open_evtx</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">input_file</span></em><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.section_03.using_python_evtx.open_evtx" title="Permalink to this definition">¶</a></dt>
|
||||
<dt id="pyforhandbook.ch03_event_logs.using_python_evtx.open_evtx">
|
||||
<code class="sig-name descname">open_evtx</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">input_file</span></em><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.ch03_event_logs.using_python_evtx.open_evtx" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>Opens a Windows Event Log and displays common log parameters.</p>
|
||||
<dl class="field-list simple">
|
||||
<dt class="field-odd">Parameters</dt>
|
||||
|
|
@ -431,10 +433,10 @@ the event record.</p>
|
|||
|
||||
<div class="rst-footer-buttons" role="navigation" aria-label="footer navigation">
|
||||
|
||||
<a href="section6.html" class="btn btn-neutral float-right" title="Section 6 - Sqlite & MacOS/Mobile/Browsers" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right"></span></a>
|
||||
<a href="ch06_databases.html" class="btn btn-neutral float-right" title="Chapter 6 - Sqlite & MacOS/Mobile/Browsers" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right"></span></a>
|
||||
|
||||
|
||||
<a href="section2.html" class="btn btn-neutral float-left" title="Section 2 - Registry Parsing" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left"></span> Previous</a>
|
||||
<a href="ch02_registry.html" class="btn btn-neutral float-left" title="Chapter 2 - Registry Parsing" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left"></span> Previous</a>
|
||||
|
||||
</div>
|
||||
|
||||
|
|
@ -7,7 +7,7 @@
|
|||
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
|
||||
<title>Section 6 - Sqlite & MacOS/Mobile/Browsers — Python Forensics Handbook 0.1.0 documentation</title>
|
||||
<title>Chapter 6 - Sqlite & MacOS/Mobile/Browsers — Python Forensics Handbook 0.1.1 documentation</title>
|
||||
|
||||
|
||||
|
||||
|
|
@ -36,7 +36,7 @@
|
|||
|
||||
<link rel="index" title="Index" href="genindex.html" />
|
||||
<link rel="search" title="Search" href="search.html" />
|
||||
<link rel="prev" title="Section 3 - Windows Event Log Parsing" href="section3.html" />
|
||||
<link rel="prev" title="Chapter 3 - Windows Event Log Parsing" href="ch03_event_logs.html" />
|
||||
|
||||
<!-- Global site tag (gtag.js) - Google Analytics -->
|
||||
<script async src="https://www.googletagmanager.com/gtag/js?id=UA-17386833-12"></script>
|
||||
|
|
@ -71,7 +71,7 @@
|
|||
|
||||
|
||||
<div class="version">
|
||||
0.1.0
|
||||
0.1.1
|
||||
</div>
|
||||
|
||||
|
||||
|
|
@ -98,11 +98,11 @@
|
|||
|
||||
<p class="caption"><span class="caption-text">Table of Contents:</span></p>
|
||||
<ul class="current">
|
||||
<li class="toctree-l1"><a class="reference internal" href="section1.html">Section 1 - Essential Scripts</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="section2.html">Section 2 - Registry Parsing</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="section3.html">Section 3 - Windows Event Log Parsing</a></li>
|
||||
<li class="toctree-l1 current"><a class="current reference internal" href="#">Section 6 - Sqlite & MacOS/Mobile/Browsers</a><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-pyforhandbook.section_06.opening_sqlite">Section 6.1 - Opening Sqlite</a><ul>
|
||||
<li class="toctree-l1"><a class="reference internal" href="ch01_essentials.html">Chapter 1 - Essential Scripts</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="ch02_registry.html">Chapter 2 - Registry Parsing</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="ch03_event_logs.html">Chapter 3 - Windows Event Log Parsing</a></li>
|
||||
<li class="toctree-l1 current"><a class="current reference internal" href="#">Chapter 6 - Sqlite & MacOS/Mobile/Browsers</a><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-pyforhandbook.ch06_databases.opening_sqlite">Section 6.1 - Opening Sqlite</a><ul>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#opening-sqlite-configuration">Opening Sqlite configuration</a></li>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#listing-tables-configuration">Listing Tables configuration</a></li>
|
||||
</ul>
|
||||
|
|
@ -156,13 +156,13 @@
|
|||
|
||||
<li><a href="index.html" class="icon icon-home"></a> »</li>
|
||||
|
||||
<li>Section 6 - Sqlite & MacOS/Mobile/Browsers</li>
|
||||
<li>Chapter 6 - Sqlite & MacOS/Mobile/Browsers</li>
|
||||
|
||||
|
||||
<li class="wy-breadcrumbs-aside">
|
||||
|
||||
|
||||
<a href="_sources/section6.rst.txt" rel="nofollow"> View page source</a>
|
||||
<a href="_sources/ch06_databases.rst.txt" rel="nofollow"> View page source</a>
|
||||
|
||||
|
||||
</li>
|
||||
|
|
@ -175,12 +175,12 @@
|
|||
<div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
|
||||
<div itemprop="articleBody">
|
||||
|
||||
<div class="section" id="section-6-sqlite-macos-mobile-browsers">
|
||||
<h1>Section 6 - Sqlite & MacOS/Mobile/Browsers<a class="headerlink" href="#section-6-sqlite-macos-mobile-browsers" title="Permalink to this headline">¶</a></h1>
|
||||
<div class="section" id="chapter-6-sqlite-macos-mobile-browsers">
|
||||
<h1>Chapter 6 - Sqlite & MacOS/Mobile/Browsers<a class="headerlink" href="#chapter-6-sqlite-macos-mobile-browsers" title="Permalink to this headline">¶</a></h1>
|
||||
<div class="toctree-wrapper compound">
|
||||
</div>
|
||||
<div class="section" id="module-pyforhandbook.section_06.opening_sqlite">
|
||||
<span id="section-6-1-opening-sqlite"></span><h2>Section 6.1 - Opening Sqlite<a class="headerlink" href="#module-pyforhandbook.section_06.opening_sqlite" title="Permalink to this headline">¶</a></h2>
|
||||
<div class="section" id="module-pyforhandbook.ch06_databases.opening_sqlite">
|
||||
<span id="section-6-1-opening-sqlite"></span><h2>Section 6.1 - Opening Sqlite<a class="headerlink" href="#module-pyforhandbook.ch06_databases.opening_sqlite" title="Permalink to this headline">¶</a></h2>
|
||||
<p>Example for opening and exploring Sqlite databases.</p>
|
||||
<p>Example Usage:</p>
|
||||
<blockquote>
|
||||
|
|
@ -197,25 +197,69 @@
|
|||
<p>This function shows an example of opening a Sqlite database with Python.
