deploy: c56f748ca5
This commit is contained in:
chapinb
parent
4223991f0e
commit
62458ba7b1
|
|
@ -0,0 +1,4 @@
|
|||
# Sphinx build info version 1
|
||||
# This file hashes the configuration used when building these files. When it is not found, a full rebuild will be done.
|
||||
config: 68742d456087727ed42422957f408af7
|
||||
tags: 645f666f9bcd5a90fca523b33c5a78b7
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
|
@ -20,7 +20,7 @@ A guide for developing Python scripts in DFIR
|
|||
|
||||
Handbook Sections
|
||||
==============================
|
||||
.. automodule:: sections
|
||||
.. automodule:: pyforhandbook
|
||||
:members:
|
||||
|
||||
Indices and tables
|
||||
|
|
|
|||
|
|
@ -6,27 +6,27 @@ Section 1 - Essential Scripts
|
|||
|
||||
Section 1.1 - Argparse Example
|
||||
--------------------------------
|
||||
.. automodule:: sections.section_01.argparse_example
|
||||
.. automodule:: pyforhandbook.section_01.argparse_example
|
||||
:members:
|
||||
|
||||
Section 1.2 - Logging Example
|
||||
--------------------------------
|
||||
.. automodule:: sections.section_01.logging_example
|
||||
.. automodule:: pyforhandbook.section_01.logging_example
|
||||
:members:
|
||||
|
||||
Section 1.3 - Open Files
|
||||
------------------------
|
||||
.. automodule:: sections.section_01.open_files
|
||||
.. automodule:: pyforhandbook.section_01.open_files
|
||||
:members:
|
||||
|
||||
Section 1.4 - CSV Example
|
||||
--------------------------------
|
||||
.. automodule:: sections.section_01.csv_example
|
||||
.. automodule:: pyforhandbook.section_01.csv_example
|
||||
:members:
|
||||
|
||||
Section 1.5 - Directory Recursion
|
||||
---------------------------------
|
||||
.. automodule:: sections.section_01.recursion_example
|
||||
.. automodule:: pyforhandbook.section_01.recursion_example
|
||||
:members:
|
||||
|
||||
Indices and tables
|
||||
|
|
|
|||
|
|
@ -6,12 +6,12 @@ Section 2 - Registry Parsing
|
|||
|
||||
Section 2.1 - Opening a Hive
|
||||
--------------------------------
|
||||
.. automodule:: sections.section_02.yarp_base
|
||||
.. automodule:: pyforhandbook.section_02.yarp_base
|
||||
:members:
|
||||
|
||||
Section 2.2 - Parsing Hive Values
|
||||
----------------------------------
|
||||
.. automodule:: sections.section_02.yarp_ntuser
|
||||
.. automodule:: pyforhandbook.section_02.yarp_ntuser
|
||||
:members:
|
||||
|
||||
Indices and tables
|
||||
|
|
|
|||
|
|
@ -4,19 +4,9 @@ Section 3 - Windows Event Log Parsing
|
|||
:maxdepth: 2
|
||||
:caption: Contents:
|
||||
|
||||
Section 3.1 - Opening an Event Log
|
||||
Section 3.1 - Using python-evtx
|
||||
----------------------------------
|
||||
.. automodule:: sections.section_03.open_evtx
|
||||
:members:
|
||||
|
||||
Section 3.2 - Iterate over events
|
||||
---------------------------------
|
||||
.. automodule:: sections.section_03.get_events
|
||||
:members:
|
||||
|
||||
Section 3.3 - Filter event data
|
||||
-------------------------------
|
||||
.. automodule:: sections.section_03.filter_events_json
|
||||
.. automodule:: pyforhandbook.section_03.using_python_evtx
|
||||
:members:
|
||||
|
||||
Indices and tables
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ Section 6 - Sqlite & MacOS/Mobile/Browsers
|
|||
|
||||
Section 6.1 - Opening Sqlite
|
||||
--------------------------------
|
||||
.. automodule:: sections.section_06.opening_sqlite
|
||||
.. automodule:: pyforhandbook.section_06.opening_sqlite
|
||||
:members:
|
||||
|
||||
Indices and tables
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
var DOCUMENTATION_OPTIONS = {
|
||||
URL_ROOT: document.getElementById("documentation_options").getAttribute('data-url_root'),
|
||||
VERSION: '20201015',
|
||||
VERSION: '0.1.0',
|
||||
LANGUAGE: 'None',
|
||||
COLLAPSE_INDEX: false,
|
||||
BUILDER: 'html',
|
||||
|
|
|
|||
194
genindex.html
194
genindex.html
|
|
@ -7,7 +7,7 @@
|
|||
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
|
||||
<title>Index — Python Forensics Handbook 20201015 documentation</title>
|
||||
<title>Index — Python Forensics Handbook 0.1.0 documentation</title>
|
||||
|
||||
|
||||
|
||||
|
|
@ -184,7 +184,7 @@
|
|||
<h2 id="C">C</h2>
|
||||
<table style="width: 100%" class="indextable genindextable"><tr>
|
||||
<td style="width: 33%; vertical-align: top;"><ul>
|
||||
<li><a href="section2.html#sections.section_02.yarp_base.RegistryBase.close">close() (RegistryBase method)</a>
|
||||
<li><a href="section2.html#pyforhandbook.section_02.yarp_base.RegistryBase.close">close() (RegistryBase method)</a>
|
||||
</li>
|
||||
</ul></td>
|
||||
</tr></table>
|
||||
|
|
@ -192,7 +192,7 @@
|
|||
<h2 id="F">F</h2>
|
||||
<table style="width: 100%" class="indextable genindextable"><tr>
|
||||
<td style="width: 33%; vertical-align: top;"><ul>
|
||||
<li><a href="section3.html#sections.section_03.open_evtx.filter_events_json">filter_events_json() (in module sections.section_03.open_evtx)</a>
|
||||
<li><a href="section3.html#pyforhandbook.section_03.using_python_evtx.filter_events_json">filter_events_json() (in module pyforhandbook.section_03.using_python_evtx)</a>
|
||||
</li>
|
||||
</ul></td>
|
||||
</tr></table>
|
||||
|
|
@ -200,7 +200,7 @@
|
|||
<h2 id="G">G</h2>
|
||||
<table style="width: 100%" class="indextable genindextable"><tr>
|
||||
<td style="width: 33%; vertical-align: top;"><ul>
|
||||
<li><a href="section3.html#sections.section_03.open_evtx.get_events">get_events() (in module sections.section_03.open_evtx)</a>
|
||||
<li><a href="section3.html#pyforhandbook.section_03.using_python_evtx.get_events">get_events() (in module pyforhandbook.section_03.using_python_evtx)</a>
|
||||
</li>
|
||||
</ul></td>
|
||||
</tr></table>
|
||||
|
|
@ -208,7 +208,7 @@
|
|||
<h2 id="L">L</h2>
|
||||
<table style="width: 100%" class="indextable genindextable"><tr>
|
||||
<td style="width: 33%; vertical-align: top;"><ul>
|
||||
<li><a href="section1.html#sections.section_01.recursion_example.list_directory">list_directory() (in module sections.section_01.recursion_example)</a>
|
||||
<li><a href="section1.html#pyforhandbook.section_01.recursion_example.list_directory">list_directory() (in module pyforhandbook.section_01.recursion_example)</a>
|
||||
</li>
