- Learning Python for Forensics
- Preston Miller Chapin Bryce
- 231字
- 2021-08-20 10:17:09
Overview
Before developing any code, let's identify the requirements and features our script must possess to accomplish the desired task. We will need to execute the following steps:
- Open the log file and read all lines
- In each line, check for indicators of a USB device entry
- Parse responsive lines for timestamp and device information
- Output the result to the user
Now, let's examine the log file of interest to determine repetitive structures that we can use as footholds in our script to parse the relevant data. In the following sample USB entry, we can see the device information on line 1 following the text Device Install (Hardware initiated). This device information contains the VID, PID, device revision, and the unique ID of the device. Each of these elements is separated by either a & or _ character and may contain some additional inconsequential characters. The installation time is recorded on line 2, following the Section start text. For our purposes, we are only interested in these two lines. All other surrounding lines will be ignored, as they relate to operating system driver information:
001 >>> [Setup online Device Install (Hardware initiated) - pciven_15ad&dev_07a0&subsys_07a015ad&rev_013&18d45aa6&0&a9]
002 >>> Section start 2010/11/10 10:21:12.593
003 ump: Creating Install Process: DrvInst.exe 10:21:12.593
004 ndv: Retrieving device info...
005 ndv: Setting device parameters...
006 ndv: Searching Driver Store and Device Path...
007 dvi: {Build Driver List} 10:21:12.640
- Android應用安全實戰:Frida協議分析
- DevSecOps敏捷安全
- Metasploit Penetration Testing Cookbook(Third Edition)
- 腦洞大開:滲透測試另類實戰攻略
- 網絡安全保障能力研究
- Web安全與攻防入門很輕松(實戰超值版)
- Computer Forensics with FTK
- Mastering Reverse Engineering
- 信息技術基礎:提高篇·實驗與習題
- CTF快速上手:PicoCTF真題解析(Web篇)
- 網絡空間安全法律問題研究
- Securing Network Infrastructure
- 黑客攻防入門
- 網絡空間安全體系
- INSTANT Microsoft Forefront UAG Mobile Configuration Starter