|
||||
Additional information regarding Sqlite modules can be
|
||||
seen at <a class="reference external" href="https://docs.python.org/3/library/sqlite3.html">https://docs.python.org/3/library/sqlite3.html</a>.</p>
|
||||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="k">def</span> <span class="nf">open_sqlite</span><span class="p">(</span><span class="n">inputdb</span><span class="p">):</span>
|
||||
<span class="nb">print</span><span class="p">(</span><span class="s2">"Provided Database: </span><span class="si">{}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">inputdb</span><span class="p">))</span>
|
||||
<span class="k">return</span> <span class="n">sqlite3</span><span class="o">.</span><span class="n">connect</span><span class="p">(</span><span class="n">inputdb</span><span class="p">)</span>
|
||||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="k">def</span> <span class="nf">open_sqlite</span><span class="p">(</span><span class="n">input_db</span><span class="p">):</span>
|
||||
<span class="sd">"""Open a SQLite database</span>
|
||||
|
||||
<span class="sd"> Args:</span>
|
||||
<span class="sd"> input_db: Path to a SQLite database to open</span>
|
||||
|
||||
<span class="sd"> Returns:</span>
|
||||
<span class="sd"> A connection to a SQLite database</span>
|
||||
<span class="sd"> """</span>
|
||||
<span class="nb">print</span><span class="p">(</span><span class="s2">"Provided Database: </span><span class="si">{}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">input_db</span><span class="p">))</span>
|
||||
<span class="k">return</span> <span class="n">sqlite3</span><span class="o">.</span><span class="n">connect</span><span class="p">(</span><span class="n">input_db</span><span class="p">)</span>
|
||||
</pre></div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="section" id="listing-tables-configuration">
|
||||
<h3>Listing Tables configuration<a class="headerlink" href="#listing-tables-configuration" title="Permalink to this headline">¶</a></h3>
|
||||
<p>This function shows an example of listing available tables in an opened Sqlite database.</p>
|
||||
<p>This function shows an example of listing available tables in an opened Sqlite
|
||||
database.</p>
|
||||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="k">def</span> <span class="nf">list_tables</span><span class="p">(</span><span class="n">conn</span><span class="p">):</span>
|
||||
<span class="sd">"""List all tables in a SQLite database</span>
|
||||
|
||||
<span class="sd"> Args:</span>
|
||||
<span class="sd"> conn: An open connection from a SQLite database</span>
|
||||
|
||||
<span class="sd"> Returns:</span>
|
||||
<span class="sd"> list: List of table names found in the database</span>
|
||||
<span class="sd"> """</span>
|
||||
<span class="n">cur</span> <span class="o">=</span> <span class="n">conn</span><span class="o">.</span><span class="n">cursor</span><span class="p">()</span>
|
||||
<span class="n">cur</span><span class="o">.</span><span class="n">execute</span><span class="p">(</span><span class="s2">"SELECT name FROM sqlite_master"</span><span class="p">)</span>
|
||||
<span class="n">table_list</span> <span class="o">=</span> <span class="p">[]</span>
|
||||
<span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="n">cur</span><span class="o">.</span><span class="n">fetchall</span><span class="p">():</span>
|
||||
<span class="n">table_list</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">i</span><span class="p">[</span><span class="mi">0</span><span class="p">])</span>
|
||||
|
||||
<span class="k">return</span> <span class="n">table_list</span>
|
||||
<span class="k">return</span> <span class="p">[</span><span class="n">i</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="n">cur</span><span class="o">.</span><span class="n">fetchall</span><span class="p">()]</span>
|
||||
</pre></div>
|
||||
</div>
|
||||
<dl class="py function">
|
||||
<dt id="pyforhandbook.ch06_databases.opening_sqlite.list_tables">
|
||||
<code class="sig-name descname">list_tables</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">conn</span></em><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.ch06_databases.opening_sqlite.list_tables" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>List all tables in a SQLite database</p>
|
||||
<dl class="field-list simple">
|
||||
<dt class="field-odd">Parameters</dt>
|
||||
<dd class="field-odd"><p><strong>conn</strong> – An open connection from a SQLite database</p>
|
||||
</dd>
|
||||
<dt class="field-even">Returns</dt>
|
||||
<dd class="field-even"><p>List of table names found in the database</p>
|
||||
</dd>
|
||||
<dt class="field-odd">Return type</dt>
|
||||
<dd class="field-odd"><p>list</p>
|
||||
</dd>
|
||||
</dl>
|
||||
</dd></dl>
|
||||
|
||||
<dl class="py function">
|
||||
<dt id="pyforhandbook.ch06_databases.opening_sqlite.open_sqlite">
|
||||
<code class="sig-name descname">open_sqlite</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">input_db</span></em><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.ch06_databases.opening_sqlite.open_sqlite" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>Open a SQLite database</p>
|
||||
<dl class="field-list simple">
|
||||
<dt class="field-odd">Parameters</dt>
|
||||
<dd class="field-odd"><p><strong>input_db</strong> – Path to a SQLite database to open</p>
|
||||
</dd>
|
||||
<dt class="field-even">Returns</dt>
|
||||
<dd class="field-even"><p>A connection to a SQLite database</p>
|
||||
</dd>
|
||||
</dl>
|
||||
</dd></dl>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
<div class="section" id="indices-and-tables">
|
||||
|
|
