Updated README.md
This commit is contained in:
Chapin Bryce
parent
0c378d7607
commit
fc80d11ed6
|
|
@ -5,7 +5,7 @@ pages:
|
|||
- apk --no-cache add make gcc musl-dev git
|
||||
- pip install -r dev_requirements.txt
|
||||
- pip install -r requirements.txt
|
||||
- cd docssrc
|
||||
- cd doc_src
|
||||
- make html
|
||||
- mv _build/html ../public
|
||||
artifacts:
|
||||
|
|
|
|||
111
Outline.md
111
Outline.md
|
|
@ -1,111 +0,0 @@
|
|||
# Outline
|
||||
|
||||
Outline of chapters and sections of the book. For quick reference
|
||||
on where to find the snippet you are looking for. Each snippet
|
||||
should drop into another script without significant tweaking
|
||||
|
||||
## Section 1 - Essential Script Snippets
|
||||
|
||||
### Argparse
|
||||
|
||||
Sample argparse usage and help information
|
||||
|
||||
### Logging
|
||||
|
||||
Setting up a basic logger with stdout and log file support.
|
||||
|
||||
### Recursive file explorations
|
||||
|
||||
### CSV writing
|
||||
|
||||
For Python 2 and 3, also unicode csv. Drop into any
|
||||
|
||||
### Parallel Processing
|
||||
|
||||
Simple implementation of multithreading and multiprocessing
|
||||
|
||||
- Show off calling volatility?
|
||||
|
||||
## Section 2 - Registry Hives with YARP
|
||||
|
||||
### Using yarp to open a single hive
|
||||
|
||||
Opening a hive and confirming it's the one you want to view
|
||||
|
||||
### Read key information/metadata
|
||||
|
||||
- USB Devices
|
||||
|
||||
### Read value information/metadata
|
||||
|
||||
- USB Devices
|
||||
|
||||
### YARP hive file + transaction logs/other registry fragments
|
||||
|
||||
- Show how we can get more data with this method
|
||||
|
||||
## Section 3 - Event Logs
|
||||
|
||||
### Using python-evtx
|
||||
|
||||
#### Opening evtx files
|
||||
|
||||
- Counts/Metadata about EVTX container
|
||||
|
||||
#### Parsing Logins (with types, levels, privs)
|
||||
|
||||
#### Parsing Logouts (durations)
|
||||
|
||||
#### Parsing Powershell decoding
|
||||
|
||||
## Section 4 - Text logs
|
||||
|
||||
### Handling IIS Logs
|
||||
|
||||
### Handling Syslog
|
||||
|
||||
### Adding in GeoIP
|
||||
|
||||
## Section 5 - API calls & JSON data
|
||||
|
||||
### VirusTotal
|
||||
|
||||
### HybridAnalysis
|
||||
|
||||
### Manipulating JSON
|
||||
|
||||
- Lists of dictionaries
|
||||
|
||||
## Section 6 - SQLite & macOS/mobile/browsers
|
||||
|
||||
### macOS Activity
|
||||
|
||||
- KnowledgeC
|
||||
|
||||
### Andriod SMS
|
||||
|
||||
### Google Chome History DB
|
||||
|
||||
## Section 7 - Opening forensic images
|
||||
|
||||
### LibEWF
|
||||
|
||||
- Expose an E01 as a raw image
|
||||
|
||||
### PyTSK
|
||||
|
||||
#### Read data from a raw image
|
||||
|
||||
- Read MBR/GPT
|
||||
|
||||
#### Read data from a file
|
||||
|
||||
- Hashing a file
|
||||
|
||||
#### Iterate through folders
|
||||
|
||||
- Generate a metadata rich file listing
|
||||
|
||||
#### Perform targetted reads
|
||||
|
||||
- Signature look ups
|
||||
31
README.md
31
README.md
|
|
@ -1,5 +1,34 @@
|
|||
# Python Forensics Handbook
|
||||
|
||||
A handy reference guide for building Python scripts to help out
|
||||
Digital Forensic, Incident Response, and other Cyber Secutiry
|
||||
Digital Forensic, Incident Response, and other Cyber Security
|
||||
tools.
|
||||
|
||||
## Accessing the Handbook
|
||||
|
||||
There are several ways you can access the content in this handbook:
|
||||
|
||||
* Online at [https://chapinb.com/python-forensics-handboook](https://chapinb.com/python-forensics-handbook)
|
||||
* Accessing the latest release available GitHub at
|
||||
[https://github.com/chapinb/python-forensics-handbook/releases](https://github.com/chapinb/python-forensics-handbook/releases)
|
||||
and downloading the `pyforhandbook_html_docs_{version}.zip` file. You can
|
||||
then extract the arvhive and open `index.html` in your web browser.
|
||||
* Cloning the repository and checking out the gh-pages branch.
|
||||
* Building it yourself! See instructions below.
|
||||
|
||||
|
||||
## Building the handbook
|
||||
|
||||
To build this handbook, you will need Python 3.6 or later. To start, clone the master branch (or check out
|
||||
a tag for the release you want to build.) Then install all requirements by running `pip install -r requirements.txt`.
|
||||
|
||||
Once that finishes, navigate to the `doc_src/` directory and run `make html`. This will run on Windows, Linux, or macOS.
|
||||
After the make command completes, you can view the built documentation within the `doc_src/_build/html` folder.
|
||||
|
||||
## Contributing
|
||||
|
||||
Have an idea for a section or a function that you would like to share? Please follow the above steps in
|
||||
"Building the handbook", add your changes, and open a pull request to get it integrated in to the repository!
|
||||
|
||||
More details on how to contribute coming soon. In the meantime, if you have any questions about the above, feel free
|
||||
to open an issue on Github or reach out to me on Twitter @chapindb.
|
||||
|
|
|
|||
Loading…
Reference in New Issue