Design and Implementation of a Documentation Tool for ... - MADOC

The user now enters the letter n and hits the return key (represented as
ASCII byte 0d) in order to execute the command echo -n. After executing the
command (which produces no output), the shell displays the prompt again.
0e 0e 16 00 00 00 00 37 50 74 | .......7Pt|
a3 0f 0e 6e 0f 0e 0e 16 00 00 00 00 00 79 c4 67 |...n.........y.g|
0f 6e 0e 0e 16 00 00 00 00 2e bb 20 01 0f 0e 0d |.n......... ....|
0f 0e 0e 16 00 00 00 00 00 79 f9 df 0f 0d 0a 0e |.........y......|
0e 16 00 00 00 00 02 25 be d3 0f 1b 5d 30 3b 73 |.......%....]0;s|
63 79 40 62 69 6a 61 7a 3a 7e 07 1b 5b 31 3b 33 |cy@bijaz:~..[1;3|
32 6d 73 63 79 1b 5b 30 3b 33 32 6d 40 1b 5b 31 |2mscy.[0;32m@.[1|
3b 33 32 6d 62 69 6a 61 7a 1b 5b 31 3b 33 34 6d |;32mbijaz.[1;34m|
20 7e 20 1b 5b 30 3b 33 36 6d 6d 61 73 74 65 72 | ~ .[0;36mmaster|
20 3f 20 1b 5b 31 3b 33 30 6d 30 2e 31 30 20 1b | ? .[1;30m0.10 .|
5b 30 3b 33 37 6d 31 39 3a 34 36 20 1b 5b 30 3b |[0;37m19:46 .[0;|
33 33 6d 1b 5b 31 3b 33 32 6d 24 1b 5b 30 6d 20 |33m.[1;32m$.[0m |
Note that without recording the users input, it would be impossible to determine
whether the user pressed return to actually run the command or whether
entering the command was cancelled, for example by pressing ^C.
1.587984366 seconds later, the user decides to end the current session by
pressing ^D, which is equivalent to the byte value 04.
0e 0e 16 00 00 00 01 23 0b ed ee 0f 0e 04 0f |.......#....... |
The shell reacts by printing exit and terminating. Then, forscript prints
its shutdown message.
65 | e|
78 69 74 0d 0a 66 6f 72 73 63 72 69 70 74 20 64 |xit..forscript d|
6f 6e 65 20 6f 6e 20 4d 6f 6e 20 32 32 20 46 65 |one on Mon 22 Fe|
62 20 32 30 31 30 20 30 37 3a 34 36 3a 32 31 20 |b 2010 07:46:21 |
50 4d 20 43 45 54 2c 20 66 69 6c 65 20 69 73 20 |PM CET, file is |
74 72 61 6e 73 63 72 69 70 74 0d 0a |transcript.. |
Finally, the exit status (0) of the shell is recorded in an end of session
metadata chunk and the transcript file ends.
0e 0e 03 00 | ....|
0f |.|
6 Conclusions and Future Work
We presented why script, although often used for digital investigations, lacks
features that are crucial for reliable documentation. A new software, forscript,
has been designed and implemented, the weaknesses of script have been eliminated.
13