@ -237,7 +281,7 @@ seen at <a class="reference external" href="https://docs.python.org/3/library/sq
|
|||
<div class="rst-footer-buttons" role="navigation" aria-label="footer navigation">
|
||||
|
||||
|
||||
<a href="section3.html" class="btn btn-neutral float-left" title="Section 3 - Windows Event Log Parsing" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left"></span> Previous</a>
|
||||
<a href="ch03_event_logs.html" class="btn btn-neutral float-left" title="Chapter 3 - Windows Event Log Parsing" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left"></span> Previous</a>
|
||||
|
||||
</div>
|
||||
|
||||
109
genindex.html
109
genindex.html
|
|
@ -7,7 +7,7 @@
|
|||
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
|
||||
<title>Index — Python Forensics Handbook 0.1.0 documentation</title>
|
||||
<title>Index — Python Forensics Handbook 0.1.1 documentation</title>
|
||||
|
||||
|
||||
|
||||
|
|
@ -70,7 +70,7 @@
|
|||
|
||||
|
||||
<div class="version">
|
||||
0.1.0
|
||||
0.1.1
|
||||
</div>
|
||||
|
||||
|
||||
|
|
@ -97,10 +97,10 @@
|
|||
|
||||
<p class="caption"><span class="caption-text">Table of Contents:</span></p>
|
||||
<ul>
|
||||
<li class="toctree-l1"><a class="reference internal" href="section1.html">Section 1 - Essential Scripts</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="section2.html">Section 2 - Registry Parsing</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="section3.html">Section 3 - Windows Event Log Parsing</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="section6.html">Section 6 - Sqlite & MacOS/Mobile/Browsers</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="ch01_essentials.html">Chapter 1 - Essential Scripts</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="ch02_registry.html">Chapter 2 - Registry Parsing</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="ch03_event_logs.html">Chapter 3 - Windows Event Log Parsing</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="ch06_databases.html">Chapter 6 - Sqlite & MacOS/Mobile/Browsers</a></li>
|
||||
</ul>
|
||||
|
||||
|
||||
|
|
@ -171,6 +171,7 @@
|
|||
<a href="#C"><strong>C</strong></a>
|
||||
| <a href="#F"><strong>F</strong></a>
|
||||
| <a href="#G"><strong>G</strong></a>
|
||||
| <a href="#I"><strong>I</strong></a>
|
||||
| <a href="#L"><strong>L</strong></a>
|
||||
| <a href="#M"><strong>M</strong></a>
|
||||
| <a href="#N"><strong>N</strong></a>
|
||||
|
|
@ -184,7 +185,7 @@
|
|||
<h2 id="C">C</h2>
|
||||
<table style="width: 100%" class="indextable genindextable"><tr>
|
||||
<td style="width: 33%; vertical-align: top;"><ul>
|
||||
<li><a href="section2.html#pyforhandbook.section_02.yarp_base.RegistryBase.close">close() (RegistryBase method)</a>
|
||||
<li><a href="ch02_registry.html#pyforhandbook.ch02_registry.yarp_base.RegistryBase.close">close() (RegistryBase method)</a>
|
||||
</li>
|
||||
</ul></td>
|
||||
</tr></table>
|
||||
|
|
@ -192,7 +193,7 @@
|
|||
<h2 id="F">F</h2>
|
||||
<table style="width: 100%" class="indextable genindextable"><tr>
|
||||
<td style="width: 33%; vertical-align: top;"><ul>
|
||||
<li><a href="section3.html#pyforhandbook.section_03.using_python_evtx.filter_events_json">filter_events_json() (in module pyforhandbook.section_03.using_python_evtx)</a>
|
||||
<li><a href="ch03_event_logs.html#pyforhandbook.ch03_event_logs.using_python_evtx.filter_events_json">filter_events_json() (in module pyforhandbook.ch03_event_logs.using_python_evtx)</a>
|
||||
</li>
|
||||
</ul></td>
|
||||
</tr></table>
|
||||
|
|
@ -200,7 +201,15 @@
|
|||
<h2 id="G">G</h2>
|
||||
<table style="width: 100%" class="indextable genindextable"><tr>
|
||||
<td style="width: 33%; vertical-align: top;"><ul>
|
||||
<li><a href="section3.html#pyforhandbook.section_03.using_python_evtx.get_events">get_events() (in module pyforhandbook.section_03.using_python_evtx)</a>
|
||||
<li><a href="ch03_event_logs.html#pyforhandbook.ch03_event_logs.using_python_evtx.get_events">get_events() (in module pyforhandbook.ch03_event_logs.using_python_evtx)</a>
|
||||
</li>
|
||||
</ul></td>
|
||||
</tr></table>
|
||||
|
||||
<h2 id="I">I</h2>
|
||||
<table style="width: 100%" class="indextable genindextable"><tr>
|
||||
<td style="width: 33%; vertical-align: top;"><ul>
|
||||
<li><a href="ch01_essentials.html#pyforhandbook.ch01_essentials.recursion_example.iterate_files">iterate_files() (in module pyforhandbook.ch01_essentials.recursion_example)</a>
|
||||
</li>
|
||||
</ul></td>
|
||||
</tr></table>
|
||||
|
|
@ -208,7 +217,11 @@
|
|||
<h2 id="L">L</h2>
|
||||
<table style="width: 100%" class="indextable genindextable"><tr>
|
||||
<td style="width: 33%; vertical-align: top;"><ul>
|
||||
<li><a href="section1.html#pyforhandbook.section_01.recursion_example.list_directory">list_directory() (in module pyforhandbook.section_01.recursion_example)</a>
|
||||
<li><a href="ch01_essentials.html#pyforhandbook.ch01_essentials.recursion_example.list_directory">list_directory() (in module pyforhandbook.ch01_essentials.recursion_example)</a>
|
||||
</li>
|
||||
</ul></td>
|
||||
<td style="width: 33%; vertical-align: top;"><ul>
|
||||
<li><a href="ch06_databases.html#pyforhandbook.ch06_databases.opening_sqlite.list_tables">list_tables() (in module pyforhandbook.ch06_databases.opening_sqlite)</a>
|
||||
</li>
|
||||
</ul></td>
|
||||
</tr></table>
|
||||
|
|
@ -222,23 +235,23 @@
|
|||
<ul>
|
||||
<li><a href="index.html#module-pyforhandbook">pyforhandbook</a>
|
||||
</li>
|
||||
<li><a href="section1.html#module-pyforhandbook.section_01.argparse_example">pyforhandbook.section_01.argparse_example</a>
|
||||
<li><a href="ch01_essentials.html#module-pyforhandbook.ch01_essentials.argparse_example">pyforhandbook.ch01_essentials.argparse_example</a>
