├── .gitattributes ├── Chapter01 ├── copy_metadata.py ├── file_metadata.py ├── hashing.py ├── logging_recipe.py ├── multiproc_example.py ├── os_walk.py ├── progressbars.py └── simple_arguments.py ├── Chapter02 ├── .DS_Store ├── ftk_parser.py ├── html_dashboard.py ├── light-bootstrap-dashboard │ ├── .DS_Store │ ├── LICENSE.md │ ├── README.md │ └── assets │ │ ├── css │ │ ├── animate.min.css │ │ ├── bootstrap.min.css │ │ ├── demo.css │ │ ├── light-bootstrap-dashboard.css │ │ └── pe-icon-7-stroke.css │ │ ├── fonts │ │ ├── Pe-icon-7-stroke.eot │ │ ├── Pe-icon-7-stroke.svg │ │ ├── Pe-icon-7-stroke.ttf │ │ └── Pe-icon-7-stroke.woff │ │ ├── img │ │ ├── default-avatar.png │ │ ├── faces │ │ │ ├── face-0.jpg │ │ │ ├── face-1.jpg │ │ │ ├── face-2.jpg │ │ │ ├── face-3.jpg │ │ │ ├── face-4.jpg │ │ │ ├── face-5.jpg │ │ │ ├── face-6.jpg │ │ │ ├── face-7.jpg │ │ │ └── tim_vector.jpe │ │ ├── favicon.ico │ │ ├── loading-bubbles.svg │ │ ├── mask.png │ │ ├── new_logo.png │ │ ├── sidebar-1.jpg │ │ ├── sidebar-2.jpg │ │ ├── sidebar-3.jpg │ │ ├── sidebar-4.jpg │ │ ├── sidebar-5.jpg │ │ └── tim_80x80.png │ │ ├── js │ │ ├── bootstrap-checkbox-radio-switch.js │ │ ├── bootstrap-notify.js │ │ ├── bootstrap-select.js │ │ ├── bootstrap.min.js │ │ ├── chartist.min.js │ │ ├── jquery-1.10.2.js │ │ └── light-bootstrap-dashboard.js │ │ └── sass │ │ ├── lbd │ │ ├── _alerts.scss │ │ ├── _buttons.scss │ │ ├── _cards.scss │ │ ├── _chartist.scss │ │ ├── _checkbox-radio-switch.scss │ │ ├── _dropdown.scss │ │ ├── _footers.scss │ │ ├── _inputs.scss │ │ ├── _misc.scss │ │ ├── _mixins.scss │ │ ├── _navbars.scss │ │ ├── _responsive.scss │ │ ├── _sidebar-and-main-panel.scss │ │ ├── _tables.scss │ │ ├── _typography.scss │ │ ├── _variables.scss │ │ └── mixins │ │ │ ├── _buttons.scss │ │ │ ├── _cards.scss │ │ │ ├── _chartist.scss │ │ │ ├── _icons.scss │ │ │ ├── _inputs.scss │ │ │ ├── _labels.scss │ │ │ ├── _morphing-buttons.scss │ │ │ ├── _navbars.scss │ │ │ ├── _social-buttons.scss │ │ │ ├── _tabs.scss │ │ │ ├── _transparency.scss │ │ │ └── _vendor-prefixes.scss │ │ └── light-bootstrap-dashboard.scss ├── output_writer.py ├── redacted_sample_event_log.csv ├── screenshotter.py ├── utility │ ├── __init__.py │ └── utilcsv.py └── xlsx_writer.py ├── Chapter03 ├── iBackup.py ├── plist_parser.py ├── sqlite_carver.py ├── sqlite_gaps.py ├── sqlite_sms.py └── wifi_lookup.py ├── Chapter04 ├── apple_genres.json ├── av_metadata.py ├── exe_metadata.py ├── msoffice_metadata.py ├── pdf_metadata.py └── pic_metadata.py ├── Chapter05 ├── beautiful_preservation.py ├── ief_parser.py ├── ief_yahoo_cache_parser.py ├── passive_lookup.py ├── total_virus.py └── virus_hashset.py ├── Chapter06 ├── eml_parser.py ├── mbox_parser.py ├── msg_parser.py └── pff_parser.py ├── Chapter07 ├── axiom_daily_out.py ├── daily_parser.py ├── date_parser.py ├── iis_parser.py ├── splunk_connector.py └── yara_scanner.py ├── Chapter08 ├── evidence_metadata.py ├── extract_file_type.py ├── open_evidence.py ├── recurse_files.py └── search_evidence_hashes.py ├── Chapter10 ├── .DS_Store ├── evt_explorer.py ├── index_parser.py ├── pf_parser.py ├── srum_parser.py ├── utility │ ├── __init__.py │ ├── pytskutil.py │ └── vss.py └── vss_explorer.py ├── LICENSE └── README.md /.gitattributes: -------------------------------------------------------------------------------- 1 | # Auto detect text files and perform LF normalization 2 | * text=auto 3 | 4 | # Custom for Visual Studio 5 | *.cs diff=csharp 6 | 7 | # Standard to msysgit 8 | *.doc diff=astextplain 9 | *.DOC diff=astextplain 10 | *.docx diff=astextplain 11 | *.DOCX diff=astextplain 12 | *.dot diff=astextplain 13 | *.DOT diff=astextplain 14 | *.pdf diff=astextplain 15 | *.PDF diff=astextplain 16 | *.rtf diff=astextplain 17 | *.RTF diff=astextplain 18 | -------------------------------------------------------------------------------- /Chapter01/copy_metadata.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | import argparse 3 | from datetime import datetime as dt 4 | import os 5 | import pytz 6 | from pywintypes import Time 7 | import shutil 8 | from win32file import SetFileTime, CreateFile, CloseHandle 9 | from win32file import GENERIC_WRITE, FILE_SHARE_WRITE 10 | from win32file import OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL 11 | 12 | """ 13 | MIT License 14 | 15 | Copyright (c) 2017 Chapin Bryce, Preston Miller 16 | 17 | Please share comments and questions at: 18 | https://github.com/PythonForensics/PythonForensicsCookbook 19 | or email pyforcookbook@gmail.com 20 | 21 | Permission is hereby granted, free of charge, to any person obtaining a copy 22 | of this software and associated documentation files (the "Software"), to deal 23 | in the Software without restriction, including without limitation the rights 24 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 25 | copies of the Software, and to permit persons to whom the Software is 26 | furnished to do so, subject to the following conditions: 27 | 28 | The above copyright notice and this permission notice shall be included in all 29 | copies or substantial portions of the Software. 30 | 31 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 32 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 33 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 34 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 35 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 36 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 37 | SOFTWARE. 38 | """ 39 | 40 | __authors__ = ["Chapin Bryce", "Preston Miller"] 41 | __date__ = 20170815 42 | __description__ = "Utility to copy files and associated metadata on Windows" 43 | 44 | parser = argparse.ArgumentParser( 45 | description=__description__, 46 | epilog="Developed by {} on {}".format( 47 | ", ".join(__authors__), __date__) 48 | ) 49 | parser.add_argument("source", help="Source file") 50 | parser.add_argument("dest", help="Destination directory or file") 51 | parser.add_argument("--timezone", help="Timezone of the file's timestamp", 52 | choices=['EST5EDT', 'CST6CDT', 'MST7MDT', 'PST8PDT'], 53 | required=True) 54 | args = parser.parse_args() 55 | 56 | source = os.path.abspath(args.source) 57 | if os.sep in args.source: 58 | src_file_name = args.source.split(os.sep, 1)[1] 59 | else: 60 | src_file_name = args.source 61 | 62 | dest = os.path.abspath(args.dest) 63 | tz = pytz.timezone(args.timezone) 64 | 65 | shutil.copy2(source, dest) 66 | if os.path.isdir(dest): 67 | dest_file = os.path.join(dest, src_file_name) 68 | else: 69 | dest_file = dest 70 | 71 | created = dt.fromtimestamp(os.path.getctime(source)) 72 | created = Time(tz.localize(created)) 73 | modified = dt.fromtimestamp(os.path.getmtime(source)) 74 | modified = Time(tz.localize(modified)) 75 | accessed = dt.fromtimestamp(os.path.getatime(source)) 76 | accessed = Time(tz.localize(accessed)) 77 | 78 | print("Source\n======") 79 | print("Created: {}\nModified: {}\nAccessed: {}".format( 80 | created, modified, accessed)) 81 | 82 | handle = CreateFile(dest_file, GENERIC_WRITE, FILE_SHARE_WRITE, 83 | None, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, None) 84 | SetFileTime(handle, created, accessed, modified) 85 | CloseHandle(handle) 86 | 87 | created = tz.localize(dt.fromtimestamp(os.path.getctime(dest_file))) 88 | modified = tz.localize(dt.fromtimestamp(os.path.getmtime(dest_file))) 89 | accessed = tz.localize(dt.fromtimestamp(os.path.getatime(dest_file))) 90 | print("\nDestination\n===========") 91 | print("Created: {}\nModified: {}\nAccessed: {}".format( 92 | created, modified, accessed)) 93 | -------------------------------------------------------------------------------- /Chapter01/file_metadata.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | import argparse 3 | from datetime import datetime as dt 4 | import os 5 | import sys 6 | 7 | """ 8 | MIT License 9 | 10 | Copyright (c) 2017 Chapin Bryce, Preston Miller 11 | 12 | Please share comments and questions at: 13 | https://github.com/PythonForensics/PythonForensicsCookbook 14 | or email pyforcookbook@gmail.com 15 | 16 | Permission is hereby granted, free of charge, to any person obtaining a copy 17 | of this software and associated documentation files (the "Software"), to deal 18 | in the Software without restriction, including without limitation the rights 19 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 20 | copies of the Software, and to permit persons to whom the Software is 21 | furnished to do so, subject to the following conditions: 22 | 23 | The above copyright notice and this permission notice shall be included in all 24 | copies or substantial portions of the Software. 25 | 26 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 27 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 28 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 29 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 30 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 31 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 32 | SOFTWARE. 33 | """ 34 | 35 | __authors__ = ["Chapin Bryce", "Preston Miller"] 36 | __date__ = 20170815 37 | __description__ = "Gather filesystem metadata of provided file" 38 | 39 | parser = argparse.ArgumentParser( 40 | description=__description__, 41 | epilog="Developed by {} on {}".format(", ".join(__authors__), __date__) 42 | ) 43 | parser.add_argument("FILE_PATH", 44 | help="Path to file to gather metadata for") 45 | args = parser.parse_args() 46 | file_path = args.FILE_PATH 47 | 48 | stat_info = os.stat(file_path) 49 | if "linux" in sys.platform or "darwin" in sys.platform: 50 | print("Change time: ", dt.fromtimestamp(stat_info.st_ctime)) 51 | elif "win" in sys.platform: 52 | print("Creation time: ", dt.fromtimestamp(stat_info.st_ctime)) 53 | else: 54 | print("[-] Unsupported platform {} detected. Cannot interpret " 55 | "creation/change timestamp.".format(sys.platform) 56 | ) 57 | print("Modification time: ", dt.fromtimestamp(stat_info.st_mtime)) 58 | print("Access time: ", dt.fromtimestamp(stat_info.st_atime)) 59 | 60 | print("File mode: ", stat_info.st_mode) 61 | print("File inode: ", stat_info.st_ino) 62 | major = os.major(stat_info.st_dev) 63 | minor = os.minor(stat_info.st_dev) 64 | print("Device ID: ", stat_info.st_dev) 65 | print("\tMajor: ", major) 66 | print("\tMinor: ", minor) 67 | 68 | print("Number of hard links: ", stat_info.st_nlink) 69 | print("Owner User ID: ", stat_info.st_uid) 70 | print("Group ID: ", stat_info.st_gid) 71 | print("File Size: ", stat_info.st_size) 72 | 73 | print("Is a symlink: ", os.path.islink(file_path)) 74 | print("Absolute Path: ", os.path.abspath(file_path)) 75 | print("File exists: ", os.path.exists(file_path)) 76 | print("Parent directory: ", os.path.dirname(file_path)) 77 | print("Parent directory: {} | File name: {}".format( 78 | *os.path.split(file_path))) 79 | -------------------------------------------------------------------------------- /Chapter01/hashing.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | import argparse 3 | import hashlib 4 | import os 5 | 6 | """ 7 | MIT License 8 | 9 | Copyright (c) 2017 Chapin Bryce, Preston Miller 10 | 11 | Please share comments and questions at: 12 | https://github.com/PythonForensics/PythonForensicsCookbook 13 | or email pyforcookbook@gmail.com 14 | 15 | Permission is hereby granted, free of charge, to any person obtaining a copy 16 | of this software and associated documentation files (the "Software"), to deal 17 | in the Software without restriction, including without limitation the rights 18 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 19 | copies of the Software, and to permit persons to whom the Software is 20 | furnished to do so, subject to the following conditions: 21 | 22 | The above copyright notice and this permission notice shall be included in all 23 | copies or substantial portions of the Software. 24 | 25 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 26 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 27 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 28 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 29 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 30 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 31 | SOFTWARE. 32 | """ 33 | 34 | __authors__ = ["Chapin Bryce", "Preston Miller"] 35 | __date__ = 20170815 36 | __description__ = "Script to hash a file's name and contents" 37 | 38 | available_algorithms = { 39 | "md5": hashlib.md5, 40 | "sha1": hashlib.sha1, 41 | "sha256": hashlib.sha256, 42 | "sha512": hashlib.sha512 43 | } 44 | 45 | parser = argparse.ArgumentParser( 46 | description=__description__, 47 | epilog="Developed by {} on {}".format(", ".join(__authors__), __date__) 48 | ) 49 | parser.add_argument("FILE_NAME", help="Path of file to hash") 50 | parser.add_argument("ALGORITHM", help="Hash algorithm to use", 51 | choices=sorted(available_algorithms.keys())) 52 | args = parser.parse_args() 53 | 54 | input_file = args.FILE_NAME 55 | hash_alg = args.ALGORITHM 56 | 57 | file_name = available_algorithms[hash_alg]() 58 | abs_path = os.path.abspath(input_file) 59 | file_name.update(abs_path.encode()) 60 | 61 | print("The {} of the filename is: {}".format( 62 | hash_alg, file_name.hexdigest())) 63 | 64 | file_content = available_algorithms[hash_alg]() 65 | with open(input_file, 'rb') as open_file: 66 | buff_size = 1024 67 | buff = open_file.read(buff_size) 68 | 69 | while buff: 70 | file_content.update(buff) 71 | buff = open_file.read(buff_size) 72 | 73 | print("The {} of the content is: {}".format( 74 | hash_alg, file_content.hexdigest())) 75 | -------------------------------------------------------------------------------- /Chapter01/logging_recipe.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | import logging 3 | import sys 4 | 5 | """ 6 | MIT License 7 | 8 | Copyright (c) 2017 Chapin Bryce, Preston Miller 9 | 10 | Please share comments and questions at: 11 | https://github.com/PythonForensics/PythonForensicsCookbook 12 | or email pyforcookbook@gmail.com 13 | 14 | Permission is hereby granted, free of charge, to any person obtaining a copy 15 | of this software and associated documentation files (the "Software"), to deal 16 | in the Software without restriction, including without limitation the rights 17 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 18 | copies of the Software, and to permit persons to whom the Software is 19 | furnished to do so, subject to the following conditions: 20 | 21 | The above copyright notice and this permission notice shall be included in all 22 | copies or substantial portions of the Software. 23 | 24 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 25 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 26 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 27 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 28 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 29 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 30 | SOFTWARE. 31 | """ 32 | 33 | logger = logging.getLogger(__file__) 34 | logger.setLevel(logging.DEBUG) 35 | 36 | msg_fmt = logging.Formatter("%(asctime)-15s %(funcName)-20s" 37 | "%(levelname)-8s %(message)s") 38 | 39 | strhndl = logging.StreamHandler(sys.stdout) 40 | strhndl.setFormatter(fmt=msg_fmt) 41 | 42 | fhndl = logging.FileHandler(__file__ + ".log", mode='a') 43 | fhndl.setFormatter(fmt=msg_fmt) 44 | 45 | logger.addHandler(strhndl) 46 | logger.addHandler(fhndl) 47 | 48 | logger.info("information message") 49 | logger.debug("debug message") 50 | 51 | 52 | def function_one(): 53 | logger.warning("warning message") 54 | 55 | 56 | def function_two(): 57 | logger.error("error message") 58 | 59 | 60 | function_one() 61 | function_two() 62 | -------------------------------------------------------------------------------- /Chapter01/multiproc_example.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | import logging 3 | import multiprocessing as mp 4 | from random import randint 5 | import sys 6 | import time 7 | 8 | """ 9 | MIT License 10 | 11 | Copyright (c) 2017 Chapin Bryce, Preston Miller 12 | 13 | Please share comments and questions at: 14 | https://github.com/PythonForensics/PythonForensicsCookbook 15 | or email pyforcookbook@gmail.com 16 | 17 | Permission is hereby granted, free of charge, to any person obtaining a copy 18 | of this software and associated documentation files (the "Software"), to deal 19 | in the Software without restriction, including without limitation the rights 20 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 21 | copies of the Software, and to permit persons to whom the Software is 22 | furnished to do so, subject to the following conditions: 23 | 24 | The above copyright notice and this permission notice shall be included in all 25 | copies or substantial portions of the Software. 