|
||||
</ul></td>
|
||||
</tr></table>
|
||||
|
|
@ -220,25 +220,25 @@
|
|||
module
|
||||
|
||||
<ul>
|
||||
<li><a href="index.html#module-sections">sections</a>
|
||||
<li><a href="index.html#module-pyforhandbook">pyforhandbook</a>
|
||||
</li>
|
||||
<li><a href="section1.html#module-sections.section_01.argparse_example">sections.section_01.argparse_example</a>
|
||||
<li><a href="section1.html#module-pyforhandbook.section_01.argparse_example">pyforhandbook.section_01.argparse_example</a>
|
||||
</li>
|
||||
<li><a href="section1.html#module-sections.section_01.csv_example">sections.section_01.csv_example</a>
|
||||
<li><a href="section1.html#module-pyforhandbook.section_01.csv_example">pyforhandbook.section_01.csv_example</a>
|
||||
</li>
|
||||
<li><a href="section1.html#module-sections.section_01.logging_example">sections.section_01.logging_example</a>
|
||||
<li><a href="section1.html#module-pyforhandbook.section_01.logging_example">pyforhandbook.section_01.logging_example</a>
|
||||
</li>
|
||||
<li><a href="section1.html#module-sections.section_01.open_files">sections.section_01.open_files</a>
|
||||
<li><a href="section1.html#module-pyforhandbook.section_01.open_files">pyforhandbook.section_01.open_files</a>
|
||||
</li>
|
||||
<li><a href="section1.html#module-sections.section_01.recursion_example">sections.section_01.recursion_example</a>
|
||||
<li><a href="section1.html#module-pyforhandbook.section_01.recursion_example">pyforhandbook.section_01.recursion_example</a>
|
||||
</li>
|
||||
<li><a href="section2.html#module-sections.section_02.yarp_base">sections.section_02.yarp_base</a>
|
||||
<li><a href="section2.html#module-pyforhandbook.section_02.yarp_base">pyforhandbook.section_02.yarp_base</a>
|
||||
</li>
|
||||
<li><a href="section2.html#module-sections.section_02.yarp_ntuser">sections.section_02.yarp_ntuser</a>
|
||||
<li><a href="section2.html#module-pyforhandbook.section_02.yarp_ntuser">pyforhandbook.section_02.yarp_ntuser</a>
|
||||
</li>
|
||||
<li><a href="section3.html#module-sections.section_03.open_evtx">sections.section_03.open_evtx</a>
|
||||
<li><a href="section3.html#module-pyforhandbook.section_03.using_python_evtx">pyforhandbook.section_03.using_python_evtx</a>
|
||||
</li>
|
||||
<li><a href="section6.html#module-sections.section_06.opening_sqlite">sections.section_06.opening_sqlite</a>
|
||||
<li><a href="section6.html#module-pyforhandbook.section_06.opening_sqlite">pyforhandbook.section_06.opening_sqlite</a>
|
||||
</li>
|
||||
</ul></li>
|
||||
</ul></td>
|
||||
|
|
@ -247,7 +247,7 @@
|
|||
<h2 id="N">N</h2>
|
||||
<table style="width: 100%" class="indextable genindextable"><tr>
|
||||
<td style="width: 33%; vertical-align: top;"><ul>
|
||||
<li><a href="section2.html#sections.section_02.yarp_ntuser.NTUSER">NTUSER (class in sections.section_02.yarp_ntuser)</a>
|
||||
<li><a href="section2.html#pyforhandbook.section_02.yarp_ntuser.NTUSER">NTUSER (class in pyforhandbook.section_02.yarp_ntuser)</a>
|
||||
</li>
|
||||
</ul></td>
|
||||
</tr></table>
|
||||
|
|
@ -255,11 +255,11 @@
|
|||
<h2 id="O">O</h2>
|
||||
<table style="width: 100%" class="indextable genindextable"><tr>
|
||||
<td style="width: 33%; vertical-align: top;"><ul>
|
||||
<li><a href="section3.html#sections.section_03.open_evtx.open_evtx">open_evtx() (in module sections.section_03.open_evtx)</a>
|
||||
<li><a href="section3.html#pyforhandbook.section_03.using_python_evtx.open_evtx">open_evtx() (in module pyforhandbook.section_03.using_python_evtx)</a>
|
||||
</li>
|
||||
</ul></td>
|
||||
<td style="width: 33%; vertical-align: top;"><ul>
|
||||
<li><a href="section1.html#sections.section_01.open_files.open_file">open_file() (in module sections.section_01.open_files)</a>
|
||||
<li><a href="section1.html#pyforhandbook.section_01.open_files.open_file">open_file() (in module pyforhandbook.section_01.open_files)</a>
|
||||
</li>
|
||||
</ul></td>
|
||||
</tr></table>
|
||||
|
|
@ -267,21 +267,91 @@
|
|||
<h2 id="P">P</h2>
|
||||
<table style="width: 100%" class="indextable genindextable"><tr>
|
||||
<td style="width: 33%; vertical-align: top;"><ul>
|
||||
<li><a href="section2.html#sections.section_02.yarp_ntuser.NTUSER.parse_mountpoints2">parse_mountpoints2() (NTUSER method)</a>
|
||||
<li><a href="section2.html#pyforhandbook.section_02.yarp_ntuser.NTUSER.parse_mountpoints2">parse_mountpoints2() (NTUSER method)</a>
|
||||
</li>
|
||||
<li><a href="section2.html#pyforhandbook.section_02.yarp_ntuser.NTUSER.parse_office_versions">parse_office_versions() (NTUSER method)</a>
|
||||
</li>
|
||||
<li><a href="section2.html#pyforhandbook.section_02.yarp_ntuser.NTUSER.parse_trustrecords">parse_trustrecords() (NTUSER method)</a>
|
||||
</li>
|
||||
<li>
|
||||
pyforhandbook
|
||||
|
||||
<ul>
|
||||
<li><a href="index.html#module-pyforhandbook">module</a>
|
||||
</li>
|
||||
</ul></li>
|
||||
<li>
|
||||
pyforhandbook.section_01.argparse_example
|
||||
|
||||
<ul>
|
||||
<li><a href="section1.html#module-pyforhandbook.section_01.argparse_example">module</a>
|
||||
</li>
|
||||
</ul></li>
|
||||
<li>
|
||||
pyforhandbook.section_01.csv_example
|
||||
|
||||
<ul>
|
||||
<li><a href="section1.html#module-pyforhandbook.section_01.csv_example">module</a>
|
||||
</li>
|
||||
</ul></li>
|
||||
<li>
|
||||
pyforhandbook.section_01.logging_example
|
||||
|
||||
<ul>
|
||||
<li><a href="section1.html#module-pyforhandbook.section_01.logging_example">module</a>
|
||||
</li>
|
||||
</ul></li>
|
||||
</ul></td>
|
||||
<td style="width: 33%; vertical-align: top;"><ul>
|
||||
<li><a href="section2.html#sections.section_02.yarp_ntuser.NTUSER.parse_office_versions">parse_office_versions() (NTUSER method)</a>
|
||||
<li>
|
||||
pyforhandbook.section_01.open_files
|
||||
|
||||
<ul>
|
||||
<li><a href="section1.html#module-pyforhandbook.section_01.open_files">module</a>
|
||||
</li>
|
||||
<li><a href="section2.html#sections.section_02.yarp_ntuser.NTUSER.parse_trustrecords">parse_trustrecords() (NTUSER method)</a>
|
||||
</ul></li>
|
||||
<li>
|
||||
pyforhandbook.section_01.recursion_example
|
||||
|
||||
<ul>
|
||||
<li><a href="section1.html#module-pyforhandbook.section_01.recursion_example">module</a>
|
||||
</li>
|
||||
</ul></li>
|
||||
<li>
|
||||
pyforhandbook.section_02.yarp_base
|
||||
|
||||
<ul>
|
||||
<li><a href="section2.html#module-pyforhandbook.section_02.yarp_base">module</a>
|
||||
</li>
|
||||
</ul></li>
|
||||
<li>
|
||||
pyforhandbook.section_02.yarp_ntuser
|
||||
|
||||
<ul>
|
||||
<li><a href="section2.html#module-pyforhandbook.section_02.yarp_ntuser">module</a>
|
||||
</li>
|
||||
</ul></li>
|
||||
<li>
|
||||
pyforhandbook.section_03.using_python_evtx
|
||||
|
||||
<ul>
|
||||
<li><a href="section3.html#module-pyforhandbook.section_03.using_python_evtx">module</a>
|
||||
</li>
|
||||
</ul></li>
|
||||
<li>
|
||||
pyforhandbook.section_06.opening_sqlite
|
||||
|
||||
<ul>
|
||||
<li><a href="section6.html#module-pyforhandbook.section_06.opening_sqlite">module</a>
|
||||
</li>
|
||||
</ul></li>
|
||||
</ul></td>
|
||||
</tr></table>
|
||||
|
||||
<h2 id="R">R</h2>
|
||||
<table style="width: 100%" class="indextable genindextable"><tr>
|
||||
<td style="width: 33%; vertical-align: top;"><ul>
|
||||
<li><a href="section2.html#sections.section_02.yarp_base.RegistryBase">RegistryBase (class in sections.section_02.yarp_base)</a>
|
||||
<li><a href="section2.html#pyforhandbook.section_02.yarp_base.RegistryBase">RegistryBase (class in pyforhandbook.section_02.yarp_base)</a>
|
||||
</li>
|
||||
</ul></td>
|
||||
</tr></table>
|
||||
|
|
@ -289,79 +359,7 @@
|
|||
<h2 id="S">S</h2>
|
||||
<table style="width: 100%" class="indextable genindextable"><tr>
|
||||
<td style="width: 33%; vertical-align: top;"><ul>
|
||||
<li>
|
||||
sections
|
||||
|
||||
<ul>
|
||||
<li><a href="index.html#module-sections">module</a>
|
||||
</li>
|
||||
</ul></li>
|
||||
<li>
|
||||
sections.section_01.argparse_example
|
||||
|
||||
<ul>
|
||||
<li><a href="section1.html#module-sections.section_01.argparse_example">module</a>
|
||||
</li>
|
||||
</ul></li>
|
||||
<li>
|
||||
sections.section_01.csv_example
|
||||
|
||||
<ul>
|
||||
<li><a href="section1.html#module-sections.section_01.csv_example">module</a>
|
||||
</li>
|
||||
</ul></li>
|
||||
<li>
|
||||
sections.section_01.logging_example
|
||||
|
||||
<ul>
|
||||
<li><a href="section1.html#module-sections.section_01.logging_example">module</a>
|
||||
</li>
|
||||
</ul></li>
|
||||
<li>
|
||||
sections.section_01.open_files
|
||||
|
||||
<ul>
|
||||
<li><a href="section1.html#module-sections.section_01.open_files">module</a>
|
||||
</li>
|
||||
</ul></li>
|
||||
</ul></td>
|
||||
<td style="width: 33%; vertical-align: top;"><ul>
|
||||
<li>
|
||||
sections.section_01.recursion_example
|
||||
|
||||
<ul>
|
||||
<li><a href="section1.html#module-sections.section_01.recursion_example">module</a>
|
||||
</li>
|
||||
</ul></li>
|
||||
<li>
|
||||
sections.section_02.yarp_base
|
||||
|
||||
<ul>
|
||||
<li><a href="section2.html#module-sections.section_02.yarp_base">module</a>
|
||||
</li>
|
||||
</ul></li>
|
||||
<li>
|
||||
sections.section_02.yarp_ntuser
|
||||
|
||||
<ul>
|
||||
<li><a href="section2.html#module-sections.section_02.yarp_ntuser">module</a>
|
||||
</li>
|
||||
</ul></li>
|
||||
<li>
|
||||
sections.section_03.open_evtx
|
||||
|
||||
<ul>
|
||||
<li><a href="section3.html#module-sections.section_03.open_evtx">module</a>
|
||||
</li>
|
||||
</ul></li>
|
||||
<li>
|
||||
sections.section_06.opening_sqlite
|
||||
|
||||
<ul>
|
||||
<li><a href="section6.html#module-sections.section_06.opening_sqlite">module</a>
|
||||
</li>
|
||||
</ul></li>
|
||||
<li><a href="section1.html#sections.section_01.logging_example.setup_logging">setup_logging() (in module sections.section_01.logging_example)</a>
|
||||
<li><a href="section1.html#pyforhandbook.section_01.logging_example.setup_logging">setup_logging() (in module pyforhandbook.section_01.logging_example)</a>
|
||||
</li>
|
||||
</ul></td>
|
||||
</tr></table>
|
||||
|
|
@ -369,11 +367,11 @@
|
|||
<h2 id="W">W</h2>
|
||||
<table style="width: 100%" class="indextable genindextable"><tr>
|
||||
<td style="width: 33%; vertical-align: top;"><ul>
|
||||
<li><a href="section1.html#sections.section_01.csv_example.write_csv_dicts">write_csv_dicts() (in module sections.section_01.csv_example)</a>
|
||||
<li><a href="section1.html#pyforhandbook.section_01.csv_example.write_csv_dicts">write_csv_dicts() (in module pyforhandbook.section_01.csv_example)</a>
|
||||
</li>
|
||||
</ul></td>
|
||||
<td style="width: 33%; vertical-align: top;"><ul>
|
||||
<li><a href="section1.html#sections.section_01.csv_example.write_csv_lists">write_csv_lists() (in module sections.section_01.csv_example)</a>
|
||||
<li><a href="section1.html#pyforhandbook.section_01.csv_example.write_csv_lists">write_csv_lists() (in module pyforhandbook.section_01.csv_example)</a>
|
||||
</li>
|
||||
</ul></td>
|
||||
</tr></table>
|
||||
|
|
@ -391,7 +389,7 @@
|
|||
<div role="contentinfo">
|
||||
<p>
|
||||
|
||||
© Copyright 2019, Chapin Bryce
|
||||
© Copyright 2020, Chapin Bryce
|
||||
|
||||
</p>
|
||||
</div>
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
|
||||
<title>The Python Forensics Handbook — Python Forensics Handbook 20201015 documentation</title>
|
||||
<title>The Python Forensics Handbook — Python Forensics Handbook 0.1.0 documentation</title>
|
||||
|
||||
|
||||
|
||||
|
|
@ -182,8 +182,8 @@
|
|||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="section" id="module-sections">
|
||||
<span id="handbook-sections"></span><h1>Handbook Sections<a class="headerlink" href="#module-sections" title="Permalink to this headline">¶</a></h1>
|
||||
<div class="section" id="module-pyforhandbook">
|
||||
<span id="handbook-sections"></span><h1>Handbook Sections<a class="headerlink" href="#module-pyforhandbook" title="Permalink to this headline">¶</a></h1>
|
||||
<p>IN DEVELOPMENT - More sections will release over the coming weeks/months/as
|
||||
time permits. Feel free to contribute as you have an idea or time to assist,
|
||||
otherwise stay tuned!</p>
|
||||
|
|
@ -402,7 +402,7 @@ needed with minimal effort.</p></li>
|
|||
<div role="contentinfo">
|
||||
<p>
|
||||
|
||||
© Copyright 2019, Chapin Bryce
|
||||
© Copyright 2020, Chapin Bryce
|
||||
|
||||
</p>
|
||||
</div>
|
||||
|
|
|
|||
BIN
objects.inv
BIN
objects.inv
Binary file not shown.
|
|
@ -7,7 +7,7 @@
|
|||
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
|
||||
<title>Python Module Index — Python Forensics Handbook 20201015 documentation</title>
|
||||
<title>Python Module Index — Python Forensics Handbook 0.1.0 documentation</title>
|
||||
|
||||
|
||||
|
||||
|
|
@ -169,63 +169,63 @@
|
|||
<h1>Python Module Index</h1>
|
||||
|
||||
<div class="modindex-jumpbox">
|
||||
<a href="#cap-s"><strong>s</strong></a>
|
||||
<a href="#cap-p"><strong>p</strong></a>
|
||||
</div>
|
||||
|
||||
<table class="indextable modindextable">
|
||||
<tr class="pcap"><td></td><td> </td><td></td></tr>
|
||||
<tr class="cap" id="cap-s"><td></td><td>
|
||||
<strong>s</strong></td><td></td></tr>
|
||||
<tr class="cap" id="cap-p"><td></td><td>
|
||||
<strong>p</strong></td><td></td></tr>
|
||||
<tr>
|
||||
<td><img src="_static/minus.png" class="toggler"
|
||||
id="toggle-1" style="display: none" alt="-" /></td>
|
||||
<td>
|
||||
<a href="index.html#module-sections"><code class="xref">sections</code></a></td><td>
|
||||
<a href="index.html#module-pyforhandbook"><code class="xref">pyforhandbook</code></a></td><td>
|
||||
<em></em></td></tr>
|
||||
<tr class="cg-1">
|
||||
<td></td>
|
||||
<td>   
|
||||
<a href="section1.html#module-sections.section_01.argparse_example"><code class="xref">sections.section_01.argparse_example</code></a></td><td>
|
||||
<a href="section1.html#module-pyforhandbook.section_01.argparse_example"><code class="xref">pyforhandbook.section_01.argparse_example</code></a></td><td>
|
||||
<em></em></td></tr>
|
||||
<tr class="cg-1">
|
||||
<td></td>
|
||||
<td>   
|
||||
<a href="section1.html#module-sections.section_01.csv_example"><code class="xref">sections.section_01.csv_example</code></a></td><td>
|
||||
<a href="section1.html#module-pyforhandbook.section_01.csv_example"><code class="xref">pyforhandbook.section_01.csv_example</code></a></td><td>
|
||||
<em></em></td></tr>
|
||||
<tr class="cg-1">
|
||||
<td></td>
|
||||
<td>   
|
||||
<a href="section1.html#module-sections.section_01.logging_example"><code class="xref">sections.section_01.logging_example</code></a></td><td>
|
||||
<a href="section1.html#module-pyforhandbook.section_01.logging_example"><code class="xref">pyforhandbook.section_01.logging_example</code></a></td><td>
|
||||
<em></em></td></tr>
|
||||
<tr class="cg-1">
|
||||
<td></td>
|
||||
<td>   
|
||||
<a href="section1.html#module-sections.section_01.open_files"><code class="xref">sections.section_01.open_files</code></a></td><td>
|
||||
<a href="section1.html#module-pyforhandbook.section_01.open_files"><code class="xref">pyforhandbook.section_01.open_files</code></a></td><td>
|
||||
<em></em></td></tr>
|
||||
<tr class="cg-1">
|
||||
<td></td>
|
||||
<td>   
|
||||
<a href="section1.html#module-sections.section_01.recursion_example"><code class="xref">sections.section_01.recursion_example</code></a></td><td>
|
||||
<a href="section1.html#module-pyforhandbook.section_01.recursion_example"><code class="xref">pyforhandbook.section_01.recursion_example</code></a></td><td>
|
||||
<em></em></td></tr>
|
||||
<tr class="cg-1">
|
||||
<td></td>
|
||||
<td>   
|
||||
<a href="section2.html#module-sections.section_02.yarp_base"><code class="xref">sections.section_02.yarp_base</code></a></td><td>
|
||||
<a href="section2.html#module-pyforhandbook.section_02.yarp_base"><code class="xref">pyforhandbook.section_02.yarp_base</code></a></td><td>
|
||||
<em></em></td></tr>
|
||||
<tr class="cg-1">
|
||||
<td></td>
|
||||
<td>   
|
||||
<a href="section2.html#module-sections.section_02.yarp_ntuser"><code class="xref">sections.section_02.yarp_ntuser</code></a></td><td>
|
||||
<a href="section2.html#module-pyforhandbook.section_02.yarp_ntuser"><code class="xref">pyforhandbook.section_02.yarp_ntuser</code></a></td><td>
|
||||
<em></em></td></tr>
|
||||
<tr class="cg-1">
|
||||
<td></td>
|
||||
<td>   
|
||||
<a href="section3.html#module-sections.section_03.open_evtx"><code class="xref">sections.section_03.open_evtx</code></a></td><td>
|
||||
<a href="section3.html#module-pyforhandbook.section_03.using_python_evtx"><code class="xref">pyforhandbook.section_03.using_python_evtx</code></a></td><td>
|
||||
<em></em></td></tr>
|
||||
<tr class="cg-1">
|
||||
<td></td>
|
||||
<td>   
|
||||
<a href="section6.html#module-sections.section_06.opening_sqlite"><code class="xref">sections.section_06.opening_sqlite</code></a></td><td>
|
||||
<a href="section6.html#module-pyforhandbook.section_06.opening_sqlite"><code class="xref">pyforhandbook.section_06.opening_sqlite</code></a></td><td>
|
||||
<em></em></td></tr>
|
||||
</table>
|
||||
|
||||
|
|
@ -241,7 +241,7 @@
|
|||
<div role="contentinfo">
|
||||
<p>
|
||||
|
||||
© Copyright 2019, Chapin Bryce
|
||||
© Copyright 2020, Chapin Bryce
|
||||
|
||||
</p>
|
||||
</div>
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
|
||||
<title>Search — Python Forensics Handbook 20201015 documentation</title>
|
||||
<title>Search — Python Forensics Handbook 0.1.0 documentation</title>
|
||||
|
||||
|
||||
|
||||
|
|
@ -190,7 +190,7 @@
|
|||
<div role="contentinfo">
|
||||
<p>
|
||||
|
||||
© Copyright 2019, Chapin Bryce
|
||||
© Copyright 2020, Chapin Bryce
|
||||
|
||||
</p>
|
||||
</div>
|
||||
|
|
|
|||
File diff suppressed because one or more lines are too long
|
|
@ -7,7 +7,7 @@
|
|||
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
|
||||
<title>Section 1 - Essential Scripts — Python Forensics Handbook 20201015 documentation</title>
|
||||
<title>Section 1 - Essential Scripts — Python Forensics Handbook 0.1.0 documentation</title>
|
||||
|
||||
|
||||
|
||||
|
|
@ -100,27 +100,27 @@
|
|||
<p class="caption"><span class="caption-text">Table of Contents:</span></p>
|
||||
<ul class="current">
|
||||
<li class="toctree-l1 current"><a class="current reference internal" href="#">Section 1 - Essential Scripts</a><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-sections.section_01.argparse_example">Section 1.1 - Argparse Example</a><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-pyforhandbook.section_01.argparse_example">Section 1.1 - Argparse Example</a><ul>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#argparse-configuration">Argparse configuration</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-sections.section_01.logging_example">Section 1.2 - Logging Example</a><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-pyforhandbook.section_01.logging_example">Section 1.2 - Logging Example</a><ul>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#logging-configuration">Logging configuration</a></li>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#docstring-references">Docstring References</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-sections.section_01.open_files">Section 1.3 - Open Files</a><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-pyforhandbook.section_01.open_files">Section 1.3 - Open Files</a><ul>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#open-files-with-proper-encoding">Open files with proper encoding</a></li>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#id1">Docstring References</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-sections.section_01.csv_example">Section 1.4 - CSV Example</a><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-pyforhandbook.section_01.csv_example">Section 1.4 - CSV Example</a><ul>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#list-of-dictionaries-to-csv">List of dictionaries to CSV</a></li>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#list-of-ordered-lists-to-csv">List of ordered lists to CSV</a></li>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#id2">Docstring References</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-sections.section_01.recursion_example">Section 1.5 - Directory Recursion</a><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-pyforhandbook.section_01.recursion_example">Section 1.5 - Directory Recursion</a><ul>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#list-a-directory">List a directory</a></li>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#list-a-directory-recursively">List a directory recursively</a></li>
|
||||
</ul>
|
||||
|
|
@ -200,8 +200,8 @@
|
|||
<h1>Section 1 - Essential Scripts<a class="headerlink" href="#section-1-essential-scripts" title="Permalink to this headline">¶</a></h1>
|
||||
<div class="toctree-wrapper compound">
|
||||
</div>
|
||||
<div class="section" id="module-sections.section_01.argparse_example">
|
||||
<span id="section-1-1-argparse-example"></span><h2>Section 1.1 - Argparse Example<a class="headerlink" href="#module-sections.section_01.argparse_example" title="Permalink to this headline">¶</a></h2>
|
||||
<div class="section" id="module-pyforhandbook.section_01.argparse_example">
|
||||
<span id="section-1-1-argparse-example"></span><h2>Section 1.1 - Argparse Example<a class="headerlink" href="#module-pyforhandbook.section_01.argparse_example" title="Permalink to this headline">¶</a></h2>
|
||||
<p>Example for setting up arguments for your command line utility.</p>
|
||||
<p>Example Usage:</p>
|
||||
<blockquote>
|
||||
|
|
@ -259,8 +259,8 @@ module has many more features documented at
|
|||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="section" id="module-sections.section_01.logging_example">
|
||||
<span id="section-1-2-logging-example"></span><h2>Section 1.2 - Logging Example<a class="headerlink" href="#module-sections.section_01.logging_example" title="Permalink to this headline">¶</a></h2>
|
||||
<div class="section" id="module-pyforhandbook.section_01.logging_example">
|
||||
<span id="section-1-2-logging-example"></span><h2>Section 1.2 - Logging Example<a class="headerlink" href="#module-pyforhandbook.section_01.logging_example" title="Permalink to this headline">¶</a></h2>
|
||||
<p>Example for writing logging information to the console and a
|
||||
log file.</p>
|
||||
<p>Example Usage:</p>
|
||||
|
|
@ -329,15 +329,15 @@ critical messages to the console in STDERR.</p>
|
|||
<div class="section" id="docstring-references">
|
||||
<h3>Docstring References<a class="headerlink" href="#docstring-references" title="Permalink to this headline">¶</a></h3>
|
||||
<dl class="py function">
|
||||
<dt id="sections.section_01.logging_example.setup_logging">
|
||||
<code class="sig-name descname">setup_logging</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#sections.section_01.logging_example.setup_logging" title="Permalink to this definition">¶</a></dt>
|
||||
<dt id="pyforhandbook.section_01.logging_example.setup_logging">
|
||||
<code class="sig-name descname">setup_logging</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.section_01.logging_example.setup_logging" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>Function to setup logging configuration and test it.</p>
|
||||
</dd></dl>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
<div class="section" id="module-sections.section_01.open_files">
|
||||
<span id="section-1-3-open-files"></span><h2>Section 1.3 - Open Files<a class="headerlink" href="#module-sections.section_01.open_files" title="Permalink to this headline">¶</a></h2>
|
||||
<div class="section" id="module-pyforhandbook.section_01.open_files">
|
||||
<span id="section-1-3-open-files"></span><h2>Section 1.3 - Open Files<a class="headerlink" href="#module-pyforhandbook.section_01.open_files" title="Permalink to this headline">¶</a></h2>
|
||||
<p>Example for reading data from encoded text files.</p>
|
||||
<p>Demonstrates how to handle setting the proper encoding for
|
||||
UTF-8, UTF-16-LE, and UTF-16-BE with the ability to easily
|
||||
|
|
@ -383,8 +383,8 @@ common text file encodings. Feel free to build and share on this.</p>
|
|||
<div class="section" id="id1">
|
||||
<h3>Docstring References<a class="headerlink" href="#id1" title="Permalink to this headline">¶</a></h3>
|
||||
<dl class="py function">
|
||||
<dt id="sections.section_01.open_files.open_file">
|
||||
<code class="sig-name descname">open_file</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">input_file</span></em><span class="sig-paren">)</span><a class="headerlink" href="#sections.section_01.open_files.open_file" title="Permalink to this definition">¶</a></dt>
|
||||
<dt id="pyforhandbook.section_01.open_files.open_file">
|
||||
<code class="sig-name descname">open_file</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">input_file</span></em><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.section_01.open_files.open_file" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>Opens an encoded text file and prints the contents</p>
|
||||
<dl class="field-list simple">
|
||||
<dt class="field-odd">Parameters</dt>
|
||||
|
|
@ -395,8 +395,8 @@ common text file encodings. Feel free to build and share on this.</p>
|
|||
|
||||
</div>
|
||||
</div>
|
||||
<div class="section" id="module-sections.section_01.csv_example">
|
||||
<span id="section-1-4-csv-example"></span><h2>Section 1.4 - CSV Example<a class="headerlink" href="#module-sections.section_01.csv_example" title="Permalink to this headline">¶</a></h2>
|
||||
<div class="section" id="module-pyforhandbook.section_01.csv_example">
|
||||
<span id="section-1-4-csv-example"></span><h2>Section 1.4 - CSV Example<a class="headerlink" href="#module-pyforhandbook.section_01.csv_example" title="Permalink to this headline">¶</a></h2>
|
||||
<p>Example for writing datasets into CSV files.</p>
|
||||
<p>Demonstrates source datasets comprised of lists of dictionaries
|
||||
and lists of lists as separate functions. Example data is
|
||||
|
|
@ -480,11 +480,10 @@ columns to the CSV.</p>
|
|||
<span class="c1"># Write only provided headers, ignore others</span>
|
||||
<span class="n">csvfile</span> <span class="o">=</span> <span class="n">csv</span><span class="o">.</span><span class="n">writer</span><span class="p">(</span><span class="n">open_file</span><span class="p">)</span>
|
||||
<span class="k">for</span> <span class="n">count</span><span class="p">,</span> <span class="n">entry</span> <span class="ow">in</span> <span class="nb">enumerate</span><span class="p">(</span><span class="n">data</span><span class="p">):</span>
|
||||
<span class="k">if</span> <span class="n">count</span> <span class="o">==</span> <span class="mi">0</span><span class="p">:</span>
|
||||
<span class="k">if</span> <span class="n">count</span> <span class="o">==</span> <span class="mi">0</span> <span class="ow">and</span> <span class="n">headers</span><span class="p">:</span>
|
||||
<span class="c1"># If headers are defined, write them, otherwise</span>
|
||||
<span class="c1"># continue as they will be written anyways</span>
|
||||
<span class="k">if</span> <span class="n">headers</span><span class="p">:</span>
|
||||
<span class="n">csvfile</span><span class="o">.</span><span class="n">writerow</span><span class="p">(</span><span class="n">headers</span><span class="p">)</span>
|
||||
<span class="n">csvfile</span><span class="o">.</span><span class="n">writerow</span><span class="p">(</span><span class="n">headers</span><span class="p">)</span>
|
||||
<span class="n">csvfile</span><span class="o">.</span><span class="n">writerow</span><span class="p">(</span><span class="n">entry</span><span class="p">)</span>
|
||||
</pre></div>
|
||||
</div>
|
||||
|
|
@ -492,8 +491,8 @@ columns to the CSV.</p>
|
|||
<div class="section" id="id2">
|
||||
<h3>Docstring References<a class="headerlink" href="#id2" title="Permalink to this headline">¶</a></h3>
|
||||
<dl class="py function">
|
||||
<dt id="sections.section_01.csv_example.write_csv_dicts">
|
||||
<code class="sig-name descname">write_csv_dicts</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">outfile</span></em>, <em class="sig-param"><span class="n">data</span></em>, <em class="sig-param"><span class="n">headers</span><span class="o">=</span><span class="default_value">None</span></em><span class="sig-paren">)</span><a class="headerlink" href="#sections.section_01.csv_example.write_csv_dicts" title="Permalink to this definition">¶</a></dt>
|
||||
<dt id="pyforhandbook.section_01.csv_example.write_csv_dicts">
|
||||
<code class="sig-name descname">write_csv_dicts</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">outfile</span></em>, <em class="sig-param"><span class="n">data</span></em>, <em class="sig-param"><span class="n">headers</span><span class="o">=</span><span class="default_value">None</span></em><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.section_01.csv_example.write_csv_dicts" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>Writes a list of dictionaries to a CSV file.</p>
|
||||
<dl class="field-list simple">
|
||||
<dt class="field-odd">Parameters</dt>
|
||||
|
|
@ -508,8 +507,8 @@ first dictionary in the <cite>data</cite> list.</p></li>
|
|||
</dd></dl>
|
||||
|
||||
<dl class="py function">
|
||||
<dt id="sections.section_01.csv_example.write_csv_lists">
