112 lines
1.8 KiB
Markdown
112 lines
1.8 KiB
Markdown
# Outline
|
|
|
|
Outline of chapters and sections of the book. For quick reference
|
|
on where to find the snippet you are looking for. Each snippet
|
|
should drop into another script without significant tweaking
|
|
|
|
## Section 1 - Essential Script Snippets
|
|
|
|
### Argparse
|
|
|
|
Sample argparse usage and help information
|
|
|
|
### Logging
|
|
|
|
Setting up a basic logger with stdout and log file support.
|
|
|
|
### Recursive file explorations
|
|
|
|
### CSV writing
|
|
|
|
For Python 2 and 3, also unicode csv. Drop into any
|
|
|
|
### Parallel Processing
|
|
|
|
Simple implementation of multithreading and multiprocessing
|
|
|
|
- Show off calling volatility?
|
|
|
|
## Section 2 - Registry Hives with YARP
|
|
|
|
### Using yarp to open a single hive
|
|
|
|
Opening a hive and confirming it's the one you want to view
|
|
|
|
### Read key information/metadata
|
|
|
|
- USB Devices
|
|
|
|
### Read value information/metadata
|
|
|
|
- USB Devices
|
|
|
|
### YARP hive file + transaction logs/other registry fragments
|
|
|
|
- Show how we can get more data with this method
|
|
|
|
## Section 3 - Event Logs
|
|
|
|
### Using python-evtx
|
|
|
|
#### Opening evtx files
|
|
|
|
- Counts/Metadata about EVTX container
|
|
|
|
#### Parsing Logins (with types, levels, privs)
|
|
|
|
#### Parsing Logouts (durations)
|
|
|
|
#### Parsing Powershell decoding
|
|
|
|
## Section 4 - Text logs
|
|
|
|
### Handling IIS Logs
|
|
|
|
### Handling Syslog
|
|
|
|
### Adding in GeoIP
|
|
|
|
## Section 5 - API calls & JSON data
|
|
|
|
### VirusTotal
|
|
|
|
### HybridAnalysis
|
|
|
|
### Manipulating JSON
|
|
|
|
- Lists of dictionaries
|
|
|
|
## Section 6 - SQLite & macOS/mobile/browsers
|
|
|
|
### macOS Activity
|
|
|
|
- KnowledgeC
|
|
|
|
### Andriod SMS
|
|
|
|
### Google Chome History DB
|
|
|
|
## Section 7 - Opening forensic images
|
|
|
|
### LibEWF
|
|
|
|
- Expose an E01 as a raw image
|
|
|
|
### PyTSK
|
|
|
|
#### Read data from a raw image
|
|
|
|
- Read MBR/GPT
|
|
|
|
#### Read data from a file
|
|
|
|
- Hashing a file
|
|
|
|
#### Iterate through folders
|
|
|
|
- Generate a metadata rich file listing
|
|
|
|
#### Perform targetted reads
|
|
|
|
- Signature look ups
|