Python Autopsy A Quick Introduction to Scripting Autopsy Brian Carrier

Recommendations

Info

Find big and round files (contd.) • Step #4: Write the analysis logic: • Check the size of each file • If it is big and round, flag it • Recall that file-level Ingest Modules are passed in a file: def process(self, file): • We check the size of the file: if ((file.getSize() > 10000000) and ((file.getSize() % 4096) == 0)): else: # YEA!!!, do something with it return OK #OSDFCon 22
Let’s Tell The World About It! • We’re going <strong>to</strong> make an “Interesting File” artifact art = file.newArtifact(TSK_INTERESTING_FILE_HIT) att = BlackboardAttribute(TSK_SET_NAME, "Big and Round Files") art.addAttribute(att) #OSDFCon 23
Page 1 and 2: Python Autopsy: A Quick Introductio
Page 3 and 4: Why Did We Choose Python? • We we
Page 5 and 6: Background: Very High-level Program
Page 7 and 8: Methods • Method: A set of instru
Page 9 and 10: Writing An Autopsy Module #OSDFCon
Page 11 and 12: Step #1: Pick Your Module Type •
Page 13 and 14: Types of Ingest Modules E01 File Fi
Page 15 and 16: Summary of Python Module Options
Page 17 and 18: Step #3: Search for “TODO” Adap
Page 19 and 20: Step #4: Publish to User • You ne
Page 21: Example: Find big and round files
Page 25 and 26: How the User Uses It #OSDFCon 25
Page 27 and 28: Conclusion • It’s easy to get s

Python Autopsy A Quick Introduction to Scripting Autopsy Brian Carrier

Create successful ePaper yourself

Delete template?

Save as template?