|
||||
</li>
|
||||
<li><a href="section1.html#module-pyforhandbook.section_01.csv_example">pyforhandbook.section_01.csv_example</a>
|
||||
<li><a href="ch01_essentials.html#module-pyforhandbook.ch01_essentials.csv_example">pyforhandbook.ch01_essentials.csv_example</a>
|
||||
</li>
|
||||
<li><a href="section1.html#module-pyforhandbook.section_01.logging_example">pyforhandbook.section_01.logging_example</a>
|
||||
<li><a href="ch01_essentials.html#module-pyforhandbook.ch01_essentials.logging_example">pyforhandbook.ch01_essentials.logging_example</a>
|
||||
</li>
|
||||
<li><a href="section1.html#module-pyforhandbook.section_01.open_files">pyforhandbook.section_01.open_files</a>
|
||||
<li><a href="ch01_essentials.html#module-pyforhandbook.ch01_essentials.open_files">pyforhandbook.ch01_essentials.open_files</a>
|
||||
</li>
|
||||
<li><a href="section1.html#module-pyforhandbook.section_01.recursion_example">pyforhandbook.section_01.recursion_example</a>
|
||||
<li><a href="ch01_essentials.html#module-pyforhandbook.ch01_essentials.recursion_example">pyforhandbook.ch01_essentials.recursion_example</a>
|
||||
</li>
|
||||
<li><a href="section2.html#module-pyforhandbook.section_02.yarp_base">pyforhandbook.section_02.yarp_base</a>
|
||||
<li><a href="ch02_registry.html#module-pyforhandbook.ch02_registry.yarp_base">pyforhandbook.ch02_registry.yarp_base</a>
|
||||
</li>
|
||||
<li><a href="section2.html#module-pyforhandbook.section_02.yarp_ntuser">pyforhandbook.section_02.yarp_ntuser</a>
|
||||
<li><a href="ch02_registry.html#module-pyforhandbook.ch02_registry.yarp_ntuser">pyforhandbook.ch02_registry.yarp_ntuser</a>
|
||||
</li>
|
||||
<li><a href="section3.html#module-pyforhandbook.section_03.using_python_evtx">pyforhandbook.section_03.using_python_evtx</a>
|
||||
<li><a href="ch03_event_logs.html#module-pyforhandbook.ch03_event_logs.using_python_evtx">pyforhandbook.ch03_event_logs.using_python_evtx</a>
|
||||
</li>
|
||||
<li><a href="section6.html#module-pyforhandbook.section_06.opening_sqlite">pyforhandbook.section_06.opening_sqlite</a>
|
||||
<li><a href="ch06_databases.html#module-pyforhandbook.ch06_databases.opening_sqlite">pyforhandbook.ch06_databases.opening_sqlite</a>
|
||||
</li>
|
||||
</ul></li>
|
||||
</ul></td>
|
||||
|
|
@ -247,7 +260,7 @@
|
|||
<h2 id="N">N</h2>
|
||||
<table style="width: 100%" class="indextable genindextable"><tr>
|
||||
<td style="width: 33%; vertical-align: top;"><ul>
|
||||
<li><a href="section2.html#pyforhandbook.section_02.yarp_ntuser.NTUSER">NTUSER (class in pyforhandbook.section_02.yarp_ntuser)</a>
|
||||
<li><a href="ch02_registry.html#pyforhandbook.ch02_registry.yarp_ntuser.NTUSER">NTUSER (class in pyforhandbook.ch02_registry.yarp_ntuser)</a>
|
||||
</li>
|
||||
</ul></td>
|
||||
</tr></table>
|
||||
|
|
@ -255,11 +268,13 @@
|
|||
<h2 id="O">O</h2>
|
||||
<table style="width: 100%" class="indextable genindextable"><tr>
|
||||
<td style="width: 33%; vertical-align: top;"><ul>
|
||||
<li><a href="section3.html#pyforhandbook.section_03.using_python_evtx.open_evtx">open_evtx() (in module pyforhandbook.section_03.using_python_evtx)</a>
|
||||
<li><a href="ch03_event_logs.html#pyforhandbook.ch03_event_logs.using_python_evtx.open_evtx">open_evtx() (in module pyforhandbook.ch03_event_logs.using_python_evtx)</a>
|
||||
</li>
|
||||
</ul></td>
|
||||
<td style="width: 33%; vertical-align: top;"><ul>
|
||||
<li><a href="section1.html#pyforhandbook.section_01.open_files.open_file">open_file() (in module pyforhandbook.section_01.open_files)</a>
|
||||
<li><a href="ch01_essentials.html#pyforhandbook.ch01_essentials.open_files.open_file">open_file() (in module pyforhandbook.ch01_essentials.open_files)</a>
|
||||
</li>
|
||||
<li><a href="ch06_databases.html#pyforhandbook.ch06_databases.opening_sqlite.open_sqlite">open_sqlite() (in module pyforhandbook.ch06_databases.opening_sqlite)</a>
|
||||
</li>
|
||||
</ul></td>
|
||||
</tr></table>
|
||||
|
|
@ -267,11 +282,11 @@
|
|||
<h2 id="P">P</h2>
|
||||
<table style="width: 100%" class="indextable genindextable"><tr>
|
||||
<td style="width: 33%; vertical-align: top;"><ul>
|
||||
<li><a href="section2.html#pyforhandbook.section_02.yarp_ntuser.NTUSER.parse_mountpoints2">parse_mountpoints2() (NTUSER method)</a>
|
||||
<li><a href="ch02_registry.html#pyforhandbook.ch02_registry.yarp_ntuser.NTUSER.parse_mount_points2">parse_mount_points2() (NTUSER method)</a>
|
||||
</li>
|
||||
<li><a href="section2.html#pyforhandbook.section_02.yarp_ntuser.NTUSER.parse_office_versions">parse_office_versions() (NTUSER method)</a>
|
||||
<li><a href="ch02_registry.html#pyforhandbook.ch02_registry.yarp_ntuser.NTUSER.parse_office_versions">parse_office_versions() (NTUSER method)</a>
|
||||
</li>
|
||||
<li><a href="section2.html#pyforhandbook.section_02.yarp_ntuser.NTUSER.parse_trustrecords">parse_trustrecords() (NTUSER method)</a>
|
||||
<li><a href="ch02_registry.html#pyforhandbook.ch02_registry.yarp_ntuser.NTUSER.parse_trust_records">parse_trust_records() (NTUSER method)</a>
|
||||
</li>
|
||||
<li>
|
||||
pyforhandbook
|
||||
|
|
@ -281,68 +296,68 @@
|
|||
</li>
|
||||
</ul></li>
|
||||
<li>
|
||||
pyforhandbook.section_01.argparse_example
|
||||
pyforhandbook.ch01_essentials.argparse_example
|
||||
|
||||
<ul>
|
||||
<li><a href="section1.html#module-pyforhandbook.section_01.argparse_example">module</a>
|
||||
<li><a href="ch01_essentials.html#module-pyforhandbook.ch01_essentials.argparse_example">module</a>
|
||||
</li>
|
||||
</ul></li>
|
||||
<li>
|
||||
pyforhandbook.section_01.csv_example
|
||||
pyforhandbook.ch01_essentials.csv_example
|
||||
|
||||
<ul>
|
||||
