Python Autopsy A Quick Introduction to Scripting Autopsy Brian Carrier

Recommendations

Info

Step #4: Write the “Analysis Method” • Each module type has a method that does the analytics. • For example, File Ingest Modules have a method named “process” that is passed in a file to analyze. def process(self, file): • It is defined in the template you copied. • You write the steps in the method to do whatever you want. #OSDFCon 18
Step #4: Publish to User • You need to get your results to the user somehow. • Two common ways: 1. Lazy: Save output to a file and add file as a “Report”. 2. Better: Create an artifact and post it to the blackboard. • ARTIFACT: WEB_BOOKMARK • URL: http://www.sleuthkit.org/ • DATE: October 28, 2015 • Artifacts and reports are both shown in the tree. #OSDFCon 19
Page 1 and 2: Python Autopsy: A Quick Introductio
Page 3 and 4: Why Did We Choose Python? • We we
Page 5 and 6: Background: Very High-level Program
Page 7 and 8: Methods • Method: A set of instru
Page 9 and 10: Writing An Autopsy Module #OSDFCon
Page 11 and 12: Step #1: Pick Your Module Type •
Page 13 and 14: Types of Ingest Modules E01 File Fi
Page 15 and 16: Summary of Python Module Options
Page 17: Step #3: Search for “TODO” Adap
Page 21 and 22: Example: Find big and round files
Page 23 and 24: Let’s Tell The World About It!
Page 25 and 26: How the User Uses It #OSDFCon 25
Page 27 and 28: Conclusion • It’s easy to get s

Python Autopsy A Quick Introduction to Scripting Autopsy Brian Carrier

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?