457 lines
14 KiB
HTML
457 lines
14 KiB
HTML
|
|
|
|
<!DOCTYPE html>
|
|
<html class="writer-html5" lang="en" >
|
|
<head>
|
|
<meta charset="utf-8">
|
|
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
|
|
<title>The Python Forensics Handbook — Python Forensics Handbook 0.1.2 documentation</title>
|
|
|
|
|
|
|
|
<link rel="stylesheet" href="_static/css/theme.css" type="text/css" />
|
|
<link rel="stylesheet" href="_static/pygments.css" type="text/css" />
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<!--[if lt IE 9]>
|
|
<script src="_static/js/html5shiv.min.js"></script>
|
|
<![endif]-->
|
|
|
|
|
|
<script type="text/javascript" id="documentation_options" data-url_root="./" src="_static/documentation_options.js"></script>
|
|
<script src="_static/jquery.js"></script>
|
|
<script src="_static/underscore.js"></script>
|
|
<script src="_static/doctools.js"></script>
|
|
<script src="_static/language_data.js"></script>
|
|
|
|
<script type="text/javascript" src="_static/js/theme.js"></script>
|
|
|
|
|
|
<link rel="index" title="Index" href="genindex.html" />
|
|
<link rel="search" title="Search" href="search.html" />
|
|
<link rel="next" title="Chapter 1 - Essential Scripts" href="ch01_essentials.html" />
|
|
|
|
<!-- Global site tag (gtag.js) - Google Analytics -->
|
|
<script async src="https://www.googletagmanager.com/gtag/js?id=UA-17386833-12"></script>
|
|
<script>
|
|
window.dataLayer = window.dataLayer || [];
|
|
function gtag(){dataLayer.push(arguments);}
|
|
gtag('js', new Date());
|
|
|
|
gtag('config', 'UA-17386833-12');
|
|
</script>
|
|
|
|
</head>
|
|
|
|
<body class="wy-body-for-nav">
|
|
|
|
|
|
<div class="wy-grid-for-nav">
|
|
|
|
<nav data-toggle="wy-nav-shift" class="wy-nav-side">
|
|
<div class="wy-side-scroll">
|
|
<div class="wy-side-nav-search" >
|
|
|
|
|
|
|
|
<a href="#" class="icon icon-home" alt="Documentation Home"> Python Forensics Handbook
|
|
|
|
|
|
|
|
</a>
|
|
|
|
|
|
|
|
|
|
<div class="version">
|
|
0.1.2
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<div role="search">
|
|
<form id="rtd-search-form" class="wy-form" action="search.html" method="get">
|
|
<input type="text" name="q" placeholder="Search docs" />
|
|
<input type="hidden" name="check_keywords" value="yes" />
|
|
<input type="hidden" name="area" value="default" />
|
|
</form>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
<div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="main navigation">
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<p class="caption"><span class="caption-text">Table of Contents:</span></p>
|
|
<ul>
|
|
<li class="toctree-l1"><a class="reference internal" href="ch01_essentials.html">Chapter 1 - Essential Scripts</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="ch02_registry.html">Chapter 2 - Registry Parsing</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="ch03_event_logs.html">Chapter 3 - Windows Event Log Parsing</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="ch06_databases.html">Chapter 6 - Sqlite & MacOS/Mobile/Browsers</a></li>
|
|
</ul>
|
|
|
|
|
|
|
|
</div>
|
|
|
|
</div>
|
|
</nav>
|
|
|
|
<section data-toggle="wy-nav-shift" class="wy-nav-content-wrap">
|
|
|
|
|
|
<nav class="wy-nav-top" aria-label="top navigation">
|
|
|
|
<i data-toggle="wy-nav-top" class="fa fa-bars"></i>
|
|
<a href="#">Python Forensics Handbook</a>
|
|
|
|
</nav>
|
|
|
|
|
|
<div class="wy-nav-content">
|
|
|
|
<div class="rst-content">
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<div role="navigation" aria-label="breadcrumbs navigation">
|
|
|
|
<ul class="wy-breadcrumbs">
|
|
|
|
<li><a href="#" class="icon icon-home"></a> »</li>
|
|
|
|
<li>The Python Forensics Handbook</li>