<li><a href="section1.html#module-pyforhandbook.section_01.csv_example">module</a>
|
||||
<li><a href="ch01_essentials.html#module-pyforhandbook.ch01_essentials.csv_example">module</a>
|
||||
</li>
|
||||
</ul></li>
|
||||
<li>
|
||||
pyforhandbook.section_01.logging_example
|
||||
pyforhandbook.ch01_essentials.logging_example
|
||||
|
||||
<ul>
|
||||
<li><a href="section1.html#module-pyforhandbook.section_01.logging_example">module</a>
|
||||
<li><a href="ch01_essentials.html#module-pyforhandbook.ch01_essentials.logging_example">module</a>
|
||||
</li>
|
||||
</ul></li>
|
||||
</ul></td>
|
||||
<td style="width: 33%; vertical-align: top;"><ul>
|
||||
<li>
|
||||
pyforhandbook.section_01.open_files
|
||||
pyforhandbook.ch01_essentials.open_files
|
||||
|
||||
<ul>
|
||||
<li><a href="section1.html#module-pyforhandbook.section_01.open_files">module</a>
|
||||
<li><a href="ch01_essentials.html#module-pyforhandbook.ch01_essentials.open_files">module</a>
|
||||
</li>
|
||||
</ul></li>
|
||||
<li>
|
||||
pyforhandbook.section_01.recursion_example
|
||||
pyforhandbook.ch01_essentials.recursion_example
|
||||
|
||||
<ul>
|
||||
<li><a href="section1.html#module-pyforhandbook.section_01.recursion_example">module</a>
|
||||
<li><a href="ch01_essentials.html#module-pyforhandbook.ch01_essentials.recursion_example">module</a>
|
||||
</li>
|
||||
</ul></li>
|
||||
<li>
|
||||
pyforhandbook.section_02.yarp_base
|
||||
pyforhandbook.ch02_registry.yarp_base
|
||||
|
||||
<ul>
|
||||
<li><a href="section2.html#module-pyforhandbook.section_02.yarp_base">module</a>
|
||||
<li><a href="ch02_registry.html#module-pyforhandbook.ch02_registry.yarp_base">module</a>
|
||||
</li>
|
||||
</ul></li>
|
||||
<li>
|
||||
pyforhandbook.section_02.yarp_ntuser
|
||||
pyforhandbook.ch02_registry.yarp_ntuser
|
||||
|
||||
<ul>
|
||||
<li><a href="section2.html#module-pyforhandbook.section_02.yarp_ntuser">module</a>
|
||||
<li><a href="ch02_registry.html#module-pyforhandbook.ch02_registry.yarp_ntuser">module</a>
|
||||
</li>
|
||||
</ul></li>
|
||||
<li>
|
||||
pyforhandbook.section_03.using_python_evtx
|
||||
pyforhandbook.ch03_event_logs.using_python_evtx
|
||||
|
||||
<ul>
|
||||
<li><a href="section3.html#module-pyforhandbook.section_03.using_python_evtx">module</a>
|
||||
<li><a href="ch03_event_logs.html#module-pyforhandbook.ch03_event_logs.using_python_evtx">module</a>
|
||||
</li>
|
||||
</ul></li>
|
||||
<li>
|
||||
pyforhandbook.section_06.opening_sqlite
|
||||
pyforhandbook.ch06_databases.opening_sqlite
|
||||
|
||||
<ul>
|
||||
<li><a href="section6.html#module-pyforhandbook.section_06.opening_sqlite">module</a>
|
||||
<li><a href="ch06_databases.html#module-pyforhandbook.ch06_databases.opening_sqlite">module</a>
|
||||
</li>
|
||||
</ul></li>
|
||||
</ul></td>
|
||||
|
|
@ -351,7 +366,7 @@
|
|||
<h2 id="R">R</h2>
|
||||
<table style="width: 100%" class="indextable genindextable"><tr>
|
||||
<td style="width: 33%; vertical-align: top;"><ul>
|
||||
<li><a href="section2.html#pyforhandbook.section_02.yarp_base.RegistryBase">RegistryBase (class in pyforhandbook.section_02.yarp_base)</a>
|
||||
<li><a href="ch02_registry.html#pyforhandbook.ch02_registry.yarp_base.RegistryBase">RegistryBase (class in pyforhandbook.ch02_registry.yarp_base)</a>
|
||||
</li>
|
||||
</ul></td>
|
||||
</tr></table>
|
||||
|
|
@ -359,7 +374,7 @@
|
|||
<h2 id="S">S</h2>
|
||||
<table style="width: 100%" class="indextable genindextable"><tr>
|
||||
<td style="width: 33%; vertical-align: top;"><ul>
|
||||
<li><a href="section1.html#pyforhandbook.section_01.logging_example.setup_logging">setup_logging() (in module pyforhandbook.section_01.logging_example)</a>
|
||||
<li><a href="ch01_essentials.html#pyforhandbook.ch01_essentials.logging_example.setup_logging">setup_logging() (in module pyforhandbook.ch01_essentials.logging_example)</a>
|
||||
</li>
|
||||
</ul></td>
|
||||
</tr></table>
|
||||
|
|
@ -367,11 +382,11 @@
|
|||
<h2 id="W">W</h2>
|
||||
<table style="width: 100%" class="indextable genindextable"><tr>
|
||||
<td style="width: 33%; vertical-align: top;"><ul>
|
||||
<li><a href="section1.html#pyforhandbook.section_01.csv_example.write_csv_dicts">write_csv_dicts() (in module pyforhandbook.section_01.csv_example)</a>
|
||||
<li><a href="ch01_essentials.html#pyforhandbook.ch01_essentials.csv_example.write_csv_dicts">write_csv_dicts() (in module pyforhandbook.ch01_essentials.csv_example)</a>
|
||||
</li>
|
||||
</ul></td>
|
||||
<td style="width: 33%; vertical-align: top;"><ul>
|
||||
<li><a href="section1.html#pyforhandbook.section_01.csv_example.write_csv_lists">write_csv_lists() (in module pyforhandbook.section_01.csv_example)</a>
|
||||
<li><a href="ch01_essentials.html#pyforhandbook.ch01_essentials.csv_example.write_csv_lists">write_csv_lists() (in module pyforhandbook.ch01_essentials.csv_example)</a>
|
||||
</li>
|
||||
</ul></td>
|
||||
</tr></table>
|
||||
|
|
|
|||
83
index.html
83
index.html
|
|
@ -7,7 +7,7 @@
|
|||
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
|
||||
<title>The Python Forensics Handbook — Python Forensics Handbook 0.1.0 documentation</title>
|
||||
<title>The Python Forensics Handbook — Python Forensics Handbook 0.1.1 documentation</title>
|
||||
|
||||
|
||||
|
||||
|
|
@ -36,7 +36,7 @@
|
|||
|
||||
<link rel="index" title="Index" href="genindex.html" />
|
||||
<link rel="search" title="Search" href="search.html" />
|
||||
<link rel="next" title="Section 1 - Essential Scripts" href="section1.html" />
|
||||
<link rel="next" title="Chapter 1 - Essential Scripts" href="ch01_essentials.html" />
|
||||
|
||||
<!-- Global site tag (gtag.js) - Google Analytics -->
|
||||
<script async src="https://www.googletagmanager.com/gtag/js?id=UA-17386833-12"></script>