26 | 27 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 28 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 29 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 30 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 31 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 32 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 33 | SOFTWARE. 34 | """ 35 | 36 | 37 | def sleepy(seconds): 38 | proc_name = mp.current_process().name 39 | logger.info("{} is sleeping for {} seconds.".format( 40 | proc_name, seconds)) 41 | time.sleep(seconds) 42 | 43 | 44 | logger = logging.getLogger(__file__) 45 | logger.setLevel(logging.DEBUG) 46 | msg_fmt = logging.Formatter("%(asctime)-15s %(funcName)-7s " 47 | "%(levelname)-8s %(message)s") 48 | strhndl = logging.StreamHandler(sys.stdout) 49 | strhndl.setFormatter(fmt=msg_fmt) 50 | logger.addHandler(strhndl) 51 | 52 | num_workers = 5 53 | workers = [] 54 | for w in range(num_workers): 55 | p = mp.Process(target=sleepy, args=(randint(1, 20),)) 56 | p.start() 57 | workers.append(p) 58 | 59 | for worker in workers: 60 | worker.join() 61 | logger.info("Joined process {}".format(worker.name)) 62 | -------------------------------------------------------------------------------- /Chapter01/os_walk.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | import argparse 3 | import os 4 | 5 | """ 6 | MIT License 7 | 8 | Copyright (c) 2017 Chapin Bryce, Preston Miller 9 | 10 | Please share comments and questions at: 11 | https://github.com/PythonForensics/PythonForensicsCookbook 12 | or email pyforcookbook@gmail.com 13 | 14 | Permission is hereby granted, free of charge, to any person obtaining a copy 15 | of this software and associated documentation files (the "Software"), to deal 16 | in the Software without restriction, including without limitation the rights 17 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 18 | copies of the Software, and to permit persons to whom the Software is 19 | furnished to do so, subject to the following conditions: 20 | 21 | The above copyright notice and this permission notice shall be included in all 22 | copies or substantial portions of the Software. 23 | 24 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 25 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 26 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 27 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 28 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 29 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 30 | SOFTWARE. 31 | """ 32 | 33 | __authors__ = ["Chapin Bryce", "Preston Miller"] 34 | __date__ = 20170815 35 | __description__ = "Directory tree walker" 36 | 37 | parser = argparse.ArgumentParser( 38 | description=__description__, 39 | epilog="Developed by {} on {}".format( 40 | ", ".join(__authors__), __date__) 41 | ) 42 | parser.add_argument("DIR_PATH", help="Path to directory") 43 | args = parser.parse_args() 44 | path_to_scan = args.DIR_PATH 45 | 46 | # Iterate over the path_to_scan 47 | for root, directories, files in os.walk(path_to_scan): 48 | # Iterate over the files in the current "root" 49 | for file_entry in files: 50 | # create the relative path to the file 51 | file_path = os.path.join(root, file_entry) 52 | print(file_path) 53 | -------------------------------------------------------------------------------- /Chapter01/progressbars.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | from time import sleep 3 | import tqdm 4 | 5 | """ 6 | MIT License 7 | 8 | Copyright (c) 2017 Chapin Bryce, Preston Miller 9 | 10 | Please share comments and questions at: 11 | https://github.com/PythonForensics/PythonForensicsCookbook 12 | or email pyforcookbook@gmail.com 13 | 14 | Permission is hereby granted, free of charge, to any person obtaining a copy 15 | of this software and associated documentation files (the "Software"), to deal 16 | in the Software without restriction, including without limitation the rights 17 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 18 | copies of the Software, and to permit persons to whom the Software is 19 | furnished to do so, subject to the following conditions: 20 | 21 | The above copyright notice and this permission notice shall be included in all 22 | copies or substantial portions of the Software. 23 | 24 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 25 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 26 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 27 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 28 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 29 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 30 | SOFTWARE. 31 | """ 32 | 33 | fruits = [ 34 | "Acai", "Apple", "Apricots", "Avocado", "Banana", "Blackberry", 35 | "Blueberries", "Cherries", "Coconut", "Cranberry", "Cucumber", 36 | "Durian", "Fig", "Grapefruit", "Grapes", "Kiwi", "Lemon", "Lime", 37 | "Mango", "Melon", "Orange", "Papaya", "Peach", "Pear", "Pineapple", 38 | "Pomegranate", "Raspberries", "Strawberries", "Watermelon" 39 | ] 40 | 41 | contains_berry = 0 42 | for fruit in tqdm.tqdm(fruits): 43 | if "berr" in fruit.lower(): 44 | contains_berry += 1 45 | sleep(.1) 46 | print("{} fruit names contain 'berry' or 'berries'".format(contains_berry)) 47 | 48 | contains_berry = 0 49 | pbar = tqdm.tqdm(fruits, desc="Reviewing names", unit="fruits") 50 | for fruit in pbar: 51 | if "berr" in fruit.lower(): 52 | contains_berry += 1 53 | pbar.set_postfix(hits=contains_berry) 54 | sleep(.1) 55 | print("{} fruit names contain 'berry' or 'berries'".format(contains_berry)) 56 | 57 | for i in tqdm.trange(10000000, unit_scale=True, desc="Trange: "): 58 | pass 59 | -------------------------------------------------------------------------------- /Chapter01/simple_arguments.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | import argparse 3 | 4 | """ 5 | MIT License 6 | 7 | Copyright (c) 2017 Chapin Bryce, Preston Miller 8 | 9 | Please share comments and questions at: 10 | https://github.com/PythonForensics/PythonForensicsCookbook 11 | or email pyforcookbook@gmail.com 12 | 13 | Permission is hereby granted, free of charge, to any person obtaining a copy 14 | of this software and associated documentation files (the "Software"), to deal 15 | in the Software without restriction, including without limitation the rights 16 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 17 | copies of the Software, and to permit persons to whom the Software is 18 | furnished to do so, subject to the following conditions: 19 | 20 | The above copyright notice and this permission notice shall be included in all 21 | copies or substantial portions of the Software. 22 | 23 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 24 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 25 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 26 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 27 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 28 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 29 | SOFTWARE. 30 | """ 31 | 32 | __authors__ = ["Chapin Bryce", "Preston Miller"] 33 | __date__ = 20170815 34 | __description__ = 'A simple argparse example' 35 | 36 | 37 | parser = argparse.ArgumentParser( 38 | description=__description__, 39 | epilog="Developed by {} on {}".format( 40 | ", ".join(__authors__), __date__) 41 | ) 42 | 43 | parser.add_argument("INPUT_FILE", help="Path to input file") 44 | parser.add_argument("OUTPUT_FILE", help="Path to output file") 45 | 46 | parser.add_argument("--hash", help="Hash the files", action="store_true") 47 | 48 | parser.add_argument("--hash-algorithm", 49 | help="Hash algorithm to use. ie md5, sha1, sha256", 50 | choices=['md5', 'sha1', 'sha256'], default="sha256" 51 | ) 52 | 53 | parser.add_argument("-v", "--version", "--script-version", 54 | help="Displays script version information", 55 | action="version", version=str(__date__) 56 | ) 57 | 58 | parser.add_argument('-l', '--log', help="Path to log file", required=True) 59 | 60 | args = parser.parse_args() 61 | 62 | input_file = args.INPUT_FILE 63 | output_file = args.OUTPUT_FILE 64 | 65 | if args.hash: 66 | ha = args.hash_algorithm 67 | print("File hashing enabled with {} algorithm".format(ha)) 68 | if not args.log: 69 | print("Log file not defined. Will write to stdout") 70 | -------------------------------------------------------------------------------- /Chapter02/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/PythonForensics/Python-Digital-Forensics-Cookbook/18a7bec2d70321db820b07c10bf311428efe3950/Chapter02/.DS_Store -------------------------------------------------------------------------------- /Chapter02/ftk_parser.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | import argparse 3 | from datetime import datetime 4 | import os 5 | import sys 6 | import html_dashboard 7 | 8 | """ 9 | MIT License 10 | 11 | Copyright (c) 2017 Chapin Bryce, Preston Miller 12 | 13 | Please share comments and questions at: 14 | https://github.com/PythonForensics/PythonForensicsCookbook 15 | or email pyforcookbook@gmail.com 16 | 17 | Permission is hereby granted, free of charge, to any person obtaining a copy 18 | of this software and associated documentation files (the "Software"), to deal 19 | in the Software without restriction, including without limitation the rights 20 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 21 | copies of the Software, and to permit persons to whom the Software is 22 | furnished to do so, subject to the following conditions: 23 | 24 | The above copyright notice and this permission notice shall be included in all 25 | copies or substantial portions of the Software. 26 | 27 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 28 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 29 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 30 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 31 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 32 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 33 | SOFTWARE. 34 | """ 35 | 36 | __authors__ = ["Chapin Bryce", "Preston Miller"] 37 | __date__ = 20170815 38 | __description__ = "Read FTK acquisition logs into a HTML dashboard" 39 | 40 | 41 | def main(in_dir, out_dir): 42 | ftk_logs = [x for x in os.listdir(in_dir) 43 | if x.lower().endswith(".txt")] 44 | print("[+] Processing {} potential FTK Imager Logs found in {} " 45 | "directory".format(len(ftk_logs), in_dir)) 46 | ftk_data = [] 47 | for log in ftk_logs: 48 | log_data = {"e_numb": "", "custodian": "", "type": "", 49 | "date": "", "size": ""} 50 | log_name = os.path.join(in_dir, log) 51 | if validate_ftk(log_name): 52 | with open(log_name) as log_file: 53 | bps, sec_count = (None, None) 54 | for line in log_file: 55 | if "Evidence Number:" in line: 56 | log_data["e_numb"] = line.split( 57 | "Number:")[1].strip() 58 | elif "Notes:" in line: 59 | log_data["custodian"] = line.split( 60 | "Notes:")[1].strip() 61 | elif "Image Type:" in line: 62 | log_data["type"] = line.split("Type:")[1].strip() 63 | elif "Acquisition started:" in line: 64 | acq = line.split("started:")[1].strip() 65 | date = datetime.strptime( 66 | acq, "%a %b %d %H:%M:%S %Y") 67 | log_data["date"] = date.strftime( 68 | "%M/%d/%Y %H:%M:%S") 69 | elif "Bytes per Sector:" in line: 70 | bps = int(line.split("Sector:")[1].strip()) 71 | elif "Sector Count:" in line: 72 | sec_count = int( 73 | line.split("Count:")[1].strip().replace( 74 | ",", "") 75 | ) 76 | if bps is not None and sec_count is not None: 77 | log_data["size"] = calculate_size(bps, sec_count) 78 | 79 | ftk_data.append( 80 | [log_data["e_numb"], log_data["custodian"], 81 | log_data["type"], log_data["date"], log_data["size"]] 82 | ) 83 | 84 | print("[+] Creating HTML dashboard based acquisition logs " 85 | "in {}".format(out_dir)) 86 | html_dashboard.process_data(ftk_data, out_dir) 87 | 88 | 89 | def validate_ftk(log_file): 90 | with open(log_file) as log: 91 | first_line = log.readline() 92 | if "Created By AccessData" not in first_line: 93 | return False 94 | else: 95 | return True 96 | 97 | 98 | def calculate_size(bytes, sectors): 99 | return (bytes * sectors) / (1024**3) 100 | 101 | 102 | if __name__ == "__main__": 103 | # Command-line Argument Parser 104 | parser = argparse.ArgumentParser( 105 | description=__description__, 106 | epilog="Developed by {} on {}".format( 107 | ", ".join(__authors__), __date__) 108 | ) 109 | parser.add_argument("INPUT_DIR", help="Input Directory of Logs") 110 | parser.add_argument("OUTPUT_DIR", help="Desired Output Path") 111 | args = parser.parse_args() 112 | 113 | if os.path.exists(args.INPUT_DIR) and os.path.isdir(args.INPUT_DIR): 114 | main(args.INPUT_DIR, args.OUTPUT_DIR) 115 | else: 116 | print("[-] Supplied input directory {} does not exist or is not " 117 | "a file".format(args.INPUT_DIR)) 118 | sys.exit(1) 119 | -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/PythonForensics/Python-Digital-Forensics-Cookbook/18a7bec2d70321db820b07c10bf311428efe3950/Chapter02/light-bootstrap-dashboard/.DS_Store -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/LICENSE.md: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2017 Creative Tim 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/README.md: -------------------------------------------------------------------------------- 1 | # [Light Bootstrap Dashboard](http://www.creative-tim.com/product/light-bootstrap-dashboard) 2 | 3 | ![alt text](http://s3.amazonaws.com/creativetim_bucket/products/32/original/opt_lbd_thumbnail.jpg "Light Bootstrap Dashboard") 4 | 5 | Light Bootstrap Dashboard is an admin dashboard template designed to be beautiful and simple. It is built on top of Bootstrap 3 and it is fully responsive. It comes with a big collections of elements that will offer you multiple possibilities to create the app that best fits your needs. It can be used to create admin panels, project management systems, web applications backend, CMS or CRM. 6 | 7 | The product represents a big suite of front-end developer tools that can help you jump start your project. We have created it thinking about things you actually need in a dashboard. Light Bootstrap Dashboard contains multiple handpicked and optimised plugins. Everything is designed to fit with one another. As you will be able to see, the dashboard you can access on Creative Tim is a customisation of this product. 8 | 9 | It comes with 6 filter colors for the sidebar (“black”, “azure”,”green”,”orange”,”red”,”purple”) and an option to have a background image. 10 | 11 | Special thanks go to: 12 | Robert McIntosh for the notification system 13 | Chartist for the wonderful charts 14 | We are very excited to share this dashboard with you and we look forward to hearing your feedback! 15 | 16 | ## Links: 17 | 18 | + [Live Preview](http://demos.creative-tim.com/light-bootstrap-dashboard) 19 | + [Video Tutorial](https://www.youtube.com/watch?v=c3M3NQtFyqM) 20 | + [Light Bootstrap Dashboard PRO](http://www.creative-tim.com/product/light-bootstrap-dashboard-pro) (from $39) 21 | 22 | ## Quick start 23 | 24 | Quick start options: 25 | 26 | - [Download from Github](https://github.com/creativetimofficial/light-bootstrap-dashboard.git). 27 | - [Download from Creative Tim](http://www.creative-tim.com/product/light-bootstrap-dashboard). 28 | - Clone the repo: `git clone https://github.com/creativetimofficial/light-bootstrap-dashboard.git`. 