Exemplo n.º 1
0
def process_image(dfir, images, image_path):
    
    status = images.mount(image_path)
    if (status is False):
        return(status)
    
    # Walk through all of the newly mounted volumes
    for volume in images.volumes:
        print "Processing volume: " + volume[0]

        # Pseudocode -
        # dfir.process(volume)
        # Where dfir.process will do stuff based on config file
        dfir_registry.system_metadata(dfir, drive, image_path)        
        ripxp(dfir, drive, image_path)
        
        images.unmount(drive)
        return (True)
Exemplo n.º 2
0
        # process_volume should contain the call to dfir.dostuff(volume)
        
        if (args.volume_path is not None):
            process_volume(dfir, args.volume_path)
        else:                        
            status = images.mount(image_path)
            if (status is False):
                print "Unable to mount ", image_path
                sys.exit()
                
    
            # Walk through all of the newly mounted drives
            for volume in images.volumes:
                print "Processing volume: " + volume[0]

                dfir_registry.system_metadata(dfir, volume, image_path)        
        ripxp(dfir, drive, image_path)
        
        images.unmount(drive)
        return (True)
            # Pseudo code - mount (image_file)
            # for each volume in image:
            #   process_volume(dfir, volume_path)
            
            process_image(dfir, images, args.image_file)
    
    else:
        
        try:
            fd = open(args.list_file, 'r')