|
||||
|
|
@ -71,7 +71,7 @@
|
|||
|
||||
|
||||
<div class="version">
|
||||
0.1.0
|
||||
0.1.1
|
||||
</div>
|
||||
|
||||
|
||||
|
|
@ -98,10 +98,10 @@
|
|||
|
||||
<p class="caption"><span class="caption-text">Table of Contents:</span></p>
|
||||
<ul>
|
||||
<li class="toctree-l1"><a class="reference internal" href="section1.html">Section 1 - Essential Scripts</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="section2.html">Section 2 - Registry Parsing</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="section3.html">Section 3 - Windows Event Log Parsing</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="section6.html">Section 6 - Sqlite & MacOS/Mobile/Browsers</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="ch01_essentials.html">Chapter 1 - Essential Scripts</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="ch02_registry.html">Chapter 2 - Registry Parsing</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="ch03_event_logs.html">Chapter 3 - Windows Event Log Parsing</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="ch06_databases.html">Chapter 6 - Sqlite & MacOS/Mobile/Browsers</a></li>
|
||||
</ul>
|
||||
|
||||
|
||||
|
|
@ -169,25 +169,28 @@
|
|||
|
||||
<div class="section" id="the-python-forensics-handbook">
|
||||
<h1>The Python Forensics Handbook<a class="headerlink" href="#the-python-forensics-handbook" title="Permalink to this headline">¶</a></h1>
|
||||
<div class="section" id="a-guide-for-developing-python-scripts-in-dfir">
|
||||
<h2>A guide for developing Python scripts in DFIR<a class="headerlink" href="#a-guide-for-developing-python-scripts-in-dfir" title="Permalink to this headline">¶</a></h2>
|
||||
<div class="section" id="a-reference-guide-for-developing-python-scripts-in-dfir">
|
||||
<h2>A reference guide for developing Python scripts in DFIR<a class="headerlink" href="#a-reference-guide-for-developing-python-scripts-in-dfir" title="Permalink to this headline">¶</a></h2>
|
||||
<div class="toctree-wrapper compound">
|
||||
<p class="caption"><span class="caption-text">Table of Contents:</span></p>
|
||||
<ul>
|
||||
<li class="toctree-l1"><a class="reference internal" href="section1.html">Section 1 - Essential Scripts</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="section2.html">Section 2 - Registry Parsing</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="section3.html">Section 3 - Windows Event Log Parsing</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="section6.html">Section 6 - Sqlite & MacOS/Mobile/Browsers</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="ch01_essentials.html">Chapter 1 - Essential Scripts</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="ch02_registry.html">Chapter 2 - Registry Parsing</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="ch03_event_logs.html">Chapter 3 - Windows Event Log Parsing</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="ch06_databases.html">Chapter 6 - Sqlite & MacOS/Mobile/Browsers</a></li>
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="section" id="module-pyforhandbook">
|
||||
<span id="handbook-sections"></span><h1>Handbook Sections<a class="headerlink" href="#module-pyforhandbook" title="Permalink to this headline">¶</a></h1>
|
||||
<div class="admonition note">
|
||||
<p class="admonition-title">Note</p>
|
||||
<p>IN DEVELOPMENT - More sections will release over the coming weeks/months/as
|
||||
time permits. Feel free to contribute as you have an idea or time to assist,
|
||||
otherwise stay tuned!</p>
|
||||
<p>This handbook has 7 sections covering common tasks for developing
|
||||
</div>
|
||||
<p>This handbook consists of 7 sections covering common tasks for developing
|
||||
Python scripts for use in DFIR. Each section contains short,
|
||||
portable code blocks that can drop into a new script with minimal
|
||||
tweaking. This way, you can quickly build out your custom script
|
||||
|
|
@ -200,8 +203,8 @@ worked well for you, even if a similar section already exists. This handbook
|
|||
is hosted on GitHub at <a class="reference external" href="https://github.com/chapinb/python-forensics-handbook">https://github.com/chapinb/python-forensics-handbook</a> and
|
||||
available to read online at <a class="reference external" href="https://chapinb.com/python-forensics-handbook">https://chapinb.com/python-forensics-handbook</a>.
|
||||
Please consider submitting a pull request with your additions!</p>
|
||||
<div class="section" id="section-1-essential-script-elements">
|
||||
<h2>Section 1 - Essential Script Elements<a class="headerlink" href="#section-1-essential-script-elements" title="Permalink to this headline">¶</a></h2>
|
||||
<div class="section" id="chapter-1-essential-script-elements">
|
||||
<h2>Chapter 1 - Essential Script Elements<a class="headerlink" href="#chapter-1-essential-script-elements" title="Permalink to this headline">¶</a></h2>
|
||||
<p>This chapter covers code blocks that are useful across scripts
|
||||
and are not DFIR specific, but solid practices to integrate into
|
||||
projects to allow for uniformity.</p>
|
||||
|
|
@ -254,8 +257,10 @@ nested files.</p></li>
|
|||
</li>
|
||||
</ul>
|
||||
</div>
|
||||
<div class="section" id="section-2-registry-hives-with-yarp">
|
||||
<h2>Section 2 - Registry Hives with YARP<a class="headerlink" href="#section-2-registry-hives-with-yarp" title="Permalink to this headline">¶</a></h2>
|
||||
<div class="section" id="chapter-2-registry-hives">
|
||||
<h2>Chapter 2 - Registry Hives<a class="headerlink" href="#chapter-2-registry-hives" title="Permalink to this headline">¶</a></h2>
|
||||