29 | 30 | 31 | ### What's included 32 | 33 | Within the download you'll find the following directories and files: 34 | 35 | ``` 36 | x_lbd_free/ 37 | ├── assets/ 38 | | ├── css/ 39 | | | ├── animate.min.css 40 | | | ├── bootstrap.min.css 41 | | | ├── demo.css 42 | │ | ├── light-bootstrap-dashboard.css 43 | │ | └── pe-icon-7-stroke.css 44 | | ├── js/ 45 | | | ├── bootstrap-checkbox-radio-switch.js 46 | | | ├── bootstrap-notify.js 47 | | | ├── bootstrap-select.js 48 | | | ├── bootstrap.min.js 49 | │ | ├── chartist.min.js 50 | │ | ├── demo.js 51 | │ | ├── jquery-1.10.2.js 52 | │ | └── light-bootstrap-dashboard.js 53 | | ├── fonts/ 54 | | | ├── Pe-icon-7-stroke.eot 55 | | | ├── Pe-icon-7-stroke.svg 56 | | | ├── Pe-icon-7-stroke.ttf 57 | | | └── Pe-icon-7-stroke.woff 58 | | └── img/ 59 | | 60 | ├── Creative Tim License.pdf 61 | ├── dashboard.html 62 | ├── icons.html 63 | ├── maps.html 64 | ├── notifications.html 65 | ├── table.html 66 | ├── template.html 67 | ├── typography.html 68 | ├── upgrade.html 69 | └── user.html 70 | 71 | ``` 72 | 73 | ### Version logs 74 | 75 | V1.0 - 20 August 2015 initial release 76 | 77 | V1.1 - 08 September 2015 - bug fixing [current version] 78 | - added company name/logo inside the sidebar for small screens 79 | - fixed bug for notification with close button on small screens 80 | - fix live preview bug for download on small screens 81 | - fix table responsive for small screens 82 | - added new labels for chartist on small screens 83 | 84 | V1.2 - 17 January 2016 - New Page 85 | - for those who want to upsell inside their dashboard we added a new page "Upgrade to PRO" with a pricing and options table 86 | 87 | V1.3 - 22 January 2016 - New Template page + Video Tutorial 88 | - added the default template page + youtube video tutorial on how to create an Admin Template (link coming soon) 89 | 90 | V1.3.1 - 19 January 2017 [current version] 91 | - switched to MIT license 92 | 93 | ### License 94 | 95 | - Copyright 2017 Creative Tim (http://www.creative-tim.com) 96 | - Licensed under MIT (https://github.com/creativetimofficial/light-bootstrap-dashboard/blob/master/LICENSE.md) 97 | 98 | ## Useful Links 99 | 100 | More products from Creative Tim: 101 | 102 | Tutorials: 103 | 104 | Freebies: 105 | 106 | Affiliate Program (earn money): 107 | 108 | Social Media: 109 | 110 | Twitter: 111 | 112 | Facebook: 113 | 114 | Dribbble: 115 | 116 | Google+: 117 | 118 | Instagram: 119 | -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/css/demo.css: -------------------------------------------------------------------------------- 1 | @media (min-width: 992px){ 2 | .typo-line{ 3 | padding-left: 140px; 4 | margin-bottom: 40px; 5 | position: relative; 6 | } 7 | 8 | .typo-line .category{ 9 | transform: translateY(-50%); 10 | top: 50%; 11 | left: 0px; 12 | position: absolute; 13 | } 14 | } 15 | 16 | .all-icons [class*="pe-"]{ 17 | font-size: 40px; 18 | } 19 | .all-icons input{ 20 | border: 0; 21 | } 22 | .all-icons .font-icon-detail{ 23 | text-align: center; 24 | padding: 45px 0px 30px; 25 | border: 1px solid #e5e5e5; 26 | border-radius: 6px; 27 | margin: 15px 0; 28 | } 29 | .all-icons .font-icon-detail input{ 30 | margin: 25px auto 0; 31 | width: 100%; 32 | text-align: center; 33 | display: block; 34 | color: #aaa; 35 | font-size: 13px; 36 | } 37 | 38 | #map{ 39 | position:relative; 40 | width:100%; 41 | height: calc(100% - 60px); 42 | } 43 | 44 | .places-buttons .btn{ 45 | margin-bottom: 30px 46 | } 47 | .sidebar .nav > li.active-pro{ 48 | position: absolute; 49 | width: 100%; 50 | bottom: 10px; 51 | } 52 | .sidebar .nav > li.active-pro a{ 53 | background: rgba(255, 255, 255, 0.14); 54 | opacity: 1; 55 | color: #FFFFFF; 56 | } 57 | 58 | .table-upgrade td:nth-child(2), 59 | .table-upgrade td:nth-child(3){ 60 | text-align: center; 61 | } 62 | -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/fonts/Pe-icon-7-stroke.eot: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/PythonForensics/Python-Digital-Forensics-Cookbook/18a7bec2d70321db820b07c10bf311428efe3950/Chapter02/light-bootstrap-dashboard/assets/fonts/Pe-icon-7-stroke.eot -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/fonts/Pe-icon-7-stroke.ttf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/PythonForensics/Python-Digital-Forensics-Cookbook/18a7bec2d70321db820b07c10bf311428efe3950/Chapter02/light-bootstrap-dashboard/assets/fonts/Pe-icon-7-stroke.ttf -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/fonts/Pe-icon-7-stroke.woff: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/PythonForensics/Python-Digital-Forensics-Cookbook/18a7bec2d70321db820b07c10bf311428efe3950/Chapter02/light-bootstrap-dashboard/assets/fonts/Pe-icon-7-stroke.woff -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/img/default-avatar.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/PythonForensics/Python-Digital-Forensics-Cookbook/18a7bec2d70321db820b07c10bf311428efe3950/Chapter02/light-bootstrap-dashboard/assets/img/default-avatar.png -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/img/faces/face-0.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/PythonForensics/Python-Digital-Forensics-Cookbook/18a7bec2d70321db820b07c10bf311428efe3950/Chapter02/light-bootstrap-dashboard/assets/img/faces/face-0.jpg -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/img/faces/face-1.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/PythonForensics/Python-Digital-Forensics-Cookbook/18a7bec2d70321db820b07c10bf311428efe3950/Chapter02/light-bootstrap-dashboard/assets/img/faces/face-1.jpg -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/img/faces/face-2.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/PythonForensics/Python-Digital-Forensics-Cookbook/18a7bec2d70321db820b07c10bf311428efe3950/Chapter02/light-bootstrap-dashboard/assets/img/faces/face-2.jpg -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/img/faces/face-3.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/PythonForensics/Python-Digital-Forensics-Cookbook/18a7bec2d70321db820b07c10bf311428efe3950/Chapter02/light-bootstrap-dashboard/assets/img/faces/face-3.jpg -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/img/faces/face-4.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/PythonForensics/Python-Digital-Forensics-Cookbook/18a7bec2d70321db820b07c10bf311428efe3950/Chapter02/light-bootstrap-dashboard/assets/img/faces/face-4.jpg -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/img/faces/face-5.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/PythonForensics/Python-Digital-Forensics-Cookbook/18a7bec2d70321db820b07c10bf311428efe3950/Chapter02/light-bootstrap-dashboard/assets/img/faces/face-5.jpg -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/img/faces/face-6.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/PythonForensics/Python-Digital-Forensics-Cookbook/18a7bec2d70321db820b07c10bf311428efe3950/Chapter02/light-bootstrap-dashboard/assets/img/faces/face-6.jpg -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/img/faces/face-7.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/PythonForensics/Python-Digital-Forensics-Cookbook/18a7bec2d70321db820b07c10bf311428efe3950/Chapter02/light-bootstrap-dashboard/assets/img/faces/face-7.jpg -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/img/faces/tim_vector.jpe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/PythonForensics/Python-Digital-Forensics-Cookbook/18a7bec2d70321db820b07c10bf311428efe3950/Chapter02/light-bootstrap-dashboard/assets/img/faces/tim_vector.jpe -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/img/favicon.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/PythonForensics/Python-Digital-Forensics-Cookbook/18a7bec2d70321db820b07c10bf311428efe3950/Chapter02/light-bootstrap-dashboard/assets/img/favicon.ico -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/img/loading-bubbles.svg: -------------------------------------------------------------------------------- 1 | 2 | 3 | 5 | 6 | 7 | 9 | 10 | 11 | 13 | 14 | 15 | -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/img/mask.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/PythonForensics/Python-Digital-Forensics-Cookbook/18a7bec2d70321db820b07c10bf311428efe3950/Chapter02/light-bootstrap-dashboard/assets/img/mask.png -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/img/new_logo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/PythonForensics/Python-Digital-Forensics-Cookbook/18a7bec2d70321db820b07c10bf311428efe3950/Chapter02/light-bootstrap-dashboard/assets/img/new_logo.png -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/img/sidebar-1.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/PythonForensics/Python-Digital-Forensics-Cookbook/18a7bec2d70321db820b07c10bf311428efe3950/Chapter02/light-bootstrap-dashboard/assets/img/sidebar-1.jpg -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/img/sidebar-2.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/PythonForensics/Python-Digital-Forensics-Cookbook/18a7bec2d70321db820b07c10bf311428efe3950/Chapter02/light-bootstrap-dashboard/assets/img/sidebar-2.jpg -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/img/sidebar-3.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/PythonForensics/Python-Digital-Forensics-Cookbook/18a7bec2d70321db820b07c10bf311428efe3950/Chapter02/light-bootstrap-dashboard/assets/img/sidebar-3.jpg -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/img/sidebar-4.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/PythonForensics/Python-Digital-Forensics-Cookbook/18a7bec2d70321db820b07c10bf311428efe3950/Chapter02/light-bootstrap-dashboard/assets/img/sidebar-4.jpg -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/img/sidebar-5.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/PythonForensics/Python-Digital-Forensics-Cookbook/18a7bec2d70321db820b07c10bf311428efe3950/Chapter02/light-bootstrap-dashboard/assets/img/sidebar-5.jpg -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/img/tim_80x80.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/PythonForensics/Python-Digital-Forensics-Cookbook/18a7bec2d70321db820b07c10bf311428efe3950/Chapter02/light-bootstrap-dashboard/assets/img/tim_80x80.png -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/js/light-bootstrap-dashboard.js: -------------------------------------------------------------------------------- 1 | /*! 2 | 3 | ========================================================= 4 | * Light Bootstrap Dashboard - v1.3.1.0 5 | ========================================================= 6 | 7 | * Product Page: http://www.creative-tim.com/product/light-bootstrap-dashboard 8 | * Copyright 2017 Creative Tim (http://www.creative-tim.com) 9 | * Licensed under MIT (https://github.com/creativetimofficial/light-bootstrap-dashboard/blob/master/LICENSE.md) 10 | 11 | ========================================================= 12 | 13 | * The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. 14 | 15 | */ 16 | 17 | var searchVisible = 0; 18 | var transparent = true; 19 | 20 | var transparentDemo = true; 21 | var fixedTop = false; 22 | 23 | var navbar_initialized = false; 24 | 25 | $(document).ready(function(){ 26 | window_width = $(window).width(); 27 | 28 | // check if there is an image set for the sidebar's background 29 | lbd.checkSidebarImage(); 30 | 31 | // Init navigation toggle for small screens 32 | if(window_width <= 991){ 33 | lbd.initRightMenu(); 34 | } 35 | 36 | // Activate the tooltips 37 | $('[rel="tooltip"]').tooltip(); 38 | 39 | // Activate the switches with icons 40 | if($('.switch').length != 0){ 41 | $('.switch')['bootstrapSwitch'](); 42 | } 43 | // Activate regular switches 44 | if($("[data-toggle='switch']").length != 0){ 45 | $("[data-toggle='switch']").wrap('
').parent().bootstrapSwitch(); 46 | } 47 | 48 | $('.form-control').on("focus", function(){ 49 | $(this).parent('.input-group').addClass("input-group-focus"); 50 | }).on("blur", function(){ 51 | $(this).parent(".input-group").removeClass("input-group-focus"); 52 | }); 53 | 54 | // Fixes sub-nav not working as expected on IOS 55 | $('body').on('touchstart.dropdown', '.dropdown-menu', function (e) { e.stopPropagation(); }); 56 | }); 57 | 58 | // activate collapse right menu when the windows is resized 59 | $(window).resize(function(){ 60 | if($(window).width() <= 991){ 61 | lbd.initRightMenu(); 62 | } 63 | }); 64 | 65 | lbd = { 66 | misc:{ 67 | navbar_menu_visible: 0 68 | }, 69 | 70 | checkSidebarImage: function(){ 71 | $sidebar = $('.sidebar'); 72 | image_src = $sidebar.data('image'); 73 | 74 | if(image_src !== undefined){ 75 | sidebar_container = '
' 76 | $sidebar.append(sidebar_container); 77 | } 78 | }, 79 | initRightMenu: function(){ 80 | if(!navbar_initialized){ 81 | $navbar = $('nav').find('.navbar-collapse').first().clone(true); 82 | 83 | $sidebar = $('.sidebar'); 84 | sidebar_color = $sidebar.data('color'); 85 | 86 | $logo = $sidebar.find('.logo').first(); 87 | logo_content = $logo[0].outerHTML; 88 | 89 | ul_content = ''; 90 | 91 | $navbar.attr('data-color',sidebar_color); 92 | 93 | //add the content from the regular header to the right menu 94 | $navbar.children('ul').each(function(){ 95 | content_buff = $(this).html(); 96 | ul_content = ul_content + content_buff; 97 | }); 98 | 99 | // add the content from the sidebar to the right menu 100 | content_buff = $sidebar.find('.nav').html(); 101 | ul_content = ul_content + content_buff; 102 | 103 | 104 | ul_content = '
' + 105 | '
    ' + 106 | ul_content + 107 | '
' + 108 | '
'; 109 | 110 | navbar_content = logo_content + ul_content; 111 | 112 | $navbar.html(navbar_content); 113 | 114 | $('body').append($navbar); 115 | 116 | background_image = $sidebar.data('image'); 117 | if(background_image != undefined){ 118 | $navbar.css('background',"url('" + background_image + "')") 119 | .removeAttr('data-nav-image') 120 | .addClass('has-image'); 121 | } 122 | 123 | 124 | $toggle = $('.navbar-toggle'); 125 | 126 | $navbar.find('a').removeClass('btn btn-round btn-default'); 127 | $navbar.find('button').removeClass('btn-round btn-fill btn-info btn-primary btn-success btn-danger btn-warning btn-neutral'); 128 | $navbar.find('button').addClass('btn-simple btn-block'); 129 | 130 | $toggle.click(function (){ 131 | if(lbd.misc.navbar_menu_visible == 1) { 132 | $('html').removeClass('nav-open'); 133 | lbd.misc.navbar_menu_visible = 0; 134 | $('#bodyClick').remove(); 135 | setTimeout(function(){ 136 | $toggle.removeClass('toggled'); 137 | }, 400); 138 | 139 | } else { 140 | setTimeout(function(){ 141 | $toggle.addClass('toggled'); 142 | }, 430); 143 | 144 | div = '