|
|
|
|
|
|
<li class="wy-breadcrumbs-aside">
|
|
|
|
|
|
<a href="_sources/index.rst.txt" rel="nofollow"> View page source</a>
|
|
|
|
|
|
</li>
|
|
|
|
</ul>
|
|
|
|
|
|
<hr/>
|
|
</div>
|
|
<div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
|
|
<div itemprop="articleBody">
|
|
|
|
<div class="section" id="the-python-forensics-handbook">
|
|
<h1>The Python Forensics Handbook<a class="headerlink" href="#the-python-forensics-handbook" title="Permalink to this headline">¶</a></h1>
|
|
<div class="section" id="a-reference-guide-for-developing-python-scripts-in-dfir">
|
|
<h2>A reference guide for developing Python scripts in DFIR<a class="headerlink" href="#a-reference-guide-for-developing-python-scripts-in-dfir" title="Permalink to this headline">¶</a></h2>
|
|
<div class="toctree-wrapper compound">
|
|
<p class="caption"><span class="caption-text">Table of Contents:</span></p>
|
|
<ul>
|
|
<li class="toctree-l1"><a class="reference internal" href="ch01_essentials.html">Chapter 1 - Essential Scripts</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="ch02_registry.html">Chapter 2 - Registry Parsing</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="ch03_event_logs.html">Chapter 3 - Windows Event Log Parsing</a></li>
|
|
<li class="toctree-l1"><a class="reference internal" href="ch06_databases.html">Chapter 6 - Sqlite & MacOS/Mobile/Browsers</a></li>
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="module-pyforhandbook">
|
|
<span id="handbook-sections"></span><h1>Handbook Sections<a class="headerlink" href="#module-pyforhandbook" title="Permalink to this headline">¶</a></h1>
|
|
<div class="admonition note">
|
|
<p class="admonition-title">Note</p>
|
|
<p>IN DEVELOPMENT - More sections will release over the coming weeks/months/as
|
|
time permits. Feel free to contribute as you have an idea or time to assist,
|
|
otherwise stay tuned!</p>
|
|
</div>
|
|
<p>This handbook consists of 7 sections covering common tasks for developing
|
|
Python scripts for use in DFIR. Each section contains short,
|
|
portable code blocks that can drop into a new script with minimal
|
|
tweaking. This way, you can quickly build out your custom script
|
|
without needing to re-invent the wheel each time.</p>
|
|
<p>This handbook is not intended to be read in order - if anything
|
|
this outline is the main launching point to find the correct page
|
|
containing the code block you wish to reference.</p>
|
|
<p>Please feel free to contribute your own sections with the snippets that have
|
|
worked well for you, even if a similar section already exists. This handbook
|
|
is hosted on GitHub at <a class="reference external" href="https://github.com/chapinb/python-forensics-handbook">https://github.com/chapinb/python-forensics-handbook</a> and
|
|
available to read online at <a class="reference external" href="https://chapinb.com/python-forensics-handbook">https://chapinb.com/python-forensics-handbook</a>.
|
|
Please consider submitting a pull request with your additions!</p>
|
|
<div class="section" id="chapter-1-essential-script-elements">
|
|
<h2>Chapter 1 - Essential Script Elements<a class="headerlink" href="#chapter-1-essential-script-elements" title="Permalink to this headline">¶</a></h2>
|
|
<p>This chapter covers code blocks that are useful across scripts
|
|
and are not DFIR specific, but solid practices to integrate into
|
|
projects to allow for uniformity.</p>
|
|
<ul class="simple">
|
|
<li><dl class="simple">
|
|
<dt>Argparse</dt><dd><ul>
|
|
<li><p>Command line parameter handling</p></li>
|
|
</ul>
|
|
</dd>
|
|
</dl>
|
|
</li>
|
|
<li><dl class="simple">
|
|
<dt>Logging</dt><dd><ul>
|
|