<p>In this chapter, we demonstrate how to open a registry hive, navigate through
|
||||
its keys, and interact with values to expose information for analysis.</p>
|
||||
<ul class="simple">
|
||||
<li><dl class="simple">
|
||||
<dt>Using yarp to open a single hive</dt><dd><ul>
|
||||
|
|
@ -283,8 +288,11 @@ needed with minimal effort.</p></li>
|
|||
</li>
|
||||
</ul>
|
||||
</div>
|
||||
<div class="section" id="section-3-event-logs">
|
||||
<h2>Section 3 - Event Logs<a class="headerlink" href="#section-3-event-logs" title="Permalink to this headline">¶</a></h2>
|
||||
<div class="section" id="chapter-3-event-logs">
|
||||
<h2>Chapter 3 - Event Logs<a class="headerlink" href="#chapter-3-event-logs" title="Permalink to this headline">¶</a></h2>
|
||||
<p>The functions showcased in this chapter highlight methods to access events
|
||||
within Windows event log files, iterating over the events, and extracting
|
||||
useful records for further examination.</p>
|
||||
<ul class="simple">
|
||||
<li><dl class="simple">
|
||||
<dt>Using python-evtx</dt><dd><ul>
|
||||
|
|
@ -295,7 +303,7 @@ needed with minimal effort.</p></li>
|
|||
</dl>
|
||||
</li>
|
||||
<li><dl class="simple">
|
||||
<dt>Parsing Logins (with types, levels, privs)</dt><dd><ul>
|
||||
<dt>Parsing Logins</dt><dd><ul>
|
||||
<li><p>Parse out the commonly investigated 4624/4672 events</p></li>
|
||||
</ul>
|
||||
</dd>
|
||||
|
|
@ -303,8 +311,8 @@ needed with minimal effort.</p></li>
|
|||
</li>
|
||||
</ul>
|
||||
</div>
|
||||
<div class="section" id="section-4-text-logs">
|
||||
<h2>Section 4 - Text logs<a class="headerlink" href="#section-4-text-logs" title="Permalink to this headline">¶</a></h2>
|
||||
<div class="section" id="chapter-4-text-logs">
|
||||
<h2>Chapter 4 - Text logs<a class="headerlink" href="#chapter-4-text-logs" title="Permalink to this headline">¶</a></h2>
|
||||
<ul class="simple">
|
||||
<li><dl class="simple">
|
||||
<dt>Handling IIS Logs</dt><dd><ul>
|
||||
|
|
@ -329,16 +337,20 @@ needed with minimal effort.</p></li>
|
|||
</li>
|
||||
</ul>
|
||||
</div>
|
||||
<div class="section" id="section-5-api-calls-json-data">
|
||||
<h2>Section 5 - API calls & JSON data<a class="headerlink" href="#section-5-api-calls-json-data" title="Permalink to this headline">¶</a></h2>
|
||||
<div class="section" id="chapter-5-api-calls-json-data">
|
||||
<h2>Chapter 5 - API calls & JSON data<a class="headerlink" href="#chapter-5-api-calls-json-data" title="Permalink to this headline">¶</a></h2>
|
||||
<ul class="simple">
|
||||
<li><p>VirusTotal</p></li>
|
||||
<li><p>HybridAnalysis</p></li>
|
||||
<li><p>Manipulating JSON</p></li>
|
||||
</ul>
|
||||
</div>
|
||||
<div class="section" id="section-6-sqlite-macos-mobile-browsers">
|
||||
<h2>Section 6 - SQLite & macOS/mobile/browsers<a class="headerlink" href="#section-6-sqlite-macos-mobile-browsers" title="Permalink to this headline">¶</a></h2>
|
||||
<div class="section" id="chapter-6-databases">
|
||||
<h2>Chapter 6 - Databases<a class="headerlink" href="#chapter-6-databases" title="Permalink to this headline">¶</a></h2>
|
||||
<p>Databases are found within many applications and operating systems. This chapter
|
||||
covers methods to extract information from these common databases, along with
|
||||
functions that are purpose built to parse information from frequently seen
|
||||
database tables.</p>
|
||||
<ul class="simple">
|
||||
<li><dl class="simple">
|
||||
<dt>macOS Activity</dt><dd><ul>
|
||||
|
|
@ -347,12 +359,17 @@ needed with minimal effort.</p></li>
|
|||
</dd>
|
||||
</dl>
|
||||
</li>
|
||||
<li><p>Andriod SMS</p></li>
|
||||
<li><p>Google Chome History DB</p></li>
|
||||
<li><p>Android SMS</p></li>
|
||||
<li><p>Google Chrome History DB</p></li>
|
||||
</ul>
|
||||
</div>
|
||||
<div class="section" id="section-7-opening-forensic-images">
|
||||
<h2>Section 7 - Opening forensic images<a class="headerlink" href="#section-7-opening-forensic-images" title="Permalink to this headline">¶</a></h2>
|
||||
<div class="section" id="chapter-7-opening-forensic-images">
|
||||
<h2>Chapter 7 - Opening forensic images<a class="headerlink" href="#chapter-7-opening-forensic-images" title="Permalink to this headline">¶</a></h2>
|
||||
<p>Media acquisition and preservation formats are very common within DFIR and
|
||||
the ability to extract specific contents from these files leads to faster
|
||||
analysis and simplified usage of the tool you are building. With these functions
|
||||
you can read files from a forensic image and pass them straight to your other
|
||||
utilities for further parsing.</p>
|
||||
<ul class="simple">
|
||||
<li><dl class="simple">
|
||||
<dt>LibEWF</dt><dd><ul>
|
||||
|
|
@ -366,7 +383,7 @@ needed with minimal effort.</p></li>
|
|||
<li><p>Read data from a raw image (MBR)</p></li>
|
||||
<li><p>Read data from a file (hashing)</p></li>
|
||||
<li><p>Iterate through folders (file listing)</p></li>
|
||||
<li><p>Perform targetted reads (file sigs)</p></li>
|
||||
<li><p>Perform targeted reads (file signatures)</p></li>
|
||||
</ul>
|
||||
</dd>
|
||||
</dl>
|
||||
|
|
@ -391,7 +408,7 @@ needed with minimal effort.</p></li>
|
|||
|
||||
<div class="rst-footer-buttons" role="navigation" aria-label="footer navigation">
|
||||
|
||||
<a href="section1.html" class="btn btn-neutral float-right" title="Section 1 - Essential Scripts" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right"></span></a>
|
||||
<a href="ch01_essentials.html" class="btn btn-neutral float-right" title="Chapter 1 - Essential Scripts" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right"></span></a>
|
||||
|
||||
|
||||
</div>
|
||||
|
|
|
|||
BIN
objects.inv
BIN
objects.inv
Binary file not shown.