'; 145 | $(div).appendTo("body").click(function() { 146 | $('html').removeClass('nav-open'); 147 | lbd.misc.navbar_menu_visible = 0; 148 | $('#bodyClick').remove(); 149 | setTimeout(function(){ 150 | $toggle.removeClass('toggled'); 151 | }, 400); 152 | }); 153 | 154 | $('html').addClass('nav-open'); 155 | lbd.misc.navbar_menu_visible = 1; 156 | 157 | } 158 | }); 159 | navbar_initialized = true; 160 | } 161 | 162 | } 163 | } 164 | 165 | 166 | // Returns a function, that, as long as it continues to be invoked, will not 167 | // be triggered. The function will be called after it stops being called for 168 | // N milliseconds. If `immediate` is passed, trigger the function on the 169 | // leading edge, instead of the trailing. 170 | 171 | function debounce(func, wait, immediate) { 172 | var timeout; 173 | return function() { 174 | var context = this, args = arguments; 175 | clearTimeout(timeout); 176 | timeout = setTimeout(function() { 177 | timeout = null; 178 | if (!immediate) func.apply(context, args); 179 | }, wait); 180 | if (immediate && !timeout) func.apply(context, args); 181 | }; 182 | }; -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/sass/lbd/_alerts.scss: -------------------------------------------------------------------------------- 1 | .alert{ 2 | border: 0; 3 | border-radius: 0; 4 | color: #FFFFFF; 5 | padding: 10px 15px; 6 | font-size: 14px; 7 | 8 | .container &{ 9 | border-radius: 4px; 10 | 11 | } 12 | .navbar &{ 13 | border-radius: 0; 14 | left: 0; 15 | position: absolute; 16 | right: 0; 17 | top: 85px; 18 | width: 100%; 19 | z-index: 3; 20 | } 21 | .navbar:not(.navbar-transparent) &{ 22 | top: 70px; 23 | } 24 | 25 | span[data-notify="icon"]{ 26 | font-size: 30px; 27 | display: block; 28 | left: 15px; 29 | position: absolute; 30 | top: 50%; 31 | margin-top: -15px; 32 | } 33 | 34 | button.close{ 35 | position: absolute; 36 | right: 10px; 37 | top: 50%; 38 | margin-top: -13px; 39 | z-index: 1033; 40 | background-color: #FFFFFF; 41 | display: block; 42 | border-radius: 50%; 43 | opacity: .4; 44 | line-height: 11px; 45 | width: 25px; 46 | height: 25px; 47 | outline: 0 !important; 48 | text-align: center; 49 | padding: 3px; 50 | font-weight: 300; 51 | 52 | &:hover{ 53 | opacity: .55; 54 | } 55 | } 56 | 57 | .close ~ span{ 58 | display: block; 59 | max-width: 89%; 60 | } 61 | 62 | &[data-notify="container"]{ 63 | padding: 10px 10px 10px 20px; 64 | border-radius: $border-radius-base; 65 | } 66 | 67 | &.alert-with-icon{ 68 | padding-left: 65px; 69 | } 70 | } 71 | .alert-info{ 72 | background-color: $azure-navbar; 73 | } 74 | .alert-success { 75 | background-color: $green-navbar; 76 | } 77 | .alert-warning { 78 | background-color: $orange-navbar; 79 | } 80 | .alert-danger { 81 | background-color: $red-navbar; 82 | } 83 | -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/sass/lbd/_buttons.scss: -------------------------------------------------------------------------------- 1 | .btn{ 2 | border-width: $border-thick; 3 | background-color: $transparent-bg; 4 | font-weight: $font-weight-normal; 5 | 6 | @include opacity(.8); 7 | padding: $padding-base-vertical $padding-base-horizontal; 8 | 9 | @include btn-styles($default-color, $default-states-color); 10 | 11 | &:hover, 12 | &:focus{ 13 | @include opacity(1); 14 | outline: 0 !important; 15 | } 16 | &:active, 17 | &.active, 18 | .open > &.dropdown-toggle { 19 | @include box-shadow(none); 20 | outline: 0 !important; 21 | } 22 | 23 | &.btn-icon{ 24 | padding: $padding-base-vertical; 25 | } 26 | 27 | } 28 | 29 | // Apply the mixin to the buttons 30 | //.btn-default { @include btn-styles($default-color, $default-states-color); } 31 | .btn-primary { @include btn-styles($primary-color, $primary-states-color); } 32 | .btn-success { @include btn-styles($success-color, $success-states-color); } 33 | .btn-info { @include btn-styles($info-color, $info-states-color); } 34 | .btn-warning { @include btn-styles($warning-color, $warning-states-color); } 35 | .btn-danger { @include btn-styles($danger-color, $danger-states-color); } 36 | .btn-neutral { 37 | @include btn-styles($white-color, $white-color); 38 | 39 | &:active, 40 | &.active, 41 | .open > &.dropdown-toggle{ 42 | background-color: $white-color; 43 | color: $default-color; 44 | } 45 | 46 | &.btn-fill, 47 | &.btn-fill:hover, 48 | &.btn-fill:focus{ 49 | color: $default-color; 50 | } 51 | 52 | &.btn-simple:active, 53 | &.btn-simple.active{ 54 | background-color: transparent; 55 | } 56 | } 57 | 58 | .btn{ 59 | &:disabled, 60 | &[disabled], 61 | &.disabled{ 62 | @include opacity(.5); 63 | } 64 | } 65 | .btn-round{ 66 | border-width: $border-thin; 67 | border-radius: $btn-round-radius !important; 68 | padding: $padding-round-vertical $padding-round-horizontal; 69 | 70 | &.btn-icon{ 71 | padding: $padding-round-vertical; 72 | } 73 | } 74 | .btn-simple{ 75 | border: $none; 76 | font-size: $font-size-medium; 77 | padding: $padding-base-vertical $padding-base-horizontal; 78 | 79 | &.btn-icon{ 80 | padding: $padding-base-vertical; 81 | } 82 | } 83 | .btn-lg{ 84 | @include btn-size($padding-large-vertical, $padding-large-horizontal, $font-size-large, $border-radius-large); 85 | font-weight: $font-weight-normal; 86 | } 87 | .btn-sm{ 88 | @include btn-size($padding-small-vertical, $padding-small-horizontal, $font-size-small, $border-radius-small); 89 | } 90 | .btn-xs { 91 | @include btn-size($padding-xs-vertical, $padding-xs-horizontal, $font-size-small, $border-radius-small); 92 | } 93 | .btn-wd { 94 | min-width: 140px; 95 | } 96 | 97 | .btn-group.select{ 98 | width: 100%; 99 | } 100 | .btn-group.select .btn{ 101 | text-align: left; 102 | } 103 | .btn-group.select .caret{ 104 | position: absolute; 105 | top: 50%; 106 | margin-top: -1px; 107 | right: 8px; 108 | } 109 | -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/sass/lbd/_cards.scss: -------------------------------------------------------------------------------- 1 | .card{ 2 | border-radius: $border-radius-base; 3 | box-shadow: 0 1px 2px rgba(0,0,0,.05),0 0 0 1px rgba(63,63,68,.1); 4 | background-color: #FFFFFF; 5 | margin-bottom: 30px; 6 | 7 | .image{ 8 | width: 100%; 9 | overflow: hidden; 10 | height: 260px; 11 | border-radius: $border-radius-base $border-radius-base 0 0; 12 | position: relative; 13 | -webkit-transform-style: preserve-3d; 14 | -moz-transform-style: preserve-3d; 15 | transform-style: preserve-3d; 16 | 17 | img { 18 | width: 100%; 19 | } 20 | } 21 | .filter{ 22 | position: absolute; 23 | z-index: 2; 24 | background-color: rgba(0,0,0,.68); 25 | top: 0; 26 | left: 0; 27 | width: 100%; 28 | height: 100%; 29 | text-align: center; 30 | 31 | @include opacity(0); 32 | 33 | .btn{ 34 | @include vertical-align(); 35 | } 36 | } 37 | &:hover .filter{ 38 | @include opacity(1); 39 | } 40 | .btn-hover{ 41 | @include opacity(0); 42 | } 43 | &:hover .btn-hover{ 44 | @include opacity(1); 45 | } 46 | .content{ 47 | padding: 15px 15px 10px 15px; 48 | } 49 | .header{ 50 | padding: 15px 15px 0; 51 | } 52 | .category, 53 | label{ 54 | font-size: $font-size-base; 55 | font-weight: $font-weight-normal; 56 | color: $dark-gray; 57 | margin-bottom: 0px; 58 | 59 | i{ 60 | font-size: $font-paragraph; 61 | } 62 | } 63 | 64 | label{ 65 | font-size: $font-size-small; 66 | margin-bottom: 5px; 67 | text-transform: uppercase; 68 | } 69 | 70 | .title{ 71 | margin: $none; 72 | color: $black-color; 73 | font-weight: $font-weight-light; 74 | } 75 | .avatar{ 76 | width: 30px; 77 | height: 30px; 78 | overflow: hidden; 79 | border-radius: 50%; 80 | margin-right: 5px; 81 | } 82 | .description{ 83 | font-size: $font-size-base; 84 | color: #333; 85 | } 86 | .footer{ 87 | padding: 0; 88 | background-color: $transparent-bg; 89 | line-height: 30px; 90 | 91 | .legend{ 92 | padding: 5px 0; 93 | } 94 | 95 | hr{ 96 | margin-top: 5px; 97 | margin-bottom: 5px; 98 | } 99 | } 100 | .stats{ 101 | color: #a9a9a9; 102 | } 103 | .footer div{ 104 | display: inline-block; 105 | } 106 | 107 | .author{ 108 | font-size: $font-size-small; 109 | font-weight: $font-weight-bold; 110 | text-transform: uppercase; 111 | } 112 | .author i{ 113 | font-size: $font-size-base; 114 | } 115 | h6{ 116 | font-size: $font-size-small; 117 | margin: 0; 118 | } 119 | &.card-separator:after{ 120 | height: 100%; 121 | right: -15px; 122 | top: 0; 123 | width: 1px; 124 | background-color: $medium-gray; 125 | content: ""; 126 | position: absolute; 127 | } 128 | 129 | .ct-chart{ 130 | margin: 30px 0 30px; 131 | height: 245px; 132 | } 133 | 134 | .table{ 135 | tbody td:first-child, 136 | thead th:first-child{ 137 | padding-left: 15px; 138 | } 139 | 140 | tbody td:last-child, 141 | thead th:last-child{ 142 | padding-right: 15px; 143 | } 144 | } 145 | 146 | .alert{ 147 | border-radius: $border-radius-base; 148 | position: relative; 149 | 150 | &.alert-with-icon{ 151 | padding-left: 65px; 152 | } 153 | } 154 | } 155 | .card-user{ 156 | .image{ 157 | height: 110px; 158 | } 159 | .image-plain{ 160 | height: 0; 161 | margin-top: 110px; 162 | } 163 | .author{ 164 | text-align: center; 165 | text-transform: none; 166 | margin-top: -70px; 167 | } 168 | .avatar{ 169 | width: 124px; 170 | height: 124px; 171 | border: 5px solid #FFFFFF; 172 | position: relative; 173 | margin-bottom: 15px; 174 | 175 | &.border-gray{ 176 | border-color: #EEEEEE; 177 | } 178 | } 179 | .title{ 180 | line-height: 24px; 181 | } 182 | .content{ 183 | min-height: 240px; 184 | } 185 | } 186 | 187 | .card-user, 188 | .card-price{ 189 | .footer{ 190 | padding: 5px 15px 10px; 191 | } 192 | hr{ 193 | margin: 5px 15px; 194 | } 195 | } 196 | .card-plain{ 197 | background-color: transparent; 198 | box-shadow: none; 199 | border-radius: 0; 200 | 201 | .image{ 202 | border-radius: 4px; 203 | } 204 | } 205 | 206 | 207 | 208 | -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/sass/lbd/_checkbox-radio-switch.scss: -------------------------------------------------------------------------------- 1 | /* Checkbox and radio */ 2 | .checkbox, 3 | .radio { 4 | margin-bottom: 12px; 5 | padding-left: 32px; 6 | position: relative; 7 | -webkit-transition: color 0.25s linear; 8 | transition: color 0.25s linear; 9 | font-size: 14px; 10 | font-weight: normal; 11 | line-height: 1.5; 12 | color: #333333; 13 | } 14 | .checkbox input, 15 | .radio input { 16 | outline: none !important; 17 | display: none; 18 | } 19 | .checkbox .icons, 20 | .radio .icons { 21 | color: $medium-gray; 22 | display: block; 23 | height: 20px; 24 | left: 0; 25 | position: absolute; 26 | top: 0; 27 | width: 20px; 28 | text-align: center; 29 | line-height: 21px; 30 | font-size: 20px; 31 | cursor: pointer; 32 | -webkit-transition: color 0.2s linear; 33 | transition: color 0.2s linear; 34 | } 35 | 36 | 37 | .checkbox .icons .first-icon, 38 | .radio .icons .first-icon, 39 | .checkbox .icons .second-icon, 40 | .radio .icons .second-icon { 41 | display: inline-table; 42 | position: absolute; 43 | left: 0; 44 | top: 0; 45 | background-color: transparent; 46 | margin: 0; 47 | @include opacity(1); 48 | } 49 | .checkbox .icons .second-icon, 50 | .radio .icons .second-icon { 51 | @include opacity(0); 52 | } 53 | .checkbox:hover, 54 | .radio:hover { 55 | -webkit-transition: color 0.2s linear; 56 | transition: color 0.2s linear; 57 | } 58 | .checkbox:hover .first-icon, 59 | .radio:hover .first-icon { 60 | @include opacity(0); 61 | } 62 | .checkbox:hover .second-icon, 63 | .radio:hover .second-icon { 64 | @include opacity (1); 65 | } 66 | .checkbox.checked, 67 | .radio.checked { 68 | color: $info-color; 69 | } 70 | .checkbox.checked .first-icon, 71 | .radio.checked .first-icon { 72 | opacity: 0; 73 | filter: alpha(opacity=0); 74 | } 75 | .checkbox.checked .second-icon, 76 | .radio.checked .second-icon { 77 | opacity: 1; 78 | filter: alpha(opacity=100); 79 | color: $info-color; 80 | -webkit-transition: color 0.2s linear; 81 | transition: color 0.2s linear; 82 | } 83 | .checkbox.disabled, 84 | .radio.disabled { 85 | cursor: default; 86 | color: $medium-gray !important; 87 | } 88 | .checkbox.disabled .icons, 89 | .radio.disabled .icons { 90 | color: $medium-gray !important; 91 | } 92 | .checkbox.disabled .first-icon, 93 | .radio.disabled .first-icon { 94 | opacity: 1; 95 | filter: alpha(opacity=100); 96 | } 97 | .checkbox.disabled .second-icon, 98 | .radio.disabled .second-icon { 99 | opacity: 0; 100 | filter: alpha(opacity=0); 101 | } 102 | .checkbox.disabled.checked .icons, 103 | .radio.disabled.checked .icons { 104 | color: $medium-gray; 105 | } 106 | .checkbox.disabled.checked .first-icon, 107 | .radio.disabled.checked .first-icon { 108 | opacity: 0; 109 | filter: alpha(opacity=0); 110 | } 111 | .checkbox.disabled.checked .second-icon, 112 | .radio.disabled.checked .second-icon { 113 | opacity: 1; 114 | filter: alpha(opacity=100); 115 | color: #D9D9D9; 116 | } 117 | 118 | 119 | 120 | /* ============================================================ 121 | * bootstrapSwitch v1.3 by Larentis Mattia @spiritualGuru 122 | * http://www.larentis.eu/switch/ 123 | * ============================================================ 124 | * Licensed under the Apache License, Version 2.0 125 | * http://www.apache.org/licenses/LICENSE-2.0 126 | * ============================================================ */ 127 | .has-switch { 128 | border-radius: 30px; 129 | cursor: pointer; 130 | display: inline-block; 131 | line-height: 1.72222; 132 | overflow: hidden; 133 | position: relative; 134 | text-align: left; 135 | width: 60px; 136 | 137 | -webkit-user-select: none; 138 | -moz-user-select: none; 139 | -ms-user-select: none; 140 | -o-user-select: none; 141 | user-select: none; 142 | 143 | /* this code is for fixing safari bug with hidden overflow for border-radius */ 144 | -webkit-mask: url('../img/mask.png') 0 0 no-repeat; 145 | -webkit-mask-size: 60px 24px; 146 | mask: url('../img/mask.png') 0 0 no-repeat; 147 | } 148 | .has-switch.deactivate { 149 | opacity: 0.5; 150 | filter: alpha(opacity=50); 151 | cursor: default !important; 152 | } 153 | .has-switch.deactivate label, 154 | .has-switch.deactivate span { 155 | cursor: default !important; 156 | } 157 | .has-switch > div { 158 | position: relative; 159 | top: 0; 160 | width: 100px; 161 | } 162 | .has-switch > div.switch-animate { 163 | -webkit-transition: left 0.25s ease-out; 164 | transition: left 0.25s ease-out; 165 | } 166 | .has-switch > div.switch-off { 167 | left: -35px; 168 | } 169 | 170 | .has-switch > div.switch-on { 171 | left: 0; 172 | } 173 | .has-switch > div label { 174 | background-color: #FFFFFF; 175 | @include icon-gradient (rgba(255,255,255,1), rgba(241,241,242,1)); 176 | 177 | box-shadow: 0 1px 1px #FFFFFF inset, 0 1px 1px rgba(0, 0, 0, 0.25); 178 | cursor: pointer; 179 | } 180 | .has-switch input[type=checkbox] { 181 | display: none; 182 | } 183 | .has-switch span { 184 | /* box-shadow: 0 1px 3px rgba(0, 0, 0, 0.2) inset; */ 185 | cursor: pointer; 186 | float: left; 187 | font-size: 11px; 188 | font-weight: 400; 189 | height: 24px; 190 | line-height: 15px; 191 | margin: 0; 192 | padding-bottom: 6px; 193 | padding-top: 5px; 194 | position: relative; 195 | text-align: center; 196 | text-indent: -10px; 197 | width: 50%; 198 | z-index: 1; 199 | -webkit-transition: 0.25s ease-out; 200 | transition: 0.25s ease-out; 201 | } 202 | .has-switch span.switch-left { 203 | background-color: $info-color; 204 | border-left: 1px solid rgba(0, 0, 0, 0); 205 | border-radius: 30px 0 0 30px; 206 | color: #FFFFFF; 207 | } 208 | .has-switch .switch-off span.switch-left{ 209 | background-color: $medium-gray; 210 | } 211 | .has-switch span.switch-right { 212 | border-radius: 0 30px 30px 0; 213 | background-color: $info-color; 214 | color: #ffffff; 215 | text-indent: 1px; 216 | } 217 | .has-switch .switch-off span.switch-right{ 218 | background-color: $medium-gray; 219 | } 220 | 221 | .has-switch label { 222 | border-radius: 12px; 223 | float: left; 224 | height: 22px; 225 | margin: 1px -13px; 226 | padding: 0; 227 | position: relative; 228 | transition: all 0.25s ease-out 0s; 229 | vertical-align: middle; 230 | width: 22px; 231 | z-index: 100; 232 | -webkit-transition: 0.25s ease-out; 233 | transition: 0.25s ease-out; 234 | } 235 | .has-switch .switch-on .fa-check:before{ 236 | margin-left: 10px; 237 | } 238 | .has-switch:hover .switch-on label{ 239 | margin: 1px -17px; 240 | width: 26px; 241 | } 242 | .has-switch:hover .switch-off label{ 243 | margin: 1px -13px; 244 | width: 26px; 245 | } 246 | 247 | -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/sass/lbd/_dropdown.scss: -------------------------------------------------------------------------------- 1 | .dropdown-menu{ 2 | visibility: hidden; 3 | margin: 0; 4 | padding: 0; 5 | border-radius: $border-radius-extreme; 6 | display: block; 7 | z-index: 9000; 8 | position: absolute; 9 | 10 | @include opacity(0); 11 | @include box-shadow($dropdown-shadow); 12 | 13 | .open &{ 14 | @include opacity(1); 15 | visibility: visible; 16 | } 17 | .select &{ 18 | border-radius: $border-radius-bottom; 19 | @include box-shadow(none); 20 | @include transform-origin($select-coordinates); 21 | @include transform-scale(1); 22 | @include transition($fast-transition-time, $transition-linear); 23 | margin-top: -20px; 24 | } 25 | .select.open &{ 26 | margin-top: -1px; 27 | } 28 | 29 | > li > a { 30 | padding: $padding-base-vertical $padding-base-horizontal; 31 | color: #333333; 32 | 33 | img{ 34 | margin-top: -3px; 35 | } 36 | } 37 | > li > a:focus{ 38 | outline: 0 !important; 39 | } 40 | 41 | .btn-group.select &{ 42 | min-width: 100%; 43 | } 44 | 45 | > li:first-child > a{ 46 | border-top-left-radius: $border-radius-extreme; 47 | border-top-right-radius: $border-radius-extreme; 48 | } 49 | 50 | > li:last-child > a{ 51 | border-bottom-left-radius: $border-radius-extreme; 52 | border-bottom-right-radius: $border-radius-extreme; 53 | } 54 | 55 | .select & > li:first-child > a{ 56 | border-radius: 0; 57 | border-bottom: 0 none; 58 | } 59 | 60 | > li > a:hover, 61 | > li > a:focus { 62 | background-color: $smoke-bg; 63 | color: #333333; 64 | opacity: 1; 65 | text-decoration: none; 66 | } 67 | 68 | &.dropdown-blue > li > a:hover, 69 | &.dropdown-blue > li > a:focus{ 70 | background-color: $light-blue; 71 | } 72 | &.dropdown-azure > li > a:hover, 73 | &.dropdown-azure > li > a:focus{ 74 | background-color: $light-azure; 75 | } 76 | &.ct-green > li > a:hover, 77 | &.ct-green > li > a:focus{ 78 | background-color: $light-green; 79 | } 80 | &.dropdown-orange > li > a:hover, 81 | &.dropdown-orange > li > a:focus{ 82 | background-color: $light-orange; 83 | } 84 | &.dropdown-red > li > a:hover, 85 | &.dropdown-red > li > a:focus{ 86 | background-color: $light-red; 87 | } 88 | 89 | } 90 | 91 | .dropdown-with-icons{ 92 | > li > a{ 93 | padding-left: 0px; 94 | line-height: 28px; 95 | } 96 | i{ 97 | text-align: center; 98 | line-height: 28px; 99 | float: left; 100 | 101 | &[class^="pe-"]{ 102 | font-size: 24px; 103 | width: 46px; 104 | } 105 | &[class^="fa"]{ 106 | font-size: 14px; 107 | width: 38px; 108 | } 109 | } 110 | } 111 | 112 | //fix bug for the select items in btn-group 113 | .btn-group.select{ 114 | overflow: hidden; 115 | } 116 | .btn-group.select.open{ 117 | overflow: visible; 118 | } 119 | 120 | 121 | -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/sass/lbd/_footers.scss: -------------------------------------------------------------------------------- 1 | .footer{ 2 | background-color: $white-color; 3 | line-height: $line-height; 4 | 5 | nav > ul{ 6 | list-style: none; 7 | margin: 0; 8 | padding: 0; 9 | font-weight: normal; 10 | 11 | a:not(.btn){ 12 | color: $dark-gray; 13 | display: block; 14 | margin-bottom: 3px; 15 | &:hover, 16 | &:focus{ 17 | color: $default-states-color; 18 | } 19 | } 20 | } 21 | .social-area{ 22 | padding: 15px 0; 23 | h5{ 24 | padding-bottom: 15px; 25 | } 26 | } 27 | .social-area > a:not(.btn){ 28 | color: $dark-gray; 29 | display: inline-block; 30 | vertical-align: top; 31 | padding: $padding-social-a; 32 | font-size: $font-size-large-navbar; 33 | font-weight: normal; 34 | line-height: $line-height; 35 | text-align: center; 36 | &:hover, 37 | &:focus{ 38 | color: $default-states-color; 39 | } 40 | } 41 | .copyright{ 42 | color: $default-states-color; 43 | padding: 10px 15px; 44 | margin: 10px 3px; 45 | line-height: 20px; 46 | font-size: $font-size-base; 47 | } 48 | hr{ 49 | border-color: $medium-gray; 50 | } 51 | .title{ 52 | color: $default-states-color; 53 | } 54 | } 55 | 56 | .footer-default{ 57 | background-color: $smoke-bg; 58 | } 59 | 60 | .footer:not(.footer-big){ 61 | nav > ul{ 62 | font-size: $font-size-base; 63 | li{ 64 | margin-left: 20px; 65 | float: left; 66 | } 67 | a{ 68 | padding: 10px 0px; 69 | margin: 10px 10px 10px 0px; 70 | } 71 | } 72 | } 73 | 74 | 75 | 76 | 77 | 78 | -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/sass/lbd/_inputs.scss: -------------------------------------------------------------------------------- 1 | .form-control::-moz-placeholder{ 2 | @include placeholder($medium-gray,1); 3 | } 4 | .form-control:-moz-placeholder{ 5 | @include placeholder($medium-gray,1); 6 | } 7 | .form-control::-webkit-input-placeholder{ 8 | @include placeholder($medium-gray,1); 9 | } 10 | .form-control:-ms-input-placeholder{ 11 | @include placeholder($medium-gray,1); 12 | } 13 | 14 | .form-control { 15 | background-color: $white-bg; 16 | border: 1px solid $light-gray; 17 | border-radius: $border-radius-base; 18 | color: #565656; 19 | @include input-size($padding-base-vertical, $padding-base-horizontal - 4, $height-base); 20 | @include box-shadow(none); 21 | 22 | &:focus{ 23 | background-color: $white-bg; 24 | border: 1px solid $medium-dark-gray; 25 | @include box-shadow(none); 26 | outline: 0 !important; 27 | color: #333333; 28 | } 29 | 30 | .has-success &, 31 | .has-error &, 32 | .has-success &:focus, 33 | .has-error &:focus{ 34 | border-color: $light-gray; 35 | @include box-shadow(none); 36 | } 37 | 38 | .has-success &{ 39 | color: $success-color; 40 | } 41 | .has-success &:focus{ 42 | border-color: $success-color; 43 | } 44 | .has-error &{ 45 | color: $danger-color; 46 | } 47 | .has-error &:focus{ 48 | border-color: $danger-color; 49 | } 50 | 51 | & + .form-control-feedback{ 52 | border-radius: $border-radius-large; 53 | font-size: $font-size-base; 54 | margin-top: -7px; 55 | position: absolute; 56 | right: 10px; 57 | top: 50%; 58 | vertical-align: middle; 59 | } 60 | 61 | .open &{ 62 | border-radius: $border-radius-base $border-radius-base 0 0; 63 | border-bottom-color: transparent; 64 | } 65 | } 66 | 67 | .input-lg{ 68 | height: 55px; 69 | padding: $padding-large-vertical $padding-large-horizontal; 70 | } 71 | 72 | .has-error{ 73 | .form-control-feedback{ 74 | color: $danger-color; 75 | } 76 | } 77 | .has-success{ 78 | .form-control-feedback{ 79 | color: $success-color 80 | } 81 | } 82 | 83 | 84 | .input-group-addon { 85 | background-color: $white-color; 86 | border: 1px solid $light-gray; 87 | border-radius: $border-radius-base; 88 | 89 | .has-success &, 90 | .has-error &{ 91 | background-color: $white-color; 92 | border: 1px solid $light-gray; 93 | } 94 | .has-error .form-control:focus + &{ 95 | border-color: $danger-color; 96 | color: $danger-color; 97 | } 98 | .has-success .form-control:focus + &{ 99 | border-color: $success-color; 100 | color: $success-color; 101 | } 102 | .form-control:focus + &, 103 | .form-control:focus ~ &{ 104 | background-color: $white-color; 105 | border-color: $dark-gray; 106 | } 107 | } 108 | 109 | .input-group .form-control:first-child, 110 | .input-group-addon:first-child, 111 | .input-group-btn:first-child > .dropdown-toggle, 112 | .input-group-btn:last-child > .btn:not(:last-child):not(.dropdown-toggle) { 113 | border-right: 0 none; 114 | } 115 | .input-group .form-control:last-child, 116 | .input-group-addon:last-child, 117 | .input-group-btn:last-child > .dropdown-toggle, 118 | .input-group-btn:first-child > .btn:not(:first-child) { 119 | border-left: 0 none; 120 | } 121 | .form-control[disabled], .form-control[readonly], fieldset[disabled] .form-control { 122 | background-color: $smoke-bg; 123 | color: $default-color; 124 | cursor: not-allowed; 125 | } 126 | 127 | .input-group-btn .btn{ 128 | border-width: $border-thin; 129 | padding: $padding-round-vertical $padding-base-horizontal; 130 | } 131 | .input-group-btn .btn-default:not(.btn-fill){ 132 | border-color: $medium-gray; 133 | } 134 | 135 | .input-group-btn:last-child > .btn{ 136 | margin-left: 0; 137 | } 138 | 139 | .input-group-focus .input-group-addon{ 140 | border-color: $dark-gray; 141 | } 142 | -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/sass/lbd/_misc.scss: -------------------------------------------------------------------------------- 1 | /* General overwrite */ 2 | body, 3 | .wrapper{ 4 | min-height: 100vh; 5 | position: relative; 6 | } 7 | a{ 8 | color: $info-color; 9 | 10 | &:hover, &:focus{ 11 | color: $info-states-color; 12 | text-decoration: none; 13 | } 14 | } 15 | 16 | a:focus, a:active, 17 | button::-moz-focus-inner, 18 | input::-moz-focus-inner, 19 | input[type="reset"]::-moz-focus-inner, 20 | input[type="button"]::-moz-focus-inner, 21 | input[type="submit"]::-moz-focus-inner, 22 | select::-moz-focus-inner, 23 | input[type="file"] > input[type="button"]::-moz-focus-inner{ 24 | outline:0; 25 | } 26 | .ui-slider-handle:focus, 27 | .navbar-toggle, 28 | input:focus { 29 | outline : 0 !important; 30 | } 31 | 32 | /* Animations */ 33 | .form-control, 34 | .input-group-addon, 35 | .tagsinput, 36 | .navbar, 37 | .navbar .alert{ 38 | @include transition($general-transition-time, $transition-linear); 39 | } 40 | 41 | .sidebar .nav a, 42 | .table > tbody > tr .td-actions .btn{ 43 | @include transition($fast-transition-time, $transition-ease-in); 44 | } 45 | 46 | .btn{ 47 | @include transition($ultra-fast-transition-time, $transition-ease-in); 48 | } 49 | .fa{ 50 | width: 18px; 51 | text-align: center; 52 | } 53 | .margin-top{ 54 | margin-top: 50px; 55 | } 56 | 57 | .wrapper{ 58 | position: relative; 59 | top: 0; 60 | height: 100vh; 61 | } 62 | 63 | -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/sass/lbd/_mixins.scss: -------------------------------------------------------------------------------- 1 | //Utilities 2 | 3 | @import "mixins/transparency"; 4 | @import "mixins/vendor-prefixes"; 5 | 6 | 7 | //Components 8 | 9 | @import "mixins/buttons"; 10 | @import "mixins/inputs"; 11 | @import "mixins/labels"; 12 | @import "mixins/tabs"; 13 | 14 | @import "mixins/navbars"; 15 | @import "mixins/icons"; 16 | @import "mixins/social-buttons"; 17 | 18 | @import "mixins/morphing-buttons"; 19 | 20 | @import "mixins/cards"; 21 | 22 | @import "mixins/chartist"; -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/sass/lbd/_tables.scss: -------------------------------------------------------------------------------- 1 | .table{ 2 | 3 | .radio, 4 | .checkbox{ 5 | position: relative; 6 | height: 20px; 7 | display: block; 8 | width: 20px; 9 | padding: 0px 0px; 10 | margin: 0px 5px; 11 | text-align: center; 12 | 13 | .icons{ 14 | left: 5px; 15 | } 16 | } 17 | > thead > tr > th, 18 | > tbody > tr > th, 19 | > tfoot > tr > th, 20 | > thead > tr > td, 21 | > tbody > tr > td, 22 | > tfoot > tr > td{ 23 | padding: 12px 8px; 24 | vertical-align: middle; 25 | } 26 | 27 | > thead > tr > th{ 28 | border-bottom-width: 1px; 29 | font-size: $font-size-small; 30 | text-transform: uppercase; 31 | color: $dark-gray; 32 | font-weight: $font-weight-normal; 33 | padding-bottom: 5px; 34 | } 35 | 36 | .td-actions .btn{ 37 | @include opacity(0.36); 38 | 39 | &.btn-xs{ 40 | padding-left: 3px; 41 | padding-right: 3px; 42 | } 43 | } 44 | .td-actions{ 45 | min-width: 90px; 46 | } 47 | 48 | > tbody > tr{ 49 | position: relative; 50 | 51 | &:hover{ 52 | .td-actions .btn{ 53 | @include opacity(1); 54 | } 55 | } 56 | } 57 | } 58 | -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/sass/lbd/_typography.scss: -------------------------------------------------------------------------------- 1 | /* Font Smoothing */ 2 | body, 3 | h1, .h1, 4 | h2, .h2, 5 | h3, .h3, 6 | h4, .h4, 7 | h5, .h5, 8 | h6, .h6, 9 | p, 10 | .navbar, 11 | .brand, 12 | .btn-simple, 13 | .alert, 14 | a, 15 | .td-name, 16 | td, 17 | button.close{ 18 | -moz-osx-font-smoothing: grayscale; 19 | -webkit-font-smoothing: antialiased; 20 | font-family: "Roboto","Helvetica Neue",Arial,sans-serif; 21 | font-weight: $font-weight-normal; 22 | } 23 | 24 | h1, .h1, h2, .h2, h3, .h3, h4, .h4{ 25 | font-weight: $font-weight-light; 26 | margin: $margin-large-vertical 0 $margin-base-vertical; 27 | } 28 | 29 | h1, .h1 { 30 | font-size: $font-size-h1; 31 | } 32 | h2, .h2{ 33 | font-size: $font-size-h2; 34 | } 35 | h3, .h3{ 36 | font-size: $font-size-h3; 37 | margin: 20px 0 10px; 38 | } 39 | h4, .h4{ 40 | font-size: $font-size-h4; 41 | line-height: 30px; 42 | } 43 | h5, .h5 { 44 | font-size: $font-size-h5; 45 | margin-bottom: 15px; 46 | } 47 | h6, .h6{ 48 | font-size: $font-size-h6; 49 | font-weight: $font-weight-bold; 50 | text-transform: uppercase; 51 | } 52 | p{ 53 | font-size: $font-paragraph; 54 | line-height: $line-height-general; 55 | } 56 | 57 | h1 small, h2 small, h3 small, h4 small, h5 small, h6 small, .h1 small, .h2 small, .h3 small, .h4 small, .h5 small, .h6 small, h1 .small, h2 .small, h3 .small, h4 .small, h5 .small, h6 .small, .h1 .small, .h2 .small, .h3 .small, .h4 .small, .h5 .small, .h6 .small { 58 | color: $dark-gray; 59 | font-weight: $font-weight-light; 60 | line-height: $line-height-general; 61 | } 62 | 63 | h1 small, h2 small, h3 small, h1 .small, h2 .small, h3 .small { 64 | font-size: 60%; 65 | } 66 | 67 | h1 .subtitle{ 68 | display: block; 69 | margin: 0 0 $margin-large-vertical; 70 | } 71 | 72 | .text-muted{ 73 | color: #9A9A9A; 74 | } 75 | .text-primary, .text-primary:hover{ 76 | color: #1D62F0 !important; 77 | } 78 | .text-info, .text-info:hover{ 79 | color: $info-color !important; 80 | } 81 | .text-success, .text-success:hover{ 82 | color: $success-color !important; 83 | } 84 | .text-warning, .text-warning:hover{ 85 | color: $warning-color !important; 86 | } 87 | .text-danger, .text-danger:hover{ 88 | color: $danger-color !important; 89 | } 90 | 91 | -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/sass/lbd/mixins/_buttons.scss: -------------------------------------------------------------------------------- 1 | // Mixin for generating new styles 2 | @mixin btn-styles($btn-color, $btn-states-color) { 3 | border-color: $btn-color; 4 | color: $btn-color; 5 | 6 | &:hover, 7 | &:focus, 8 | &:active, 9 | &.active, 10 | .open > &.dropdown-toggle { 11 | background-color: $transparent-bg; 12 | color: $btn-states-color; 13 | border-color: $btn-states-color; 14 | } 15 | 16 | &.disabled, 17 | &:disabled, 18 | &[disabled], 19 | fieldset[disabled] & { 20 | &, 21 | &:hover, 22 | &:focus, 23 | &.focus, 24 | &:active, 25 | &.active { 26 | background-color: $transparent-bg; 27 | border-color: $btn-color; 28 | } 29 | } 30 | 31 | 32 | &.btn-fill { 33 | color: $white-color; 34 | background-color: $btn-color; 35 | @include opacity(1); 36 | 37 | &:hover, 38 | &:focus, 39 | &:active, 40 | &.active, 41 | .open > &.dropdown-toggle{ 42 | background-color: $btn-states-color; 43 | color: $white-color; 44 | } 45 | 46 | .caret{ 47 | border-top-color: $white-color; 48 | } 49 | } 50 | 51 | .caret{ 52 | border-top-color: $btn-color; 53 | } 54 | } 55 | 56 | 57 | @mixin btn-size($padding-vertical, $padding-horizontal, $font-size, $border){ 58 | font-size: $font-size; 59 | border-radius: $border; 60 | padding: $padding-vertical $padding-horizontal; 61 | 62 | &.btn-round{ 63 | padding: $padding-vertical + 1 $padding-horizontal; 64 | } 65 | 66 | &.btn-simple{ 67 | padding: $padding-vertical + 2 $padding-horizontal; 68 | } 69 | 70 | } -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/sass/lbd/mixins/_cards.scss: -------------------------------------------------------------------------------- 1 | @mixin filter($color){ 2 | @if $color == #FFFFFF{ 3 | background-color: rgba($color,.91); 4 | } @else { 5 | background-color: rgba($color,.69); 6 | } 7 | } 8 | 9 | -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/sass/lbd/mixins/_chartist.scss: -------------------------------------------------------------------------------- 1 | // Scales for responsive SVG containers 2 | $ct-scales: ((1), (15/16), (8/9), (5/6), (4/5), (3/4), (2/3), (5/8), (1/1.618), (3/5), (9/16), (8/15), (1/2), (2/5), (3/8), (1/3), (1/4)) !default; 3 | $ct-scales-names: (ct-square, ct-minor-second, ct-major-second, ct-minor-third, ct-major-third, ct-perfect-fourth, ct-perfect-fifth, ct-minor-sixth, ct-golden-section, ct-major-sixth, ct-minor-seventh, ct-major-seventh, ct-octave, ct-major-tenth, ct-major-eleventh, ct-major-twelfth, ct-double-octave) !default; 4 | 5 | // Class names to be used when generating CSS 6 | $ct-class-chart: ct-chart !default; 7 | $ct-class-chart-line: ct-chart-line !default; 8 | $ct-class-chart-bar: ct-chart-bar !default; 9 | $ct-class-horizontal-bars: ct-horizontal-bars !default; 10 | $ct-class-chart-pie: ct-chart-pie !default; 11 | $ct-class-chart-donut: ct-chart-donut !default; 12 | $ct-class-label: ct-label !default; 13 | $ct-class-series: ct-series !default; 14 | $ct-class-line: ct-line !default; 15 | $ct-class-point: ct-point !default; 16 | $ct-class-area: ct-area !default; 17 | $ct-class-bar: ct-bar !default; 18 | $ct-class-slice-pie: ct-slice-pie !default; 19 | $ct-class-slice-donut: ct-slice-donut !default; 20 | $ct-class-grid: ct-grid !default; 21 | $ct-class-vertical: ct-vertical !default; 22 | $ct-class-horizontal: ct-horizontal !default; 23 | $ct-class-start: ct-start !default; 24 | $ct-class-end: ct-end !default; 25 | 26 | // Container ratio 27 | $ct-container-ratio: (1/1.618) !default; 28 | 29 | // Text styles for labels 30 | $ct-text-color: rgba(0, 0, 0, 0.4) !default; 31 | $ct-text-size: 1.3rem !default; 32 | $ct-text-align: flex-start !default; 33 | $ct-text-justify: flex-start !default; 34 | $ct-text-line-height: 1; 35 | 36 | // Grid styles 37 | $ct-grid-color: rgba(0, 0, 0, 0.2) !default; 38 | $ct-grid-dasharray: 2px !default; 39 | $ct-grid-width: 1px !default; 40 | 41 | // Line chart properties 42 | $ct-line-width: 3px !default; 43 | $ct-line-dasharray: false !default; 44 | $ct-point-size: 8px !default; 45 | // Line chart point, can be either round or square 46 | $ct-point-shape: round !default; 47 | // Area fill transparency between 0 and 1 48 | $ct-area-opacity: 0.8 !default; 49 | 50 | // Bar chart bar width 51 | $ct-bar-width: 10px !default; 52 | 53 | // Donut width (If donut width is to big it can cause issues where the shape gets distorted) 54 | $ct-donut-width: 60px !default; 55 | 56 | // If set to true it will include the default classes and generate CSS output. If you're planning to use the mixins you 57 | // should set this property to false 58 | $ct-include-classes: true !default; 59 | 60 | // If this is set to true the CSS will contain colored series. You can extend or change the color with the 61 | // properties below 62 | $ct-include-colored-series: $ct-include-classes !default; 63 | 64 | // If set to true this will include all responsive container variations using the scales defined at the top of the script 65 | $ct-include-alternative-responsive-containers: $ct-include-classes !default; 66 | 67 | // Series names and colors. This can be extended or customized as desired. Just add more series and colors. 