|
||||
<code class="sig-name descname">write_csv_lists</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">outfile</span></em>, <em class="sig-param"><span class="n">data</span></em>, <em class="sig-param"><span class="n">headers</span><span class="o">=</span><span class="default_value">None</span></em><span class="sig-paren">)</span><a class="headerlink" href="#sections.section_01.csv_example.write_csv_lists" title="Permalink to this definition">¶</a></dt>
|
||||
<dt id="pyforhandbook.section_01.csv_example.write_csv_lists">
|
||||
<code class="sig-name descname">write_csv_lists</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">outfile</span></em>, <em class="sig-param"><span class="n">data</span></em>, <em class="sig-param"><span class="n">headers</span><span class="o">=</span><span class="default_value">None</span></em><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.section_01.csv_example.write_csv_lists" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>Writes a list of lists to a CSV file.</p>
|
||||
<dl class="field-list simple">
|
||||
<dt class="field-odd">Parameters</dt>
|
||||
|
|
@ -525,8 +524,8 @@ first list in the <cite>data</cite> list.</p></li>
|
|||
|
||||
</div>
|
||||
</div>
|
||||
<div class="section" id="module-sections.section_01.recursion_example">
|
||||
<span id="section-1-5-directory-recursion"></span><h2>Section 1.5 - Directory Recursion<a class="headerlink" href="#module-sections.section_01.recursion_example" title="Permalink to this headline">¶</a></h2>
|
||||
<div class="section" id="module-pyforhandbook.section_01.recursion_example">
|
||||
<span id="section-1-5-directory-recursion"></span><h2>Section 1.5 - Directory Recursion<a class="headerlink" href="#module-pyforhandbook.section_01.recursion_example" title="Permalink to this headline">¶</a></h2>
|
||||
<p>File recursion example.</p>
|
||||
<p>Demonstration of iterating through a directory to interact with
|
||||
files.</p>
|
||||
|
|
@ -583,8 +582,8 @@ counting the number of files, subdirectories, and files ending in
|
|||
</pre></div>
|
||||
</div>
|
||||
<dl class="py function">
|
||||
<dt id="sections.section_01.recursion_example.list_directory">
|
||||
<code class="sig-name descname">list_directory</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">path</span></em><span class="sig-paren">)</span><a class="headerlink" href="#sections.section_01.recursion_example.list_directory" title="Permalink to this definition">¶</a></dt>
|
||||
<dt id="pyforhandbook.section_01.recursion_example.list_directory">
|
||||
<code class="sig-name descname">list_directory</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">path</span></em><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.section_01.recursion_example.list_directory" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>List all file and folder entries in <cite>path</cite>.</p>
|
||||
</dd></dl>
|
||||
|
||||
|
|
@ -621,7 +620,7 @@ counting the number of files, subdirectories, and files ending in
|
|||
<div role="contentinfo">
|
||||
<p>
|
||||
|
||||
© Copyright 2019, Chapin Bryce
|
||||
© Copyright 2020, Chapin Bryce
|
||||
|
||||
</p>
|
||||
</div>
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
|
||||
<title>Section 2 - Registry Parsing — Python Forensics Handbook 20201015 documentation</title>
|
||||
<title>Section 2 - Registry Parsing — Python Forensics Handbook 0.1.0 documentation</title>
|
||||
|
||||
|
||||
|
||||
|
|
@ -101,12 +101,12 @@
|
|||
<ul class="current">
|
||||
<li class="toctree-l1"><a class="reference internal" href="section1.html">Section 1 - Essential Scripts</a></li>
|
||||
<li class="toctree-l1 current"><a class="current reference internal" href="#">Section 2 - Registry Parsing</a><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-sections.section_02.yarp_base">Section 2.1 - Opening a Hive</a><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-pyforhandbook.section_02.yarp_base">Section 2.1 - Opening a Hive</a><ul>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#opening-a-registry-hive">Opening a Registry Hive</a></li>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#docstring-references">Docstring References</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-sections.section_02.yarp_ntuser">Section 2.2 - Parsing Hive Values</a><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-pyforhandbook.section_02.yarp_ntuser">Section 2.2 - Parsing Hive Values</a><ul>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#creating-a-hive-specific-parser">Creating a Hive Specific Parser</a></li>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#reading-hive-string-values">Reading Hive String Values</a></li>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#reading-hive-binary-values">Reading Hive Binary Values</a></li>
|
||||
|
|
@ -187,8 +187,8 @@
|
|||
<h1>Section 2 - Registry Parsing<a class="headerlink" href="#section-2-registry-parsing" title="Permalink to this headline">¶</a></h1>
|
||||
<div class="toctree-wrapper compound">
|
||||
</div>
|
||||
<div class="section" id="module-sections.section_02.yarp_base">
|
||||
<span id="section-2-1-opening-a-hive"></span><h2>Section 2.1 - Opening a Hive<a class="headerlink" href="#module-sections.section_02.yarp_base" title="Permalink to this headline">¶</a></h2>
|
||||
<div class="section" id="module-pyforhandbook.section_02.yarp_base">
|
||||
<span id="section-2-1-opening-a-hive"></span><h2>Section 2.1 - Opening a Hive<a class="headerlink" href="#module-pyforhandbook.section_02.yarp_base" title="Permalink to this headline">¶</a></h2>
|
||||
<p>Using the <cite>yarp</cite> library to open Windows registry hives using a class
|
||||
structure that is very portable and flexible.</p>
|
||||
<p>Example Usage:</p>
|
||||
|
|
@ -251,13 +251,13 @@ of the primary hive and attempted recovery of the transaction logs.</p>
|
|||
<div class="section" id="docstring-references">
|
||||
<h3>Docstring References<a class="headerlink" href="#docstring-references" title="Permalink to this headline">¶</a></h3>
|
||||
<dl class="py class">
|
||||
<dt id="sections.section_02.yarp_base.RegistryBase">
|
||||
<em class="property">class </em><code class="sig-name descname">RegistryBase</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">reg_file</span></em><span class="sig-paren">)</span><a class="headerlink" href="#sections.section_02.yarp_base.RegistryBase" title="Permalink to this definition">¶</a></dt>
|
||||
<dt id="pyforhandbook.section_02.yarp_base.RegistryBase">
|
||||
<em class="property">class </em><code class="sig-name descname">RegistryBase</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">reg_file</span></em><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.section_02.yarp_base.RegistryBase" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>Base class containing common registry parsing code. Will open a hive
|
||||
and attempt recovery using available transaction logs</p>
|
||||
<dl class="py method">
|
||||
<dt id="sections.section_02.yarp_base.RegistryBase.close">
|
||||
<code class="sig-name descname">close</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#sections.section_02.yarp_base.RegistryBase.close" title="Permalink to this definition">¶</a></dt>
|
||||
<dt id="pyforhandbook.section_02.yarp_base.RegistryBase.close">
|
||||
<code class="sig-name descname">close</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.section_02.yarp_base.RegistryBase.close" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>Properly close a hive.</p>
|
||||
</dd></dl>
|
||||
|
||||
|
|
@ -265,8 +265,8 @@ and attempt recovery using available transaction logs</p>
|
|||
|
||||
</div>
|
||||
</div>
|
||||
<div class="section" id="module-sections.section_02.yarp_ntuser">
|
||||
<span id="section-2-2-parsing-hive-values"></span><h2>Section 2.2 - Parsing Hive Values<a class="headerlink" href="#module-sections.section_02.yarp_ntuser" title="Permalink to this headline">¶</a></h2>
|
||||
<div class="section" id="module-pyforhandbook.section_02.yarp_ntuser">
|
||||
<span id="section-2-2-parsing-hive-values"></span><h2>Section 2.2 - Parsing Hive Values<a class="headerlink" href="#module-pyforhandbook.section_02.yarp_ntuser" title="Permalink to this headline">¶</a></h2>
|
||||
<p>Using the <cite>yarp</cite> library to parse NTUSER.DAT Windows registry hives
|
||||
using a class structure that is very portable and flexible. Parses the
|
||||
MountPoints2 and TrustRecords keys for with string and binary values.</p>
|
||||
|
|
@ -352,18 +352,18 @@ to be displayed.</p>
|
|||
<div class="section" id="id1">
|
||||
<h3>Docstring References<a class="headerlink" href="#id1" title="Permalink to this headline">¶</a></h3>
|
||||
<dl class="py class">
|
||||
<dt id="sections.section_02.yarp_ntuser.NTUSER">
|
||||
<em class="property">class </em><code class="sig-name descname">NTUSER</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">reg_path</span></em><span class="sig-paren">)</span><a class="headerlink" href="#sections.section_02.yarp_ntuser.NTUSER" title="Permalink to this definition">¶</a></dt>
|
||||
<dt id="pyforhandbook.section_02.yarp_ntuser.NTUSER">
|
||||
<em class="property">class </em><code class="sig-name descname">NTUSER</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">reg_path</span></em><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.section_02.yarp_ntuser.NTUSER" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>Class to handle the parsing of the NTUSER.DAT hive.</p>
|
||||
<dl class="py method">
|
||||
<dt id="sections.section_02.yarp_ntuser.NTUSER.parse_mountpoints2">
|
||||
<code class="sig-name descname">parse_mountpoints2</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#sections.section_02.yarp_ntuser.NTUSER.parse_mountpoints2" title="Permalink to this definition">¶</a></dt>
|
||||
<dt id="pyforhandbook.section_02.yarp_ntuser.NTUSER.parse_mountpoints2">
|
||||
<code class="sig-name descname">parse_mountpoints2</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.section_02.yarp_ntuser.NTUSER.parse_mountpoints2" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>Demonstration of parsing values from a key by path.</p>
|
||||
</dd></dl>
|
||||
|
||||
<dl class="py method">
|
||||
<dt id="sections.section_02.yarp_ntuser.NTUSER.parse_office_versions">
|
||||
<code class="sig-name descname">parse_office_versions</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#sections.section_02.yarp_ntuser.NTUSER.parse_office_versions" title="Permalink to this definition">¶</a></dt>
|
||||
<dt id="pyforhandbook.section_02.yarp_ntuser.NTUSER.parse_office_versions">
|
||||
<code class="sig-name descname">parse_office_versions</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.section_02.yarp_ntuser.NTUSER.parse_office_versions" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>Get Office versions within an open Registry hive.</p>
|
||||
<dl class="field-list simple">
|
||||
<dt class="field-odd">Yields</dt>
|
||||
|
|
@ -373,8 +373,8 @@ to be displayed.</p>
|
|||
</dd></dl>
|
||||
|
||||
<dl class="py method">
|
||||
<dt id="sections.section_02.yarp_ntuser.NTUSER.parse_trustrecords">
|
||||
<code class="sig-name descname">parse_trustrecords</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#sections.section_02.yarp_ntuser.NTUSER.parse_trustrecords" title="Permalink to this definition">¶</a></dt>
|
||||
<dt id="pyforhandbook.section_02.yarp_ntuser.NTUSER.parse_trustrecords">
|
||||
<code class="sig-name descname">parse_trustrecords</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.section_02.yarp_ntuser.NTUSER.parse_trustrecords" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>Demonstration of parsing binary values within a key.</p>
|
||||
</dd></dl>
|
||||
|
||||
|
|
@ -413,7 +413,7 @@ to be displayed.</p>
|
|||
<div role="contentinfo">
|
||||
<p>
|
||||
|
||||
© Copyright 2019, Chapin Bryce
|
||||
© Copyright 2020, Chapin Bryce
|
||||
|
||||
</p>
|
||||
</div>
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
|
||||
<title>Section 3 - Windows Event Log Parsing — Python Forensics Handbook 20201015 documentation</title>
|
||||
<title>Section 3 - Windows Event Log Parsing — Python Forensics Handbook 0.1.0 documentation</title>
|
||||
|
||||
|
||||
|
||||
|
|
@ -102,15 +102,13 @@
|
|||
<li class="toctree-l1"><a class="reference internal" href="section1.html">Section 1 - Essential Scripts</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="section2.html">Section 2 - Registry Parsing</a></li>
|
||||
<li class="toctree-l1 current"><a class="current reference internal" href="#">Section 3 - Windows Event Log Parsing</a><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-sections.section_03.open_evtx">Section 3.1 - Opening an Event Log</a><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-pyforhandbook.section_03.using_python_evtx">Section 3.1 - Using python-evtx</a><ul>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#open-windows-event-logs-evtx">Open Windows Event Logs (EVTX)</a></li>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#iterate-over-record-xml-data-evtx">Iterate over record XML data (EVTX)</a></li>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#filtering-records-within-events-logs">Filtering records within events logs</a></li>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#docstring-references">Docstring References</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#section-3-2-iterate-over-events">Section 3.2 - Iterate over events</a></li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#section-3-3-filter-event-data">Section 3.3 - Filter event data</a></li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#indices-and-tables">Indices and tables</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
|
|
@ -184,9 +182,9 @@
|
|||
<h1>Section 3 - Windows Event Log Parsing<a class="headerlink" href="#section-3-windows-event-log-parsing" title="Permalink to this headline">¶</a></h1>
|
||||
<div class="toctree-wrapper compound">
|
||||
</div>
|
||||
<div class="section" id="module-sections.section_03.open_evtx">
|
||||
<span id="section-3-1-opening-an-event-log"></span><h2>Section 3.1 - Opening an Event Log<a class="headerlink" href="#module-sections.section_03.open_evtx" title="Permalink to this headline">¶</a></h2>
|
||||
<p>Example for opening EVTX files.</p>
|
||||
<div class="section" id="module-pyforhandbook.section_03.using_python_evtx">
|
||||
<span id="section-3-1-using-python-evtx"></span><h2>Section 3.1 - Using python-evtx<a class="headerlink" href="#module-pyforhandbook.section_03.using_python_evtx" title="Permalink to this headline">¶</a></h2>
|
||||
<p>Example for opening EVTX files, iterating over events, and filtering events.</p>
|
||||
<p>Demonstrates how to open an EVTX file and get basic details about the event log.
|
||||
This section makes use of python-evtx, a python library for reading event log
|
||||
files. To install, run <code class="docutils literal notranslate"><span class="pre">pip</span> <span class="pre">install</span> <span class="pre">python-evtx</span></code>.</p>
|
||||
|
|
@ -194,7 +192,7 @@ files. To install, run <code class="docutils literal notranslate"><span class="p
|
|||
add snippets that showcase how to make use of them in reading EVTX files.</p>
|
||||
<p>Example Usage:</p>
|
||||
<blockquote>
|
||||
<div><p><code class="docutils literal notranslate"><span class="pre">$</span> <span class="pre">python</span> <span class="pre">open_evtx.py</span> <span class="pre">System.evtx</span></code></p>
|
||||
<div><p><code class="docutils literal notranslate"><span class="pre">$</span> <span class="pre">python</span> <span class="pre">using_python_evtx.py</span> <span class="pre">System.evtx</span></code></p>
|
||||
</div></blockquote>
|
||||
<p>References:</p>
|
||||
<ul class="simple">
|
||||
|
|
@ -272,7 +270,7 @@ object that you can interact with.</p>
|
|||
</div>
|
||||
<div class="section" id="filtering-records-within-events-logs">
|
||||
<h3>Filtering records within events logs<a class="headerlink" href="#filtering-records-within-events-logs" title="Permalink to this headline">¶</a></h3>
|
||||
<p>Now that we have <a class="reference internal" href="#sections.section_03.open_evtx.get_events" title="sections.section_03.open_evtx.get_events"><code class="xref py py-func docutils literal notranslate"><span class="pre">get_events()</span></code></a>, we can begin to perform operations on
|
||||
<p>Now that we have <a class="reference internal" href="#pyforhandbook.section_03.using_python_evtx.get_events" title="pyforhandbook.section_03.using_python_evtx.get_events"><code class="xref py py-func docutils literal notranslate"><span class="pre">get_events()</span></code></a>, we can begin to perform operations on
|
||||
the newly accessible data. In this function, we extract information from the
|
||||
LXML object, and use that to filter results based on Event ID and other fields