<li><p>Writing status and error messages to the console and
|
|
log file</p></li>
|
|
</ul>
|
|
</dd>
|
|
</dl>
|
|
</li>
|
|
<li><dl class="simple">
|
|
<dt>Open Files</dt><dd><ul>
|
|
<li><p>Read text files with varying UTF encodings.</p></li>
|
|
</ul>
|
|
</dd>
|
|
</dl>
|
|
</li>
|
|
<li><dl class="simple">
|
|
<dt>CSV Generation</dt><dd><ul>
|
|
<li><p>For better or worse, CSV reports are very common in DFIR
|
|
and this code block covers several methods for
|
|
generating a CSV</p></li>
|
|
</ul>
|
|
</dd>
|
|
</dl>
|
|
</li>
|
|
<li><dl class="simple">
|
|
<dt>Recursive File Exploration</dt><dd><ul>
|
|
<li><p>Quick example of code to explore directories and access
|
|
nested files.</p></li>
|
|
</ul>
|
|
</dd>
|
|
</dl>
|
|
</li>
|
|
<li><dl class="simple">
|
|
<dt>Parallel Processing</dt><dd><ul>
|
|
<li><p>Simple implementation of multithreading and multiprocessing</p></li>
|
|
</ul>
|
|
</dd>
|
|
</dl>
|
|
</li>
|
|
</ul>
|
|
</div>
|
|
<div class="section" id="chapter-2-registry-hives">
|
|
<h2>Chapter 2 - Registry Hives<a class="headerlink" href="#chapter-2-registry-hives" title="Permalink to this headline">¶</a></h2>
|
|
<p>In this chapter, we demonstrate how to open a registry hive, navigate through
|
|
its keys, and interact with values to expose information for analysis.</p>
|
|
<ul class="simple">
|
|
<li><dl class="simple">
|
|
<dt>Using yarp to open a single hive</dt><dd><ul>
|
|
<li><p>Opening a hive and recovering data available in transaction logs</p></li>
|
|
</ul>
|
|
</dd>
|
|
</dl>
|
|
</li>
|
|
<li><dl class="simple">
|
|
<dt>Parse registry hive keys and values</dt><dd><ul>
|
|
<li><p>Building off our prior code to parse specific artifacts from an
|
|
NTUSER.DAT hive, including string and binary values. Uses classes in a
|
|
manner that is very flexible and permits extending functionality as
|
|
needed with minimal effort.</p></li>
|
|
</ul>
|
|
</dd>
|
|
</dl>
|
|
</li>
|
|
<li><dl class="simple">
|
|
<dt>Searching for a pattern across hive keys and values.</dt><dd><ul>
|
|
<li><p>Looking for a provided pattern across the entire hive.</p></li>
|
|
</ul>
|
|
</dd>
|
|
</dl>
|
|
</li>
|
|
</ul>
|
|
</div>
|
|
<div class="section" id="chapter-3-event-logs">
|
|
<h2>Chapter 3 - Event Logs<a class="headerlink" href="#chapter-3-event-logs" title="Permalink to this headline">¶</a></h2>
|
|
<p>The functions showcased in this chapter highlight methods to access events
|
|
within Windows event log files, iterating over the events, and extracting
|
|
useful records for further examination.</p>
|
|
<ul class="simple">
|
|
<li><dl class="simple">
|
|
<dt>Using python-evtx</dt><dd><ul>
|
|
<li><p>Opening evtx files</p></li>
|
|
<li><p>Iterating over events</p></li>
|
|
</ul>
|
|
</dd>
|
|
</dl>
|
|
</li>
|
|
<li><dl class="simple">
|
|
<dt>Parsing Logins</dt><dd><ul>
|
|
<li><p>Parse out the commonly investigated 4624/4672 events</p></li>
|
|
</ul>
|
|
</dd>
|
|
</dl>
|
|
</li>
|
|
</ul>
|
|
</div>
|
|
<div class="section" id="chapter-4-text-logs">
|
|
<h2>Chapter 4 - Text logs<a class="headerlink" href="#chapter-4-text-logs" title="Permalink to this headline">¶</a></h2>
|
|
<ul class="simple">
|
|
<li><dl class="simple">
|
|
<dt>Handling IIS Logs</dt><dd><ul>
|
|
<li><p>Parse common fields in IIS logs into a report</p></li>
|
|
</ul>
|
|
</dd>
|
|
</dl>
|
|
</li>
|
|
<li><dl class="simple">
|
|
<dt>Handling Syslog</dt><dd><ul>
|
|
<li><p>Parse common syslog formats into a report</p></li>
|
|
</ul>
|
|
</dd>
|
|
</dl>
|
|
</li>
|
|
<li><dl class="simple">
|
|
<dt>Adding in GeoIP</dt><dd><ul>
|
|
<li><p>Function to add GeoIP recognition</p></li>
|
|
</ul>
|
|
</dd>
|
|
</dl>
|
|
</li>
|
|
</ul>
|
|
</div>
|
|
<div class="section" id="chapter-5-api-calls-json-data">
|
|
<h2>Chapter 5 - API calls & JSON data<a class="headerlink" href="#chapter-5-api-calls-json-data" title="Permalink to this headline">¶</a></h2>
|
|
<ul class="simple">
|
|
<li><p>VirusTotal</p></li>
|
|
<li><p>HybridAnalysis</p></li>
|
|
<li><p>Manipulating JSON</p></li>
|
|
</ul>
|
|
</div>
|
|
<div class="section" id="chapter-6-databases">
|
|
<h2>Chapter 6 - Databases<a class="headerlink" href="#chapter-6-databases" title="Permalink to this headline">¶</a></h2>
|
|
<p>Databases are found within many applications and operating systems. This chapter
|
|
covers methods to extract information from these common databases, along with
|
|
functions that are purpose built to parse information from frequently seen
|
|
database tables.</p>
|
|
<ul class="simple">
|
|
<li><dl class="simple">
|
|
<dt>macOS Activity</dt><dd><ul>
|
|
<li><p>KnowledgeC</p></li>
|
|
</ul>
|
|
</dd>
|
|
</dl>
|
|
</li>
|
|
<li><p>Android SMS</p></li>
|
|
<li><p>Google Chrome History DB</p></li>
|
|
</ul>
|
|
</div>
|
|
<div class="section" id="chapter-7-opening-forensic-images">
|
|
<h2>Chapter 7 - Opening forensic images<a class="headerlink" href="#chapter-7-opening-forensic-images" title="Permalink to this headline">¶</a></h2>
|
|
<p>Media acquisition and preservation formats are very common within DFIR and
|
|
the ability to extract specific contents from these files leads to faster
|
|
analysis and simplified usage of the tool you are building. With these functions
|
|
you can read files from a forensic image and pass them straight to your other
|
|
utilities for further parsing.</p>
|
|
<ul class="simple">
|
|
<li><dl class="simple">
|
|
<dt>LibEWF</dt><dd><ul>
|
|
<li><p>Expose an E01 as a raw image</p></li>
|
|
</ul>
|
|
</dd>
|
|
</dl>
|
|
</li>
|
|
<li><dl class="simple">
|
|
<dt>PyTSK</dt><dd><ul>
|
|
<li><p>Read data from a raw image (MBR)</p></li>
|
|
<li><p>Read data from a file (hashing)</p></li>
|
|
<li><p>Iterate through folders (file listing)</p></li>
|
|
<li><p>Perform targeted reads (file signatures)</p></li>
|
|
</ul>
|
|
</dd>
|
|
</dl>
|
|
</li>
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="indices-and-tables">
|
|
<h1>Indices and tables<a class="headerlink" href="#indices-and-tables" title="Permalink to this headline">¶</a></h1>
|
|
<ul class="simple">
|
|
<li><p><a class="reference internal" href="genindex.html"><span class="std std-ref">Index</span></a></p></li>
|
|
<li><p><a class="reference internal" href="py-modindex.html"><span class="std std-ref">Module Index</span></a></p></li>
|
|
<li><p><a class="reference internal" href="search.html"><span class="std std-ref">Search Page</span></a></p></li>
|
|
</ul>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
|
|
</div>
|
|
<footer>
|
|
|
|
<div class="rst-footer-buttons" role="navigation" aria-label="footer navigation">
|
|
|
|
<a href="ch01_essentials.html" class="btn btn-neutral float-right" title="Chapter 1 - Essential Scripts" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right"></span></a>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
<hr/>
|
|
|
|
<div role="contentinfo">
|
|
<p>
|
|
|
|
© Copyright 2020, Chapin Bryce
|
|
|
|
</p>
|
|
</div>
|
|
|
|
|
|
|
|
Built with <a href="http://sphinx-doc.org/">Sphinx</a> using a
|
|
|
|
<a href="https://github.com/rtfd/sphinx_rtd_theme">theme</a>
|
|
|
|
provided by <a href="https://readthedocs.org">Read the Docs</a>.
|
|
|
|
</footer>
|
|
|
|
</div>
|
|
</div>
|
|
|
|
</section>
|
|
|
|
</div>
|
|
|
|
|
|
<script type="text/javascript">
|
|
jQuery(function () {
|
|
SphinxRtdTheme.Navigation.enable(true);
|
|
});
|
|
</script>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
</body>
|
|
</html> |