68 | $ct-series-names: (a, b, c, d, e, f, g, h, i, j, k, l, m, n, o) !default; 69 | $ct-series-colors: ( 70 | $new-blue, 71 | $new-red, 72 | $new-orange, 73 | $new-purple, 74 | $new-green, 75 | $new-dark-blue, 76 | $new-black, 77 | $social-google, 78 | $social-tumblr, 79 | $social-youtube, 80 | $social-twitter, 81 | $social-pinterest, 82 | $social-behance, 83 | #6188e2, 84 | #a748ca 85 | ) !default; -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/sass/lbd/mixins/_icons.scss: -------------------------------------------------------------------------------- 1 | @mixin icon-background ($icon-url){ 2 | background-image : url($icon-url); 3 | 4 | } 5 | 6 | @mixin icon-shape ($size, $padding, $border-radius) { 7 | height: $size; 8 | width: $size; 9 | padding: $padding; 10 | border-radius: $border-radius; 11 | display: inline-table; 12 | 13 | } -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/sass/lbd/mixins/_inputs.scss: -------------------------------------------------------------------------------- 1 | @mixin input-size($padding-vertical, $padding-horizontal, $height){ 2 | padding: $padding-vertical $padding-horizontal; 3 | height: $height; 4 | } 5 | 6 | @mixin placeholder($color, $opacity){ 7 | color: $color; 8 | @include opacity(1); 9 | } 10 | 11 | @mixin light-form(){ 12 | border-radius: 0; 13 | border:0; 14 | padding: 0; 15 | background-color: transparent; 16 | 17 | } -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/sass/lbd/mixins/_labels.scss: -------------------------------------------------------------------------------- 1 | @mixin label-style(){ 2 | padding: $padding-label-vertical $padding-label-horizontal; 3 | border: 1px solid $default-color; 4 | border-radius: $border-radius-small; 5 | color: $default-color; 6 | font-weight: $font-weight-semi; 7 | font-size: $font-size-small; 8 | text-transform: uppercase; 9 | display: inline-block; 10 | vertical-align: middle; 11 | } 12 | 13 | @mixin label-color($color){ 14 | border-color: $color; 15 | color: $color; 16 | } 17 | @mixin label-color-fill($color){ 18 | border-color: $color; 19 | color: $white-color; 20 | background-color: $color; 21 | } -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/sass/lbd/mixins/_morphing-buttons.scss: -------------------------------------------------------------------------------- 1 | $prefixes: ('', '-moz-', '-webkit-', '-ms-') !default; 2 | 3 | @mixin circle-animation(){ 4 | @for $i from 0 to length($prefixes) { 5 | @include circle-animation-details(nth($prefixes, $i + 1)); 6 | } 7 | } 8 | 9 | @mixin circle-animation-details($name){ 10 | #{$name}animation-name: spin; 11 | #{$name}animation-duration: 1250ms; 12 | #{$name}animation-iteration-count: infinite; 13 | #{$name}animation-timing-function: linear; 14 | 15 | } 16 | @keyframes spin { 17 | from { transform:rotate(0deg); } 18 | to { transform:rotate(360deg); } 19 | } 20 | 21 | @-webkit-keyframes spin { 22 | from { -webkit-transform: rotate(0deg); } 23 | to { -webkit-transform: rotate(360deg); } 24 | } 25 | 26 | @-moz-keyframes spin { 27 | from { -moz-transform: rotate(0deg); } 28 | to { -moz-transform: rotate(360deg); } 29 | } 30 | 31 | @-ms-keyframes spin { 32 | from { -ms-transform: rotate(0deg); } 33 | to { -ms-transform: rotate(360deg); } 34 | } -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/sass/lbd/mixins/_navbars.scss: -------------------------------------------------------------------------------- 1 | @mixin navbar-color($color){ 2 | background-color: $color; 3 | } 4 | 5 | @mixin center-item(){ 6 | left: 0; 7 | right: 0; 8 | margin-right: auto; 9 | margin-left: auto; 10 | position: absolute; 11 | } -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/sass/lbd/mixins/_social-buttons.scss: -------------------------------------------------------------------------------- 1 | @mixin social-buttons-color ($color){ 2 | 3 | border-color: $color; 4 | color: $color; 5 | 6 | &:hover, 7 | &:focus, 8 | &:active, 9 | &.active, 10 | .open > &.dropdown-toggle { 11 | background-color: $transparent-bg; 12 | color: $color; 13 | border-color: $color; 14 | opacity: 1; 15 | } 16 | 17 | &:disabled, 18 | &[disabled], 19 | &.disabled { 20 | background-color: $transparent-bg; 21 | border-color: $color; 22 | } 23 | 24 | &.btn-fill { 25 | color: $white-color; 26 | background-color: $color; 27 | opacity: 0.9; 28 | 29 | &:hover, 30 | &:focus, 31 | &:active, 32 | &.active, 33 | .open > &.dropdown-toggle{ 34 | background-color: $color; 35 | color: $white-color; 36 | opacity: 1; 37 | } 38 | 39 | } 40 | 41 | 42 | } 43 | -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/sass/lbd/mixins/_tabs.scss: -------------------------------------------------------------------------------- 1 | @mixin pill-style($color){ 2 | border: 1px solid $color; 3 | color: $color; 4 | } -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/sass/lbd/mixins/_transparency.scss: -------------------------------------------------------------------------------- 1 | // Opacity 2 | 3 | @mixin opacity($opacity) { 4 | opacity: $opacity; 5 | // IE8 filter 6 | $opacity-ie: ($opacity * 100); 7 | filter: #{alpha(opacity=$opacity-ie)}; 8 | } 9 | 10 | @mixin black-filter($opacity){ 11 | top: 0; 12 | left: 0; 13 | height: 100%; 14 | width: 100%; 15 | position: absolute; 16 | background-color: rgba(17,17,17,$opacity); 17 | display: block; 18 | content: ""; 19 | z-index: 1; 20 | } -------------------------------------------------------------------------------- /Chapter02/light-bootstrap-dashboard/assets/sass/light-bootstrap-dashboard.scss: -------------------------------------------------------------------------------- 1 | 2 | /*! 3 | 4 | ========================================================= 5 | * Light Bootstrap Dashboard - v1.3.1.0 6 | ========================================================= 7 | 8 | * Product Page: http://www.creative-tim.com/product/light-bootstrap-dashboard 9 | * Copyright 2017 Creative Tim (http://www.creative-tim.com) 10 | * Licensed under MIT (https://github.com/creativetimofficial/light-bootstrap-dashboard/blob/master/LICENSE.md) 11 | 12 | ========================================================= 13 | 14 | * The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. 15 | 16 | */ 17 | 18 | @import "lbd/variables"; 19 | @import "lbd/mixins"; 20 | 21 | @import "lbd/typography"; 22 | 23 | // Core CSS 24 | @import "lbd/misc"; 25 | @import "lbd/sidebar-and-main-panel"; 26 | @import "lbd/buttons"; 27 | @import "lbd/inputs"; 28 | 29 | @import "lbd/alerts"; 30 | @import "lbd/tables"; 31 | 32 | @import "lbd/checkbox-radio-switch"; 33 | @import "lbd/navbars"; 34 | @import "lbd/footers"; 35 | 36 | // Fancy Stuff 37 | @import "lbd/dropdown"; 38 | @import "lbd/cards"; 39 | @import "lbd/chartist"; 40 | @import "lbd/responsive"; 41 | -------------------------------------------------------------------------------- /Chapter02/output_writer.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | import csv 3 | import os 4 | import sys 5 | 6 | """ 7 | MIT License 8 | 9 | Copyright (c) 2017 Chapin Bryce, Preston Miller 10 | 11 | Please share comments and questions at: 12 | https://github.com/PythonForensics/PythonForensicsCookbook 13 | or email pyforcookbook@gmail.com 14 | 15 | Permission is hereby granted, free of charge, to any person obtaining a copy 16 | of this software and associated documentation files (the "Software"), to deal 17 | in the Software without restriction, including without limitation the rights 18 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 19 | copies of the Software, and to permit persons to whom the Software is 20 | furnished to do so, subject to the following conditions: 21 | 22 | The above copyright notice and this permission notice shall be included in all 23 | copies or substantial portions of the Software. 24 | 25 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 26 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 27 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 28 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 29 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 30 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 31 | SOFTWARE. 32 | """ 33 | 34 | TEST_DATA_LIST = [["Bill", 53, 0], ["Alice", 42, 5], 35 | ["Zane", 33, -1], ["Theodore", 72, 9001]] 36 | 37 | TEST_DATA_DICT = [{"Name": "Bill", "Age": 53, "Cool Factor": 0}, 38 | {"Name": "Alice", "Age": 42, "Cool Factor": 5}, 39 | {"Name": "Zane", "Age": 33, "Cool Factor": -1}, 40 | {"Name": "Theodore", "Age": 72, "Cool Factor": 9001}] 41 | 42 | 43 | def csv_writer_py2(data, header, output_directory, name=None): 44 | if name is None: 45 | name = "output.csv" 46 | 47 | print("[+] Writing {} to {}".format(name, output_directory)) 48 | 49 | with open(os.path.join(output_directory, name), "wb") as csvfile: 50 | writer = csv.writer(csvfile) 51 | writer.writerow(header) 52 | 53 | writer.writerows(data) 54 | 55 | 56 | def csv_writer_py3(data, header, output_directory, name=None): 57 | if name is None: 58 | name = "output.csv" 59 | 60 | print("[+] Writing {} to {}".format(name, output_directory)) 61 | 62 | with open(os.path.join(output_directory, name), "w", newline="") as \ 63 | csvfile: 64 | writer = csv.writer(csvfile) 65 | writer.writerow(header) 66 | 67 | writer.writerows(data) 68 | 69 | 70 | def unicode_csv_dict_writer_py2(data, header, output_directory, name=None): 71 | try: 72 | import unicodecsv 73 | except ImportError: 74 | print("[+] Install unicodecsv module before executing this" 75 | " function") 76 | sys.exit(1) 77 | 78 | if name is None: 79 | name = "output.csv" 80 | 81 | print("[+] Writing {} to {}".format(name, output_directory)) 82 | with open(os.path.join(output_directory, name), "wb") as csvfile: 83 | writer = unicodecsv.DictWriter(csvfile, fieldnames=header) 84 | writer.writeheader() 85 | 86 | writer.writerows(data) 87 | 88 | 89 | if sys.version_info < (3, 0): 90 | csv_writer_py2(TEST_DATA_LIST, ["Name", "Age", "Cool Factor"], 91 | os.getcwd()) 92 | unicode_csv_dict_writer_py2( 93 | TEST_DATA_DICT, ["Name", "Age", "Cool Factor"], os.getcwd(), 94 | "dict_output.csv") 95 | 96 | elif sys.version_info >= (3, 0): 97 | csv_writer_py3(TEST_DATA_LIST, ["Name", "Age", "Cool Factor"], 98 | os.getcwd()) 99 | -------------------------------------------------------------------------------- /Chapter02/screenshotter.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | import argparse 3 | from multiprocessing import freeze_support 4 | import os 5 | import sys 6 | import time 7 | 8 | try: 9 | import pyscreenshot 10 | import wx 11 | except ImportError: 12 | print("[-] Install wx and pyscreenshot to use this script") 13 | sys.exit(1) 14 | 15 | """ 16 | MIT License 17 | 18 | Copyright (c) 2017 Chapin Bryce, Preston Miller 19 | 20 | Please share comments and questions at: 21 | https://github.com/PythonForensics/PythonForensicsCookbook 22 | or email pyforcookbook@gmail.com 23 | 24 | Permission is hereby granted, free of charge, to any person obtaining a copy 25 | of this software and associated documentation files (the "Software"), to deal 26 | in the Software without restriction, including without limitation the rights 27 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 28 | copies of the Software, and to permit persons to whom the Software is 29 | furnished to do so, subject to the following conditions: 30 | 31 | The above copyright notice and this permission notice shall be included in all 32 | copies or substantial portions of the Software. 33 | 34 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 35 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 36 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 37 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 38 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 39 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 40 | SOFTWARE. 41 | """ 42 | 43 | __authors__ = ["Chapin Bryce", "Preston Miller"] 44 | __date__ = 20170815 45 | __description__ = "Capture incremental screenshots" 46 | 47 | 48 | def main(output_dir, interval, total): 49 | i = 0 50 | while True: 51 | i += 1 52 | time.sleep(interval) 53 | image = pyscreenshot.grab() 54 | output = os.path.join(output_dir, "screenshot_{}.png").format(i) 55 | image.save(output) 56 | print("[+] Took screenshot {} and saved it to {}".format( 57 | i, output_dir)) 58 | if total is not None and i == total: 59 | print("[+] Finished taking {} screenshots every {} " 60 | "seconds".format(total, interval)) 61 | sys.exit(0) 62 | 63 | 64 | if __name__ == "__main__": 65 | # Command-line Argument Parser 66 | parser = argparse.ArgumentParser( 67 | description=__description__, 68 | epilog="Developed by {} on {}".format( 69 | ", ".join(__authors__), __date__) 70 | ) 71 | parser.add_argument("OUTPUT_DIR", help="Desired Output Path") 72 | parser.add_argument( 73 | "INTERVAL", help="Screenshot interval (seconds)", type=int) 74 | parser.add_argument( 75 | "-total", help="Total number of screenshots to take", type=int) 76 | args = parser.parse_args() 77 | 78 | if not os.path.exists(args.OUTPUT_DIR): 79 | os.makedirs(args.OUTPUT_DIR) 80 | 81 | main(args.OUTPUT_DIR, args.INTERVAL, args.total) 82 | -------------------------------------------------------------------------------- /Chapter02/utility/__init__.py: -------------------------------------------------------------------------------- 1 | import utilcsv 2 | -------------------------------------------------------------------------------- /Chapter02/utility/utilcsv.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | import csv 3 | import os 4 | import sys 5 | 6 | """ 7 | MIT License 8 | 9 | Copyright (c) 2017 Chapin Bryce, Preston Miller 10 | 11 | Please share comments and questions at: 12 | https://github.com/PythonForensics/PythonForensicsCookbook 13 | or email pyforcookbook@gmail.com 14 | 15 | Permission is hereby granted, free of charge, to any person obtaining a copy 16 | of this software and associated documentation files (the "Software"), to deal 17 | in the Software without restriction, including without limitation the rights 18 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 19 | copies of the Software, and to permit persons to whom the Software is 20 | furnished to do so, subject to the following conditions: 21 | 22 | The above copyright notice and this permission notice shall be included in all 23 | copies or substantial portions of the Software. 24 | 25 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 26 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 27 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 28 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 29 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 30 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 31 | SOFTWARE. 32 | """ 33 | 34 | 35 | def csv_writer(data, header, output_directory, name=None): 36 | if name is None: 37 | name = "output.csv" 38 | 39 | if sys.version_info < (3, 0): 40 | with open(os.path.join(output_directory, name), "wb") as csvfile: 41 | writer = csv.writer(csvfile) 42 | writer.writerow(header) 43 | 44 | writer.writerows(data) 45 | else: 46 | with open(os.path.join(output_directory, name), "w", newline="") as csvfile: 47 | writer = csv.writer(csvfile) 48 | writer.writerow(header) 49 | 50 | writer.writerows(data) 51 | 52 | 53 | def csv_reader(f_path): 54 | if sys.version_info < (3, 0): 55 | with open(f_path, "rb") as csvfile: 56 | reader = csv.reader(csvfile) 57 | 58 | return list(reader) 59 | else: 60 | with open(f_path, newline="") as csvfile: 61 | reader = csv.reader(csvfile) 62 | 63 | return list(reader) 64 | 65 | 66 | def unicode_csv_dict_writer(data, header, output_directory, name=None): 67 | try: 68 | import unicodecsv 69 | except ImportError: 70 | print("[+] Install unicodecsv module before executing this function") 71 | sys.exit(1) 72 | 73 | if name is None: 74 | name = "output.csv" 75 | 76 | print("[+] Writing {} to {}".format(name, output_directory)) 77 | with open(os.path.join(output_directory, name), "wb") as csvfile: 78 | writer = unicodecsv.DictWriter(csvfile, fieldnames=header) 79 | writer.writeheader() 80 | 81 | writer.writerows(data) 82 | -------------------------------------------------------------------------------- /Chapter02/xlsx_writer.