|
||||
within the results. You can easily extend this to support other fields,
|
||||
|
|
@ -334,8 +332,8 @@ then calculating the session durations</p></li>
|
|||
<div class="section" id="docstring-references">
|
||||
<h3>Docstring References<a class="headerlink" href="#docstring-references" title="Permalink to this headline">¶</a></h3>
|
||||
<dl class="py function">
|
||||
<dt id="sections.section_03.open_evtx.filter_events_json">
|
||||
<code class="sig-name descname">filter_events_json</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">event_data</span></em>, <em class="sig-param"><span class="n">event_ids</span></em>, <em class="sig-param"><span class="n">fields</span><span class="o">=</span><span class="default_value">None</span></em><span class="sig-paren">)</span><a class="headerlink" href="#sections.section_03.open_evtx.filter_events_json" title="Permalink to this definition">¶</a></dt>
|
||||
<dt id="pyforhandbook.section_03.using_python_evtx.filter_events_json">
|
||||
<code class="sig-name descname">filter_events_json</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">event_data</span></em>, <em class="sig-param"><span class="n">event_ids</span></em>, <em class="sig-param"><span class="n">fields</span><span class="o">=</span><span class="default_value">None</span></em><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.section_03.using_python_evtx.filter_events_json" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>Provide events where the event id is found within the provided list
|
||||
of event ids. If found, it will return a JSON formatted object per event.</p>
|
||||
<p>If a list of fields are provided, it will filter the resulting JSON event
|
||||
|
|
@ -344,7 +342,7 @@ object to contain only those fields.</p>
|
|||
<dt class="field-odd">Parameters</dt>
|
||||
<dd class="field-odd"><ul class="simple">
|
||||
<li><p><strong>event_data</strong> (<em>genertor</em>) – Iterable containing event data as XML. Preferably
|
||||
the result of the <a class="reference internal" href="#sections.section_03.open_evtx.get_events" title="sections.section_03.open_evtx.get_events"><code class="xref py py-func docutils literal notranslate"><span class="pre">get_events()</span></code></a> method.</p></li>
|
||||
the result of the <a class="reference internal" href="#pyforhandbook.section_03.using_python_evtx.get_events" title="pyforhandbook.section_03.using_python_evtx.get_events"><code class="xref py py-func docutils literal notranslate"><span class="pre">get_events()</span></code></a> method.</p></li>
|
||||
<li><p><strong>event_ids</strong> (<em>list</em>) – A list of event identifiers. Each element should be a
|
||||
string value, even though the identifier is an integer.</p></li>
|
||||
<li><p><strong>fields</strong> (<em>list</em>) – Collection of fields from the XML data to include in the
|
||||
|
|
@ -371,8 +369,8 @@ JSON output. Only supports top-level fields.</p></li>
|
|||
</dd></dl>
|
||||
|
||||
<dl class="py function">
|
||||
<dt id="sections.section_03.open_evtx.get_events">
|
||||
<code class="sig-name descname">get_events</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">input_file</span></em>, <em class="sig-param"><span class="n">parse_xml</span><span class="o">=</span><span class="default_value">False</span></em><span class="sig-paren">)</span><a class="headerlink" href="#sections.section_03.open_evtx.get_events" title="Permalink to this definition">¶</a></dt>
|
||||
<dt id="pyforhandbook.section_03.using_python_evtx.get_events">
|
||||
<code class="sig-name descname">get_events</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">input_file</span></em>, <em class="sig-param"><span class="n">parse_xml</span><span class="o">=</span><span class="default_value">False</span></em><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.section_03.using_python_evtx.get_events" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>Opens a Windows Event Log and returns XML information from
|
||||
the event record.</p>
|
||||
<dl class="field-list simple">
|
||||
|
|
@ -394,8 +392,8 @@ the event record.</p>
|
|||
</dd></dl>
|
||||
|
||||
<dl class="py function">
|
||||
<dt id="sections.section_03.open_evtx.open_evtx">
|
||||
<code class="sig-name descname">open_evtx</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">input_file</span></em><span class="sig-paren">)</span><a class="headerlink" href="#sections.section_03.open_evtx.open_evtx" title="Permalink to this definition">¶</a></dt>
|
||||
<dt id="pyforhandbook.section_03.using_python_evtx.open_evtx">
|
||||
<code class="sig-name descname">open_evtx</code><span class="sig-paren">(</span><em class="sig-param"><span class="n">input_file</span></em><span class="sig-paren">)</span><a class="headerlink" href="#pyforhandbook.section_03.using_python_evtx.open_evtx" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>Opens a Windows Event Log and displays common log parameters.</p>
|
||||
<dl class="field-list simple">
|
||||
<dt class="field-odd">Parameters</dt>
|
||||
|
|
@ -415,12 +413,6 @@ the event record.</p>
|
|||
|
||||
</div>
|
||||
</div>
|
||||
<div class="section" id="section-3-2-iterate-over-events">
|
||||
<h2>Section 3.2 - Iterate over events<a class="headerlink" href="#section-3-2-iterate-over-events" title="Permalink to this headline">¶</a></h2>
|
||||
</div>
|
||||
<div class="section" id="section-3-3-filter-event-data">
|
||||
<h2>Section 3.3 - Filter event data<a class="headerlink" href="#section-3-3-filter-event-data" title="Permalink to this headline">¶</a></h2>
|
||||
</div>
|
||||
<div class="section" id="indices-and-tables">
|
||||
<h2>Indices and tables<a class="headerlink" href="#indices-and-tables" title="Permalink to this headline">¶</a></h2>
|
||||
<ul class="simple">
|
||||
|
|
@ -452,7 +444,7 @@ the event record.</p>
|
|||
<div role="contentinfo">
|
||||
<p>
|
||||
|
||||
© Copyright 2019, Chapin Bryce
|
||||
© Copyright 2020, Chapin Bryce
|
||||
|
||||
</p>
|
||||
</div>
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
|
||||
<title>Section 6 - Sqlite & MacOS/Mobile/Browsers — Python Forensics Handbook 20201015 documentation</title>
|
||||
<title>Section 6 - Sqlite & MacOS/Mobile/Browsers — Python Forensics Handbook 0.1.0 documentation</title>
|
||||
|
||||
|
||||
|
||||
|
|
@ -102,7 +102,7 @@
|
|||
<li class="toctree-l1"><a class="reference internal" href="section2.html">Section 2 - Registry Parsing</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="section3.html">Section 3 - Windows Event Log Parsing</a></li>
|
||||
<li class="toctree-l1 current"><a class="current reference internal" href="#">Section 6 - Sqlite & MacOS/Mobile/Browsers</a><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-sections.section_06.opening_sqlite">Section 6.1 - Opening Sqlite</a><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#module-pyforhandbook.section_06.opening_sqlite">Section 6.1 - Opening Sqlite</a><ul>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#opening-sqlite-configuration">Opening Sqlite configuration</a></li>
|
||||
<li class="toctree-l3"><a class="reference internal" href="#listing-tables-configuration">Listing Tables configuration</a></li>
|
||||
</ul>
|
||||
|
|
@ -179,8 +179,8 @@
|
|||
<h1>Section 6 - Sqlite & MacOS/Mobile/Browsers<a class="headerlink" href="#section-6-sqlite-macos-mobile-browsers" title="Permalink to this headline">¶</a></h1>
|
||||
<div class="toctree-wrapper compound">
|
||||
</div>
|
||||
<div class="section" id="module-sections.section_06.opening_sqlite">
|
||||
<span id="section-6-1-opening-sqlite"></span><h2>Section 6.1 - Opening Sqlite<a class="headerlink" href="#module-sections.section_06.opening_sqlite" title="Permalink to this headline">¶</a></h2>
|
||||
<div class="section" id="module-pyforhandbook.section_06.opening_sqlite">
|
||||
<span id="section-6-1-opening-sqlite"></span><h2>Section 6.1 - Opening Sqlite<a class="headerlink" href="#module-pyforhandbook.section_06.opening_sqlite" title="Permalink to this headline">¶</a></h2>
|
||||
<p>Example for opening and exploring Sqlite databases.</p>
|
||||
<p>Example Usage:</p>
|
||||
<blockquote>
|
||||
|
|
@ -247,7 +247,7 @@ seen at <a class="reference external" href="https://docs.python.org/3/library/sq
|
|||
<div role="contentinfo">
|
||||
<p>
|
||||
|
||||
© Copyright 2019, Chapin Bryce
|
||||
© Copyright 2020, Chapin Bryce
|
||||
|
||||
</p>
|
||||
</div>
|
||||
|
|
|
|||
Loading…
Reference in New Issue