return mft_entry_hist
########################################################################################################################
# MAIN
if __name__ == '__main__':
args = parse_args(sys.argv[1:])
usnjrnl_file = NamedTemporaryFile()
logfile_file = NamedTemporaryFile()
# Parse the MFT first
sector = BootSector(image_name=args.image,
offset_sectors=args.offset_sectors,
offset_bytes=args.offset_bytes,
sector_size=args.sector_size)
mft = MFT(image_name=args.image, boot_sector=sector)
mft.parse_all()
# get the inum (MFT entry number) of the $UsnJrnl --> located in $Extend|$INDEX_ROOT attribute
usn_jrnl_inum = mft.entries[11].\
attributes[AttributeTypeEnum.INDEX_ROOT][0].\
entries[AttributeTypeEnum.FILE_NAME]['$UsnJrnl'].\
file_reference_mft_entry
# carve out the logfile (inum 2) and store in local temporary file
mft.extract_data(inum=2, output_file=logfile_file.name, stream=0)
# carve out the $UsnJrnl (inum searched for above) and store in local temporary file
mft.extract_data(inum=usn_jrnl_inum,
output_file=usnjrnl_file.name,
stream=0)
# return the list, otherwise the data_list variable is appended in obfuscation
return mft_entry_hist
########################################################################################################################
# MAIN
if __name__ == '__main__':
args = parse_args(sys.argv[1:])
usnjrnl_file = NamedTemporaryFile()
logfile_file = NamedTemporaryFile()
# Parse the MFT first
sector = BootSector(image_name=args.image,
offset_sectors=args.offset_sectors,
offset_bytes=args.offset_bytes,
sector_size=args.sector_size)
mft = MFT(image_name=args.image, boot_sector=sector)
mft.parse_all()
# get the inum (MFT entry number) of the $UsnJrnl --> located in $Extend|$INDEX_ROOT attribute
usn_jrnl_inum = mft.entries[11].\
attributes[AttributeTypeEnum.INDEX_ROOT][0].\
entries[AttributeTypeEnum.FILE_NAME]['$UsnJrnl'].\
file_reference_mft_entry
# carve out the logfile (inum 2) and store in local temporary file
mft.extract_data(inum=2, output_file=logfile_file.name, stream=0)
# carve out the $UsnJrnl (inum searched for above) and store in local temporary file
mft.extract_data(inum=usn_jrnl_inum, output_file=usnjrnl_file.name, stream=0)
# pass the temporary logfile-file into the $LogFile class and parse it
log_file = LogFile(dump_dir=args.dump_dir, file_name=logfile_file.name)
parents=[common_arguments],
description=help,
help=help)
return parser.parse_args(argument_string)
if __name__ == '__main__':
args = parse_args(sys.argv[1:])
if args.image:
sector = BootSector(image_name=args.image,
offset_sectors=args.offset_sectors,
offset_bytes=args.offset_bytes,
sector_size=args.sector_size)
mft = MFT(image_name=args.image, boot_sector=sector)
# Export
if args.action == 'export':
# Parsing
if args.inums == 'all':
mft.parse_all()
range = None
else:
range = InumRange(args.inums)
mft.parse_inums(inum_range=range)
# Exporting
if args.export_type == 'parsed':
mft.export_parsed(inum_range=range, export_file=args.export_file)
elif args.export_type == 'csv':
description=help,
help=help)
return parser.parse_args(argument_string)
if __name__ == '__main__':
args = parse_args(sys.argv[1:])
if args.image:
sector = BootSector(image_name=args.image,
offset_sectors=args.offset_sectors,
offset_bytes=args.offset_bytes,
sector_size=args.sector_size)
mft = MFT(image_name=args.image, boot_sector=sector)
# Export
if args.action == 'export':
# Parsing
if args.inums == 'all':
mft.parse_all()
range = None
else:
range = InumRange(args.inums)
mft.parse_inums(inum_range=range)
# Exporting
if args.export_type == 'parsed':
mft.export_parsed(inum_range=range, export_file=args.export_file)
elif args.export_type == 'csv':