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | import argparse 3 | from collections import Counter 4 | from datetime import datetime 5 | import os 6 | import sys 7 | from utility import utilcsv 8 | 9 | try: 10 | import xlsxwriter 11 | except ImportError: 12 | print("[-] Install required third-party module xlsxwriter") 13 | sys.exit(1) 14 | 15 | """ 16 | MIT License 17 | 18 | Copyright (c) 2017 Chapin Bryce, Preston Miller 19 | 20 | Please share comments and questions at: 21 | https://github.com/PythonForensics/PythonForensicsCookbook 22 | or email pyforcookbook@gmail.com 23 | 24 | Permission is hereby granted, free of charge, to any person obtaining a copy 25 | of this software and associated documentation files (the "Software"), to deal 26 | in the Software without restriction, including without limitation the rights 27 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 28 | copies of the Software, and to permit persons to whom the Software is 29 | furnished to do so, subject to the following conditions: 30 | 31 | The above copyright notice and this permission notice shall be included in all 32 | copies or substantial portions of the Software. 33 | 34 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 35 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 36 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 37 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 38 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 39 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 40 | SOFTWARE. 41 | """ 42 | 43 | __authors__ = ["Chapin Bryce", "Preston Miller"] 44 | __date__ = 20170815 45 | __description__ = "Create charts in XLSX files" 46 | 47 | 48 | def main(output_directory): 49 | print("[+] Reading in sample data set") 50 | # Skip first row of headers 51 | data = utilcsv.csv_reader("redacted_sample_event_log.csv")[1:] 52 | xlsx_writer(data, output_directory) 53 | 54 | 55 | def xlsx_writer(data, output_directory): 56 | print("[+] Writing output.xlsx file to {}".format(output_directory)) 57 | workbook = xlsxwriter.Workbook( 58 | os.path.join(output_directory, "output.xlsx")) 59 | dashboard = workbook.add_worksheet("Dashboard") 60 | data_sheet = workbook.add_worksheet("Data") 61 | 62 | title_format = workbook.add_format({ 63 | 'bold': True, 'font_color': 'white', 'bg_color': 'black', 64 | 'font_size': 30, 'font_name': 'Calibri', 'align': 'center' 65 | }) 66 | date_format = workbook.add_format( 67 | {'num_format': 'mm/dd/yy hh:mm:ss AM/PM'}) 68 | 69 | # Write CSV data to Data worksheet 70 | for i, record in enumerate(data): 71 | data_sheet.write_number(i, 0, int(record[0])) 72 | data_sheet.write(i, 1, record[1]) 73 | data_sheet.write(i, 2, record[2]) 74 | dt = datetime.strptime(record[3], "%m/%d/%Y %H:%M:%S %p") 75 | data_sheet.write_datetime(i, 3, dt, date_format) 76 | data_sheet.write_number(i, 4, int(record[4])) 77 | data_sheet.write(i, 5, record[5]) 78 | data_sheet.write_number(i, 6, int(record[6])) 79 | data_sheet.write(i, 7, record[7]) 80 | 81 | data_length = len(data) + 1 82 | data_sheet.add_table( 83 | "A1:H{}".format(data_length), 84 | {"columns": [ 85 | {"header": "Index"}, 86 | {"header": "File Name"}, 87 | {"header": "Computer Name"}, 88 | {"header": "Written Date"}, 89 | {"header": "Event Level"}, 90 | {"header": "Event Source"}, 91 | {"header": "Event ID"}, 92 | {"header": "File Path"} 93 | ]} 94 | ) 95 | 96 | event_ids = Counter([x[6] for x in data]) 97 | dashboard.merge_range('A1:Q1', 'Event Log Dashboard', title_format) 98 | for i, record in enumerate(event_ids): 99 | dashboard.write(100 + i, 0, record) 100 | dashboard.write(100 + i, 1, event_ids[record]) 101 | 102 | dashboard.add_table("A100:B{}".format( 103 | 100 + len(event_ids)), 104 | {"columns": [{"header": "Event ID"}, {"header": "Occurrence"}]} 105 | ) 106 | 107 | event_chart = workbook.add_chart({'type': 'bar'}) 108 | event_chart.set_title({'name': 'Event ID Breakdown'}) 109 | event_chart.set_size({'x_scale': 2, 'y_scale': 5}) 110 | 111 | event_chart.add_series( 112 | {'categories': '=Dashboard!$A$101:$A${}'.format( 113 | 100 + len(event_ids)), 114 | 'values': '=Dashboard!$B$101:$B${}'.format( 115 | 100 + len(event_ids))}) 116 | dashboard.insert_chart('C5', event_chart) 117 | 118 | workbook.close() 119 | 120 | 121 | if __name__ == "__main__": 122 | # Command-line Argument Parser 123 | parser = argparse.ArgumentParser( 124 | description=__description__, 125 | epilog="Developed by {} on {}".format( 126 | ", ".join(__authors__), __date__) 127 | ) 128 | parser.add_argument("OUTPUT_DIR", help="Desired Output Path") 129 | args = parser.parse_args() 130 | 131 | if not os.path.exists(args.OUTPUT_DIR): 132 | os.makedirs(args.OUTPUT_DIR) 133 | 134 | main(args.OUTPUT_DIR) 135 | -------------------------------------------------------------------------------- /Chapter03/plist_parser.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | import argparse 3 | import biplist 4 | import os 5 | import sys 6 | 7 | """ 8 | MIT License 9 | 10 | Copyright (c) 2017 Chapin Bryce, Preston Miller 11 | 12 | Please share comments and questions at: 13 | https://github.com/PythonForensics/PythonForensicsCookbook 14 | or email pyforcookbook@gmail.com 15 | 16 | Permission is hereby granted, free of charge, to any person obtaining a copy 17 | of this software and associated documentation files (the "Software"), to deal 18 | in the Software without restriction, including without limitation the rights 19 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 20 | copies of the Software, and to permit persons to whom the Software is 21 | furnished to do so, subject to the following conditions: 22 | 23 | The above copyright notice and this permission notice shall be included in all 24 | copies or substantial portions of the Software. 25 | 26 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 27 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 28 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 29 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 30 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 31 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 32 | SOFTWARE. 33 | """ 34 | 35 | __authors__ = ["Chapin Bryce", "Preston Miller"] 36 | __date__ = 20170815 37 | __description__ = "Property List Parser" 38 | 39 | 40 | def main(plist): 41 | print("[+] Opening {} file".format(plist)) 42 | try: 43 | plist_data = biplist.readPlist(plist) 44 | except (biplist.InvalidPlistException, 45 | biplist.NotBinaryPlistException) as e: 46 | print("[-] Invalid PLIST file - unable to be opened by biplist") 47 | sys.exit(2) 48 | 49 | print("[+] Printing Info.plist Device " 50 | "and User Information to Console\n") 51 | for k in plist_data: 52 | if k != 'Applications' and k != 'iTunes Files': 53 | print("{:<25s} - {}".format(k, plist_data[k])) 54 | 55 | 56 | if __name__ == "__main__": 57 | parser = argparse.ArgumentParser( 58 | description=__description__, 59 | epilog="Developed by {} on {}".format( 60 | ", ".join(__authors__), __date__) 61 | ) 62 | parser.add_argument("PLIST_FILE", help="Input PList File") 63 | args = parser.parse_args() 64 | 65 | if not os.path.exists(args.PLIST_FILE) or \ 66 | not os.path.isfile(args.PLIST_FILE): 67 | print("[-] {} does not exist or is not a file".format( 68 | args.PLIST_FILE)) 69 | sys.exit(1) 70 | 71 | main(args.PLIST_FILE) 72 | -------------------------------------------------------------------------------- /Chapter03/sqlite_gaps.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | import argparse 3 | import os 4 | import sqlite3 5 | import sys 6 | 7 | """ 8 | MIT License 9 | 10 | Copyright (c) 2017 Chapin Bryce, Preston Miller 11 | 12 | Please share comments and questions at: 13 | https://github.com/PythonForensics/PythonForensicsCookbook 14 | or email pyforcookbook@gmail.com 15 | 16 | Permission is hereby granted, free of charge, to any person obtaining a copy 17 | of this software and associated documentation files (the "Software"), to deal 18 | in the Software without restriction, including without limitation the rights 19 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 20 | copies of the Software, and to permit persons to whom the Software is 21 | furnished to do so, subject to the following conditions: 22 | 23 | The above copyright notice and this permission notice shall be included in all 24 | copies or substantial portions of the Software. 25 | 26 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 27 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 28 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 29 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 30 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 31 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 32 | SOFTWARE. 33 | """ 34 | 35 | __authors__ = ["Chapin Bryce", "Preston Miller"] 36 | __date__ = 20170815 37 | __description__ = "SQLite gap analysis utility" 38 | 39 | 40 | def main(database, table, **kwargs): 41 | print("[+] Attempting connection to {} database".format(database)) 42 | if not os.path.exists(database) or not os.path.isfile(database): 43 | print("[-] Database does not exist or is not a file") 44 | sys.exit(1) 45 | 46 | # Connect to SQLite Database 47 | conn = sqlite3.connect(database) 48 | c = conn.cursor() 49 | 50 | # Query Table for Primary Key 51 | c.execute("pragma table_info({})".format(table)) 52 | table_data = c.fetchall() 53 | if table_data == []: 54 | print("[-] Check spelling of table name - '{}' did not return " 55 | "any results".format(table)) 56 | sys.exit(2) 57 | 58 | if "col" in kwargs: 59 | find_gaps(c, table, kwargs["col"]) 60 | 61 | else: 62 | # Add Primary Keys to List 63 | potential_pks = [] 64 | for row in table_data: 65 | if row[-1] == 1: 66 | potential_pks.append(row[1]) 67 | 68 | if len(potential_pks) != 1: 69 | print("[-] None or multiple primary keys found -- please " 70 | "check if there is a primary key or specify a specific " 71 | "key using the --column argument") 72 | sys.exit(3) 73 | 74 | find_gaps(c, table, potential_pks[0]) 75 | 76 | 77 | def find_gaps(db_conn, table, pk): 78 | print("[+] Identifying missing ROWIDs for {} column".format(pk)) 79 | try: 80 | db_conn.execute("select {} from {}".format(pk, table)) 81 | except sqlite3.OperationalError: 82 | print("[-] '{}' column does not exist -- " 83 | "please check spelling".format(pk)) 84 | sys.exit(4) 85 | results = db_conn.fetchall() 86 | rowids = sorted([x[0] for x in results]) 87 | total_missing = rowids[-1] - len(rowids) 88 | 89 | if total_missing == 0: 90 | print("[*] No missing ROWIDs from {} column".format(pk)) 91 | sys.exit(0) 92 | else: 93 | print("[+] {} missing ROWID(s) from {} column".format( 94 | total_missing, pk)) 95 | 96 | # Find Missing ROWIDs 97 | gaps = set(range(rowids[0], rowids[-1] + 1)).difference(rowids) 98 | print("[*] Missing ROWIDS: {}".format(gaps)) 99 | 100 | 101 | if __name__ == "__main__": 102 | # Command-line Argument Parser 103 | parser = argparse.ArgumentParser( 104 | description=__description__, 105 | epilog="Developed by {} on {}".format( 106 | ", ".join(__authors__), __date__) 107 | ) 108 | parser.add_argument("SQLITE_DATABASE", help="Input SQLite database") 109 | parser.add_argument("TABLE", help="Table to query from") 110 | parser.add_argument("--column", help="Optional column argument") 111 | args = parser.parse_args() 112 | 113 | if args.column is not None: 114 | main(args.SQLITE_DATABASE, args.TABLE, col=args.column) 115 | else: 116 | main(args.SQLITE_DATABASE, args.TABLE) 117 | -------------------------------------------------------------------------------- /Chapter03/sqlite_sms.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | import argparse 3 | import csv 4 | import os 5 | import sqlite3 6 | import sys 7 | 8 | """ 9 | MIT License 10 | 11 | Copyright (c) 2017 Chapin Bryce, Preston Miller 12 | 13 | Please share comments and questions at: 14 | https://github.com/PythonForensics/PythonForensicsCookbook 15 | or email pyforcookbook@gmail.com 16 | 17 | Permission is hereby granted, free of charge, to any person obtaining a copy 18 | of this software and associated documentation files (the "Software"), to deal 19 | in the Software without restriction, including without limitation the rights 20 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 21 | copies of the Software, and to permit persons to whom the Software is 22 | furnished to do so, subject to the following conditions: 23 | 24 | The above copyright notice and this permission notice shall be included in all 25 | copies or substantial portions of the Software. 26 | 27 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 28 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 29 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 30 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 31 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 32 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 33 | SOFTWARE. 34 | """ 35 | 36 | __authors__ = ["Chapin Bryce", "Preston Miller"] 37 | __date__ = 20170815 38 | __description__ = "SQLite SMS analysis utility" 39 | 40 | 41 | def main(database, out_csv): 42 | print("[+] Attempting connection to {} database".format(database)) 43 | if not os.path.exists(database) or not os.path.isfile(database): 44 | print("[-] Database does not exist or is not a file") 45 | sys.exit(1) 46 | 47 | # Connect to SQLite Database 48 | conn = sqlite3.connect(database) 49 | c = conn.cursor() 50 | 51 | # Query DB for Column Names and Data of Message Table 52 | c.execute("pragma table_info(message)") 53 | table_data = c.fetchall() 54 | columns = [x[1] for x in table_data] 55 | 56 | c.execute("select * from message") 57 | message_data = c.fetchall() 58 | 59 | print("[+] Writing Message Content to {}".format(out_csv)) 60 | write_csv(out_csv, columns, message_data) 61 | 62 | 63 | def write_csv(output, cols, msgs): 64 | with open(output, "w", newline="") as csvfile: 65 | csv_writer = csv.writer(csvfile) 66 | csv_writer.writerow(cols) 67 | csv_writer.writerows(msgs) 68 | 69 | 70 | if __name__ == '__main__': 71 | # Command-line Argument Parser 72 | parser = argparse.ArgumentParser( 73 | description=__description__, 74 | epilog="Developed by {} on {}".format( 75 | ", ".join(__authors__), __date__) 76 | ) 77 | parser.add_argument("SQLITE_DATABASE", help="Input SQLite database") 78 | parser.add_argument("OUTPUT_CSV", help="Output CSV File") 79 | args = parser.parse_args() 80 | 81 | directory = os.path.dirname(args.OUTPUT_CSV) 82 | if directory != '' and not os.path.exists(directory): 83 | os.makedirs(directory) 84 | 85 | main(args.SQLITE_DATABASE, args.OUTPUT_CSV) 86 | -------------------------------------------------------------------------------- /Chapter04/av_metadata.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | import argparse 3 | import json 4 | import mutagen 5 | 6 | """ 7 | MIT License 8 | 9 | Copyright (c) 2017 Chapin Bryce, Preston Miller 10 | 11 | Please share comments and questions at: 12 | https://github.com/PythonForensics/PythonForensicsCookbook 13 | or email pyforcookbook@gmail.com 14 | 15 | Permission is hereby granted, free of charge, to any person obtaining a copy 16 | of this software and associated documentation files (the "Software"), to deal 17 | in the Software without restriction, including without limitation the rights 18 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 19 | copies of the Software, and to permit persons to whom the Software is 20 | furnished to do so, subject to the following conditions: 21 | 22 | The above copyright notice and this permission notice shall be included in all 23 | copies or substantial portions of the Software. 24 | 25 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 26 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 27 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 28 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 29 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 30 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 31 | SOFTWARE. 