diff --git a/.buildinfo b/.buildinfo index 587c6f0..84638ee 100644 --- a/.buildinfo +++ b/.buildinfo @@ -1,4 +1,4 @@ # Sphinx build info version 1 # This file hashes the configuration used when building these files. When it is not found, a full rebuild will be done. -config: 68742d456087727ed42422957f408af7 +config: bba2bba94c5da3a0f35a41a0438a5a1d tags: 645f666f9bcd5a90fca523b33c5a78b7 diff --git a/.doctrees/ch01_essentials.doctree b/.doctrees/ch01_essentials.doctree new file mode 100644 index 0000000..94c4d9e Binary files /dev/null and b/.doctrees/ch01_essentials.doctree differ diff --git a/.doctrees/section2.doctree b/.doctrees/ch02_registry.doctree similarity index 52% rename from .doctrees/section2.doctree rename to .doctrees/ch02_registry.doctree index 3a2957e..a890063 100644 Binary files a/.doctrees/section2.doctree and b/.doctrees/ch02_registry.doctree differ diff --git a/.doctrees/section3.doctree b/.doctrees/ch03_event_logs.doctree similarity index 80% rename from .doctrees/section3.doctree rename to .doctrees/ch03_event_logs.doctree index 841c814..4902d95 100644 Binary files a/.doctrees/section3.doctree and b/.doctrees/ch03_event_logs.doctree differ diff --git a/.doctrees/ch06_databases.doctree b/.doctrees/ch06_databases.doctree new file mode 100644 index 0000000..2ab852e Binary files /dev/null and b/.doctrees/ch06_databases.doctree differ diff --git a/.doctrees/environment.pickle b/.doctrees/environment.pickle index fe762f0..6bde266 100644 Binary files a/.doctrees/environment.pickle and b/.doctrees/environment.pickle differ diff --git a/.doctrees/index.doctree b/.doctrees/index.doctree index 9ff4c48..1eb0014 100644 Binary files a/.doctrees/index.doctree and b/.doctrees/index.doctree differ diff --git a/.doctrees/section1.doctree b/.doctrees/section1.doctree deleted file mode 100644 index 1597f41..0000000 Binary files a/.doctrees/section1.doctree and /dev/null differ diff --git a/.doctrees/section6.doctree b/.doctrees/section6.doctree deleted file mode 100644 index 9ce0099..0000000 Binary files a/.doctrees/section6.doctree and /dev/null differ diff --git a/_sources/section1.rst.txt b/_sources/ch01_essentials.rst.txt similarity index 62% rename from _sources/section1.rst.txt rename to _sources/ch01_essentials.rst.txt index 93a1adb..8dad7d9 100644 --- a/_sources/section1.rst.txt +++ b/_sources/ch01_essentials.rst.txt @@ -1,4 +1,4 @@ -Section 1 - Essential Scripts +Chapter 1 - Essential Scripts ============================== .. toctree:: :maxdepth: 2 @@ -6,27 +6,27 @@ Section 1 - Essential Scripts Section 1.1 - Argparse Example -------------------------------- -.. automodule:: pyforhandbook.section_01.argparse_example +.. automodule:: pyforhandbook.ch01_essentials.argparse_example :members: Section 1.2 - Logging Example -------------------------------- -.. automodule:: pyforhandbook.section_01.logging_example +.. automodule:: pyforhandbook.ch01_essentials.logging_example :members: Section 1.3 - Open Files ------------------------ -.. automodule:: pyforhandbook.section_01.open_files +.. automodule:: pyforhandbook.ch01_essentials.open_files :members: Section 1.4 - CSV Example -------------------------------- -.. automodule:: pyforhandbook.section_01.csv_example +.. automodule:: pyforhandbook.ch01_essentials.csv_example :members: Section 1.5 - Directory Recursion --------------------------------- -.. automodule:: pyforhandbook.section_01.recursion_example +.. automodule:: pyforhandbook.ch01_essentials.recursion_example :members: Indices and tables diff --git a/_sources/section2.rst.txt b/_sources/ch02_registry.rst.txt similarity index 71% rename from _sources/section2.rst.txt rename to _sources/ch02_registry.rst.txt index 44b55f1..164c4fe 100644 --- a/_sources/section2.rst.txt +++ b/_sources/ch02_registry.rst.txt @@ -1,4 +1,4 @@ -Section 2 - Registry Parsing +Chapter 2 - Registry Parsing ============================== .. toctree:: :maxdepth: 2 @@ -6,12 +6,12 @@ Section 2 - Registry Parsing Section 2.1 - Opening a Hive -------------------------------- -.. automodule:: pyforhandbook.section_02.yarp_base +.. automodule:: pyforhandbook.ch02_registry.yarp_base :members: Section 2.2 - Parsing Hive Values ---------------------------------- -.. automodule:: pyforhandbook.section_02.yarp_ntuser +.. automodule:: pyforhandbook.ch02_registry.yarp_ntuser :members: Indices and tables diff --git a/_sources/section3.rst.txt b/_sources/ch03_event_logs.rst.txt similarity index 73% rename from _sources/section3.rst.txt rename to _sources/ch03_event_logs.rst.txt index 5e2ff50..1a8edfc 100644 --- a/_sources/section3.rst.txt +++ b/_sources/ch03_event_logs.rst.txt @@ -1,4 +1,4 @@ -Section 3 - Windows Event Log Parsing +Chapter 3 - Windows Event Log Parsing ===================================== .. toctree:: :maxdepth: 2 @@ -6,7 +6,7 @@ Section 3 - Windows Event Log Parsing Section 3.1 - Using python-evtx ---------------------------------- -.. automodule:: pyforhandbook.section_03.using_python_evtx +.. automodule:: pyforhandbook.ch03_event_logs.using_python_evtx :members: Indices and tables diff --git a/_sources/section6.rst.txt b/_sources/ch06_databases.rst.txt similarity index 72% rename from _sources/section6.rst.txt rename to _sources/ch06_databases.rst.txt index 24ee294..894a4e9 100644 --- a/_sources/section6.rst.txt +++ b/_sources/ch06_databases.rst.txt @@ -1,4 +1,4 @@ -Section 6 - Sqlite & MacOS/Mobile/Browsers +Chapter 6 - Sqlite & MacOS/Mobile/Browsers ========================================== .. toctree:: :maxdepth: 2 @@ -6,7 +6,7 @@ Section 6 - Sqlite & MacOS/Mobile/Browsers Section 6.1 - Opening Sqlite -------------------------------- -.. automodule:: pyforhandbook.section_06.opening_sqlite +.. automodule:: pyforhandbook.ch06_databases.opening_sqlite :members: Indices and tables diff --git a/_sources/index.rst.txt b/_sources/index.rst.txt index b64b138..246e5c1 100644 --- a/_sources/index.rst.txt +++ b/_sources/index.rst.txt @@ -5,18 +5,18 @@ The Python Forensics Handbook ============================= ---------------------------------------------- -A guide for developing Python scripts in DFIR ---------------------------------------------- +-------------------------------------------------------- +A reference guide for developing Python scripts in DFIR +-------------------------------------------------------- .. toctree:: :maxdepth: 1 :caption: Table of Contents: - section1 - section2 - section3 - section6 + ch01_essentials + ch02_registry + ch03_event_logs + ch06_databases Handbook Sections ============================== diff --git a/_static/documentation_options.js b/_static/documentation_options.js index 87d8188..1f7b0d1 100644 --- a/_static/documentation_options.js +++ b/_static/documentation_options.js @@ -1,6 +1,6 @@ var DOCUMENTATION_OPTIONS = { URL_ROOT: document.getElementById("documentation_options").getAttribute('data-url_root'), - VERSION: '0.1.0', + VERSION: '0.1.1', LANGUAGE: 'None', COLLAPSE_INDEX: false, BUILDER: 'html', diff --git a/section1.html b/ch01_essentials.html similarity index 59% rename from section1.html rename to ch01_essentials.html index b636aca..d91f011 100644 --- a/section1.html +++ b/ch01_essentials.html @@ -7,7 +7,7 @@ - Section 1 - Essential Scripts — Python Forensics Handbook 0.1.0 documentation + Chapter 1 - Essential Scripts — Python Forensics Handbook 0.1.1 documentation @@ -36,7 +36,7 @@ - + @@ -72,7 +72,7 @@
- 0.1.0 + 0.1.1
@@ -99,28 +99,28 @@

Table of Contents: