RomanNum3ral
/
python-forensics-handbook
mirror of https://github.com/chapinb/python-forensics-handbook.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Minor updates

This commit is contained in:
Chapin Bryce 2019-11-03 07:45:40 -05:00
parent 18cc3c4376
commit 5be3e71173
2 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sections/section_01/open_files.py
View File

@ -67,7 +67,7 @@ __docs__ = [
def open_file(input_file): def open_file(input_file):
"""Writes a list of dictionaries to a CSV file. """Opens an encoded text file and prints the contents
Arguments: Arguments:
input_file (str): Path to file to open input_file (str): Path to file to open

6
sections/section_02/yarp_ntuser.py
View File

@ -62,7 +62,10 @@ from datetime import datetime, timedelta
import struct import struct
import yarp import yarp
from sections.section_02.yarp_base import RegistryBase try:
from sections.section_02.yarp_base import RegistryBase
except ImportError:
from yarp_base import RegistryBase
""" """
Copyright 2019 Chapin Bryce Copyright 2019 Chapin Bryce
@ -115,6 +118,7 @@ class NTUSER(RegistryBase):
mp_data['name'] = mp.name().replace('#', '\\') mp_data['name'] = mp.name().replace('#', '\\')
mp_data['values'] = {x.name(): x.data() for x in mp.values()} mp_data['values'] = {x.name(): x.data() for x in mp.values()}
mp_data['last_written'] = mp.last_written_timestamp() mp_data['last_written'] = mp.last_written_timestamp()
import pdb; pdb.set_trace()
yield mp_data yield mp_data
def parse_office_versions(self): def parse_office_versions(self):