- Learning Python for Forensics
- Preston Miller Chapin Bryce
- 250字
- 2021-07-02 16:41:12
Chapter 3. Parsing Text Files
Text files, usually sourced from application or service logs, are a common source of artifacts in digital investigations. Log files can be quite large or contain data that makes human review difficult. Manual examination can devolve into a series of grep searches, which may or may not be fruitful. Some text files might be supported by prebuilt software. For those that are not, we will need to develop our own solution to properly parse and extract relevant information. In this chapter, we will analyze the setupapi.dev.log
file, which records device information on Windows machines. This log file is commonly analyzed in forensics to extract the first connection time of USB devices on the system. Although our focus is a single log file, note that we could replicate and improve upon this basic design to handle similarly structured files.
We will step through several iterations of the same code through this chapter. Though redundant, we encourage writing out each iteration for yourself. By rewriting the code, we will progress through the material together and find the proper solution, learn about bug handling, and implement efficiency measures. Please rewrite the code for yourself and test each iteration to see the changes in the output and code handling.
In this chapter, we will be covering the following topics:
- Identifying repetitive patterns in the log file for USB device entries
- Extracting and processing artifacts from text files
- Enhancing presentation of data in a deduplicated and readable manner
- PHP動(dòng)態(tài)網(wǎng)站程序設(shè)計(jì)
- HornetQ Messaging Developer’s Guide
- ASP.NET Core 5.0開發(fā)入門與實(shí)戰(zhàn)
- Oracle從新手到高手
- Getting Started with PowerShell
- 算法精粹:經(jīng)典計(jì)算機(jī)科學(xué)問題的Python實(shí)現(xiàn)
- Java加密與解密的藝術(shù)
- C#程序設(shè)計(jì)基礎(chǔ):教程、實(shí)驗(yàn)、習(xí)題
- Scientific Computing with Scala
- Learning Three.js:The JavaScript 3D Library for WebGL
- FPGA Verilog開發(fā)實(shí)戰(zhàn)指南:基于Intel Cyclone IV(進(jìn)階篇)
- 微信小程序全棧開發(fā)技術(shù)與實(shí)戰(zhàn)(微課版)
- Web App Testing Using Knockout.JS
- MyBatis 3源碼深度解析
- PhoneGap 4 Mobile Application Development Cookbook