|
|
@ -7,7 +7,7 @@
|
|||
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
|
||||
<title>Python Module Index — Python Forensics Handbook 0.1.0 documentation</title>
|
||||
<title>Python Module Index — Python Forensics Handbook 0.1.1 documentation</title>
|
||||
|
||||
|
||||
|
||||
|
|
@ -73,7 +73,7 @@
|
|||
|
||||
|
||||
<div class="version">
|
||||
0.1.0
|
||||
0.1.1
|
||||
</div>
|
||||
|
||||
|
||||
|
|
@ -100,10 +100,10 @@
|
|||
|
||||
<p class="caption"><span class="caption-text">Table of Contents:</span></p>
|
||||
<ul>
|
||||
<li class="toctree-l1"><a class="reference internal" href="section1.html">Section 1 - Essential Scripts</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="section2.html">Section 2 - Registry Parsing</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="section3.html">Section 3 - Windows Event Log Parsing</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="section6.html">Section 6 - Sqlite & MacOS/Mobile/Browsers</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="ch01_essentials.html">Chapter 1 - Essential Scripts</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="ch02_registry.html">Chapter 2 - Registry Parsing</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="ch03_event_logs.html">Chapter 3 - Windows Event Log Parsing</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="ch06_databases.html">Chapter 6 - Sqlite & MacOS/Mobile/Browsers</a></li>
|
||||
</ul>
|
||||
|
||||
|
||||
|
|
@ -185,47 +185,47 @@
|
|||
<tr class="cg-1">
|
||||
<td></td>
|
||||
<td>   
|
||||
<a href="section1.html#module-pyforhandbook.section_01.argparse_example"><code class="xref">pyforhandbook.section_01.argparse_example</code></a></td><td>
|
||||
<a href="ch01_essentials.html#module-pyforhandbook.ch01_essentials.argparse_example"><code class="xref">pyforhandbook.ch01_essentials.argparse_example</code></a></td><td>
|
||||
<em></em></td></tr>
|
||||
<tr class="cg-1">
|
||||
<td></td>
|
||||
<td>   
|
||||
<a href="section1.html#module-pyforhandbook.section_01.csv_example"><code class="xref">pyforhandbook.section_01.csv_example</code></a></td><td>
|
||||
<a href="ch01_essentials.html#module-pyforhandbook.ch01_essentials.csv_example"><code class="xref">pyforhandbook.ch01_essentials.csv_example</code></a></td><td>
|
||||
<em></em></td></tr>
|
||||
<tr class="cg-1">
|
||||
<td></td>
|
||||
<td>   
|
||||
<a href="section1.html#module-pyforhandbook.section_01.logging_example"><code class="xref">pyforhandbook.section_01.logging_example</code></a></td><td>
|
||||
<a href="ch01_essentials.html#module-pyforhandbook.ch01_essentials.logging_example"><code class="xref">pyforhandbook.ch01_essentials.logging_example</code></a></td><td>
|
||||
<em></em></td></tr>
|
||||
<tr class="cg-1">
|
||||
<td></td>
|
||||
<td>   
|
||||
<a href="section1.html#module-pyforhandbook.section_01.open_files"><code class="xref">pyforhandbook.section_01.open_files</code></a></td><td>
|
||||
<a href="ch01_essentials.html#module-pyforhandbook.ch01_essentials.open_files"><code class="xref">pyforhandbook.ch01_essentials.open_files</code></a></td><td>
|
||||
<em></em></td></tr>
|
||||
<tr class="cg-1">
|
||||
<td></td>
|
||||
<td>   
|
||||
<a href="section1.html#module-pyforhandbook.section_01.recursion_example"><code class="xref">pyforhandbook.section_01.recursion_example</code></a></td><td>
|
||||
<a href="ch01_essentials.html#module-pyforhandbook.ch01_essentials.recursion_example"><code class="xref">pyforhandbook.ch01_essentials.recursion_example</code></a></td><td>
|
||||
<em></em></td></tr>
|
||||
<tr class="cg-1">
|
||||
<td></td>
|
||||
<td>   
|
||||
<a href="section2.html#module-pyforhandbook.section_02.yarp_base"><code class="xref">pyforhandbook.section_02.yarp_base</code></a></td><td>
|
||||
<a href="ch02_registry.html#module-pyforhandbook.ch02_registry.yarp_base"><code class="xref">pyforhandbook.ch02_registry.yarp_base</code></a></td><td>
|
||||
<em></em></td></tr>
|
||||
<tr class="cg-1">
|
||||
<td></td>
|
||||
<td>   
|
||||
<a href="section2.html#module-pyforhandbook.section_02.yarp_ntuser"><code class="xref">pyforhandbook.section_02.yarp_ntuser</code></a></td><td>
|
||||
<a href="ch02_registry.html#module-pyforhandbook.ch02_registry.yarp_ntuser"><code class="xref">pyforhandbook.ch02_registry.yarp_ntuser</code></a></td><td>
|
||||
<em></em></td></tr>
|
||||
<tr class="cg-1">
|
||||
<td></td>
|
||||
<td>   
|
||||
<a href="section3.html#module-pyforhandbook.section_03.using_python_evtx"><code class="xref">pyforhandbook.section_03.using_python_evtx</code></a></td><td>
|
||||
<a href="ch03_event_logs.html#module-pyforhandbook.ch03_event_logs.using_python_evtx"><code class="xref">pyforhandbook.ch03_event_logs.using_python_evtx</code></a></td><td>
|
||||
<em></em></td></tr>
|
||||
<tr class="cg-1">
|
||||
<td></td>
|
||||
<td>   
|
||||
<a href="section6.html#module-pyforhandbook.section_06.opening_sqlite"><code class="xref">pyforhandbook.section_06.opening_sqlite</code></a></td><td>
|
||||
<a href="ch06_databases.html#module-pyforhandbook.ch06_databases.opening_sqlite"><code class="xref">pyforhandbook.ch06_databases.opening_sqlite</code></a></td><td>
|
||||
<em></em></td></tr>
|
||||
</table>
|
||||
|
||||
|
|
|
|||
12
search.html
12
search.html
|
|
@ -7,7 +7,7 @@
|
|||
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
|
||||
<title>Search — Python Forensics Handbook 0.1.0 documentation</title>
|
||||
<title>Search — Python Forensics Handbook 0.1.1 documentation</title>
|
||||
|
||||
|
||||
|
||||
|
|
@ -72,7 +72,7 @@
|
|||
|
||||
|
||||
<div class="version">
|
||||
0.1.0
|
||||
0.1.1
|
||||
</div>
|
||||
|
||||
|
||||
|
|
@ -99,10 +99,10 @@
|
|||
|
||||
<p class="caption"><span class="caption-text">Table of Contents:</span></p>
|
||||
<ul>
|
||||
<li class="toctree-l1"><a class="reference internal" href="section1.html">Section 1 - Essential Scripts</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="section2.html">Section 2 - Registry Parsing</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="section3.html">Section 3 - Windows Event Log Parsing</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="section6.html">Section 6 - Sqlite & MacOS/Mobile/Browsers</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="ch01_essentials.html">Chapter 1 - Essential Scripts</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="ch02_registry.html">Chapter 2 - Registry Parsing</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="ch03_event_logs.html">Chapter 3 - Windows Event Log Parsing</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="ch06_databases.html">Chapter 6 - Sqlite & MacOS/Mobile/Browsers</a></li>
|
||||
</ul>
|
||||
|
||||
|
||||
|
|
|
|||
File diff suppressed because one or more lines are too long
Loading…
Reference in New Issue