32 | """ 33 | 34 | __authors__ = ["Chapin Bryce", "Preston Miller"] 35 | __date__ = 20170815 36 | __description__ = "Utility to extract metadata from A/V Filess" 37 | 38 | 39 | def handle_id3(id3_file): 40 | # Definitions from http://id3.org/id3v2.4.0-frames 41 | id3_frames = { 42 | 'TIT2': 'Title', 'TPE1': 'Artist', 'TALB': 'Album', 43 | 'TXXX': 'Custom', 'TCON': 'Content Type', 'TDRL': 'Date released', 44 | 'COMM': 'Comments', 'TDRC': 'Recording Date'} 45 | print("{:15} | {:15} | {:38} | {}".format("Frame", "Description", 46 | "Text", "Value")) 47 | print("-" * 85) 48 | 49 | for frames in id3_file.tags.values(): 50 | frame_name = id3_frames.get(frames.FrameID, frames.FrameID) 51 | desc = getattr(frames, 'desc', "N/A") 52 | text = getattr(frames, 'text', ["N/A"])[0] 53 | value = getattr(frames, 'value', "N/A") 54 | if "date" in frame_name.lower(): 55 | text = str(text) 56 | 57 | print("{:15} | {:15} | {:38} | {}".format( 58 | frame_name, desc, text, value)) 59 | 60 | 61 | def handle_mp4(mp4_file): 62 | # Definitions from 63 | # http://www.sno.phy.queensu.ca/~phil/exiftool/TagNames/QuickTime.html 64 | cp_sym = u"\u00A9" 65 | qt_tag = { 66 | cp_sym + 'nam': 'Title', cp_sym + 'art': 'Artist', 67 | cp_sym + 'alb': 'Album', cp_sym + 'gen': 'Genre', 68 | 'cpil': 'Compilation', cp_sym + 'day': 'Creation Date', 69 | 'cnID': 'Apple Store Content ID', 'atID': 'Album Title ID', 70 | 'plID': 'Playlist ID', 'geID': 'Genre ID', 'pcst': 'Podcast', 71 | 'purl': 'Podcast URL', 'egid': 'Episode Global ID', 72 | 'cmID': 'Camera ID', 'sfID': 'Apple Store Country', 73 | 'desc': 'Description', 'ldes': 'Long Description'} 74 | # Definitions from 75 | # http://www.sno.phy.queensu.ca/~phil/exiftool/TagNames/QuickTime.html#GenreID 76 | genre_ids = json.load(open('apple_genres.json')) 77 | 78 | print("{:22} | {}".format('Name', 'Value')) 79 | print("-" * 40) 80 | for name, value in mp4_file.tags.items(): 81 | tag_name = qt_tag.get(name, name) 82 | if isinstance(value, list): 83 | value = "; ".join([str(x) for x in value]) 84 | if name == 'geID': 85 | value = "{}: {}".format( 86 | value, genre_ids[str(value)].replace("|", " - ")) 87 | print("{:22} | {}".format(tag_name, value)) 88 | 89 | 90 | if __name__ == '__main__': 91 | parser = argparse.ArgumentParser( 92 | description=__description__, 93 | epilog="Developed by {} on {}".format( 94 | ", ".join(__authors__), __date__) 95 | ) 96 | parser.add_argument("AV_FILE", help="File to extract metadata from") 97 | args = parser.parse_args() 98 | av_file = mutagen.File(args.AV_FILE) 99 | 100 | file_ext = args.AV_FILE.rsplit('.', 1)[-1] 101 | if file_ext.lower() == 'mp3': 102 | handle_id3(av_file) 103 | elif file_ext.lower() == 'mp4': 104 | handle_mp4(av_file) 105 | -------------------------------------------------------------------------------- /Chapter04/exe_metadata.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | import argparse 3 | from datetime import datetime 4 | from pefile import PE 5 | 6 | """ 7 | MIT License 8 | 9 | Copyright (c) 2017 Chapin Bryce, Preston Miller 10 | 11 | Please share comments and questions at: 12 | https://github.com/PythonForensics/PythonForensicsCookbook 13 | or email pyforcookbook@gmail.com 14 | 15 | Permission is hereby granted, free of charge, to any person obtaining a copy 16 | of this software and associated documentation files (the "Software"), to deal 17 | in the Software without restriction, including without limitation the rights 18 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 19 | copies of the Software, and to permit persons to whom the Software is 20 | furnished to do so, subject to the following conditions: 21 | 22 | The above copyright notice and this permission notice shall be included in all 23 | copies or substantial portions of the Software. 24 | 25 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 26 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 27 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 28 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 29 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 30 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 31 | SOFTWARE. 32 | """ 33 | 34 | __authors__ = ["Chapin Bryce", "Preston Miller"] 35 | __date__ = 20170815 36 | __description__ = "Utility to extract metadata from EXE files" 37 | 38 | parser = argparse.ArgumentParser( 39 | description=__description__, 40 | epilog="Developed by {} on {}".format( 41 | ", ".join(__authors__), __date__) 42 | ) 43 | parser.add_argument("EXE_FILE", help="Path to exe file") 44 | parser.add_argument("-v", "--verbose", help="Increase verbosity of output", 45 | action='store_true', default=False) 46 | args = parser.parse_args() 47 | 48 | pe = PE(args.EXE_FILE) 49 | ped = pe.dump_dict() 50 | 51 | file_info = {} 52 | for structure in pe.FileInfo: 53 | if structure.Key == b'StringFileInfo': 54 | for s_table in structure.StringTable: 55 | for key, value in s_table.entries.items(): 56 | if value is None or len(value) == 0: 57 | value = "Unknown" 58 | file_info[key] = value 59 | print("File Information: ") 60 | print("==================") 61 | for k, v in file_info.items(): 62 | if isinstance(k, bytes): 63 | k = k.decode() 64 | if isinstance(v, bytes): 65 | v = v.decode() 66 | print("{}: {}".format(k, v)) 67 | 68 | # Compile time 69 | comp_time = ped['FILE_HEADER']['TimeDateStamp']['Value'] 70 | comp_time = comp_time.split("[")[-1].strip("]") 71 | time_stamp, timezone = comp_time.rsplit(" ", 1) 72 | comp_time = datetime.strptime(time_stamp, "%a %b %d %H:%M:%S %Y") 73 | print("Compiled on {} {}".format(comp_time, timezone.strip())) 74 | 75 | # Extract IOCs from PE Sections 76 | print("\nSections: ") 77 | print("==========") 78 | for section in ped['PE Sections']: 79 | print("Section '{}' at {}: {}/{} {}".format( 80 | section['Name']['Value'], hex(section['VirtualAddress']['Value']), 81 | section['Misc_VirtualSize']['Value'], 82 | section['SizeOfRawData']['Value'], section['MD5']) 83 | ) 84 | 85 | # Display Imports, Names, and Addresses 86 | if hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'): 87 | print("\nImports: ") 88 | print("=========") 89 | for dir_entry in pe.DIRECTORY_ENTRY_IMPORT: 90 | dll = dir_entry.dll 91 | if not args.verbose: 92 | print(dll.decode(), end=", ") 93 | continue 94 | 95 | name_list = [] 96 | for impts in dir_entry.imports: 97 | if getattr(impts, "name", b"Unknown") is None: 98 | name = b"Unknown" 99 | else: 100 | name = getattr(impts, "name", b"Unknown") 101 | name_list.append([name.decode(), hex(impts.address)]) 102 | name_fmt = ["{} ({})".format(x[0], x[1]) for x in name_list] 103 | print('- {}: {}'.format(dll.decode(), ", ".join(name_fmt))) 104 | if not args.verbose: 105 | print() 106 | 107 | # Display Exports, Names, and Addresses 108 | if hasattr(pe, 'DIRECTORY_ENTRY_EXPORT'): 109 | print("\nExports: ") 110 | print("=========") 111 | for sym in pe.DIRECTORY_ENTRY_EXPORT.symbols: 112 | print('- {}: {}'.format(sym.name.decode(), hex(sym.address))) 113 | -------------------------------------------------------------------------------- /Chapter04/msoffice_metadata.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | from argparse import ArgumentParser 3 | from datetime import datetime as dt 4 | from xml.etree import ElementTree as etree 5 | import zipfile 6 | 7 | """ 8 | MIT License 9 | 10 | Copyright (c) 2017 Chapin Bryce, Preston Miller 11 | 12 | Please share comments and questions at: 13 | https://github.com/PythonForensics/PythonForensicsCookbook 14 | or email pyforcookbook@gmail.com 15 | 16 | Permission is hereby granted, free of charge, to any person obtaining a copy 17 | of this software and associated documentation files (the "Software"), to deal 18 | in the Software without restriction, including without limitation the rights 19 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 20 | copies of the Software, and to permit persons to whom the Software is 21 | furnished to do so, subject to the following conditions: 22 | 23 | The above copyright notice and this permission notice shall be included in all 24 | copies or substantial portions of the Software. 25 | 26 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 27 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 28 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 29 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 30 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 31 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 32 | SOFTWARE. 33 | """ 34 | 35 | __authors__ = ["Chapin Bryce", "Preston Miller"] 36 | __date__ = 20170815 37 | __description__ = "Read metadta from Office files" 38 | 39 | parser = argparse.ArgumentParser( 40 | description=__description__, 41 | epilog="Developed by {} on {}".format(", ".join(__authors__), __date__) 42 | ) 43 | parser.add_argument("Office_File", help="Path to office file to read") 44 | args = parser.parse_args() 45 | 46 | # Check if input file is a zipfile 47 | zipfile.is_zipfile(args.Office_File) 48 | 49 | # Open the file (MS Office 2007 or later) 50 | zfile = zipfile.ZipFile(args.Office_File) 51 | 52 | # Extract key elements for processing 53 | core_xml = etree.fromstring(zfile.read('docProps/core.xml')) 54 | app_xml = etree.fromstring(zfile.read('docProps/app.xml')) 55 | 56 | # Core.xml tag mapping 57 | core_mapping = { 58 | 'title': 'Title', 59 | 'subject': 'Subject', 60 | 'creator': 'Author(s)', 61 | 'keywords': 'Keywords', 62 | 'description': 'Description', 63 | 'lastModifiedBy': 'Last Modified By', 64 | 'modified': 'Modified Date', 65 | 'created': 'Created Date', 66 | 'category': 'Category', 67 | 'contentStatus': 'Status', 68 | 'revision': 'Revision' 69 | } 70 | 71 | for element in core_xml.getchildren(): 72 | for key, title in core_mapping.items(): 73 | if key in element.tag: 74 | if 'date' in title.lower(): 75 | text = dt.strptime(element.text, "%Y-%m-%dT%H:%M:%SZ") 76 | else: 77 | text = element.text 78 | print("{}: {}".format(title, text)) 79 | 80 | app_mapping = { 81 | 'TotalTime': 'Edit Time (minutes)', 82 | 'Pages': 'Page Count', 83 | 'Words': 'Word Count', 84 | 'Characters': 'Character Count', 85 | 'Lines': 'Line Count', 86 | 'Paragraphs': 'Paragraph Count', 87 | 'Company': 'Company', 88 | 'HyperlinkBase': 'Hyperlink Base', 89 | 'Slides': 'Slide count', 90 | 'Notes': 'Note Count', 91 | 'HiddenSlides': 'Hidden Slide Count', 92 | } 93 | for element in app_xml.getchildren(): 94 | for key, title in app_mapping.items(): 95 | if key in element.tag: 96 | if 'date' in title.lower(): 97 | text = dt.strptime(element.text, "%Y-%m-%dT%H:%M:%SZ") 98 | else: 99 | text = element.text 100 | print("{}: {}".format(title, text)) 101 | -------------------------------------------------------------------------------- /Chapter04/pdf_metadata.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | from argparse import ArgumentParser, FileType 3 | import datetime 4 | from PyPDF2 import PdfFileReader 5 | import sys 6 | 7 | """ 8 | MIT License 9 | 10 | Copyright (c) 2017 Chapin Bryce, Preston Miller 11 | 12 | Please share comments and questions at: 13 | https://github.com/PythonForensics/PythonForensicsCookbook 14 | or email pyforcookbook@gmail.com 15 | 16 | Permission is hereby granted, free of charge, to any person obtaining a copy 17 | of this software and associated documentation files (the "Software"), to deal 18 | in the Software without restriction, including without limitation the rights 19 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 20 | copies of the Software, and to permit persons to whom the Software is 21 | furnished to do so, subject to the following conditions: 22 | 23 | The above copyright notice and this permission notice shall be included in all 24 | copies or substantial portions of the Software. 25 | 26 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 27 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 28 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 29 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 30 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 31 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 32 | SOFTWARE. 33 | """ 34 | 35 | __authors__ = ["Chapin Bryce", "Preston Miller"] 36 | __date__ = 20170815 37 | __description__ = "Utility to extract metadata from PDF files" 38 | 39 | parser = ArgumentParser( 40 | description=__description__, 41 | epilog="Developed by {} on {}".format(", ".join(__authors__), __date__) 42 | ) 43 | parser.add_argument('PDF_FILE', help='Path to PDF file', 44 | type=FileType('rb')) 45 | args = parser.parse_args() 46 | 47 | pdf_file = PdfFileReader(args.PDF_FILE) 48 | 49 | xmpm = pdf_file.getXmpMetadata() 50 | if xmpm is None: 51 | print("No XMP metadata found in document.") 52 | sys.exit() 53 | 54 | 55 | def custom_print(fmt_str, value): 56 | if isinstance(value, list): 57 | print(fmt_str.format(", ".join(value))) 58 | elif isinstance(value, dict): 59 | fmt_value = [":".join((k, v)) for k, v in value.items()] 60 | print(fmt_str.format(", ".join(value))) 61 | elif isinstance(value, str) or isinstance(value, bool): 62 | print(fmt_str.format(value)) 63 | elif isinstance(value, bytes): 64 | print(fmt_str.format(value.decode())) 65 | elif isinstance(value, datetime.datetime): 66 | print(fmt_str.format(value.isoformat())) 67 | elif value is None: 68 | print(fmt_str.format("N/A")) 69 | else: 70 | print("warn: unhandled type {} found".format(type(value))) 71 | 72 | 73 | # Definitions from 74 | # http://wwwimages.adobe.com/content/dam/Adobe/en/devnet/xmp/pdfs/XMP%20SDK%20Release%20cc-2016-08/XMPSpecificationPart1.pdf 75 | custom_print("Title: {}", xmpm.dc_title) 76 | custom_print("Creator(s): {}", xmpm.dc_creator) 77 | custom_print("Contributors: {}", xmpm.dc_contributor) 78 | custom_print("Subject: {}", xmpm.dc_subject) 79 | custom_print("Description: {}", xmpm.dc_description) 80 | custom_print("Created: {}", xmpm.xmp_createDate) 81 | custom_print("Modified: {}", xmpm.xmp_modifyDate) 82 | custom_print("Event Dates: {}", xmpm.dc_date) 83 | custom_print("Created With: {}", xmpm.xmp_creatorTool) 84 | custom_print("Document ID: {}", xmpm.xmpmm_documentId) 85 | custom_print("Instance ID: {}", xmpm.xmpmm_instanceId) 86 | custom_print("Language: {}", xmpm.dc_language) 87 | custom_print("Publisher: {}", xmpm.dc_publisher) 88 | custom_print("Resource Type: {}", xmpm.dc_format) 89 | custom_print("Type: {}", xmpm.dc_type) 90 | 91 | if xmpm.custom_properties: 92 | print("Custom Properties:") 93 | for k, v in xmpm.custom_properties.items(): 94 | print("\t{}: {}".format(k, v)) 95 | -------------------------------------------------------------------------------- /Chapter04/pic_metadata.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | import argparse 3 | from PIL import Image 4 | from PIL.ExifTags import TAGS 5 | import simplekml 6 | import sys 7 | 8 | """ 9 | MIT License 10 | 11 | Copyright (c) 2017 Chapin Bryce, Preston Miller 12 | 13 | Please share comments and questions at: 14 | https://github.com/PythonForensics/PythonForensicsCookbook 15 | or email pyforcookbook@gmail.com 16 | 17 | Permission is hereby granted, free of charge, to any person obtaining a copy 18 | of this software and associated documentation files (the "Software"), to deal 19 | in the Software without restriction, including without limitation the rights 20 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 21 | copies of the Software, and to permit persons to whom the Software is 22 | furnished to do so, subject to the following conditions: 23 | 24 | The above copyright notice and this permission notice shall be included in all 25 | copies or substantial portions of the Software. 26 | 27 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 28 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 29 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 30 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 31 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 32 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 33 | SOFTWARE. 34 | """ 35 | 36 | __authors__ = ["Chapin Bryce", "Preston Miller"] 37 | __date__ = 20170815 38 | __description__ = "Utility to gather EXIF data from images" 39 | 40 | parser = argparse.ArgumentParser( 41 | description=__description__, 42 | epilog="Developed by {} on {}".format(", ".join(__authors__), __date__) 43 | ) 44 | parser.add_argument('PICTURE_FILE', help="Path to picture") 45 | args = parser.parse_args() 46 | 47 | gmaps = "https://www.google.com/maps?q={},{}" 48 | open_maps = "http://www.openstreetmap.org/?mlat={}&mlon={}" 49 | 50 | 51 | def process_coords(coord): 52 | coord_deg = 0 53 | for count, values in enumerate(coord): 54 | coord_deg += (float(values[0]) / values[1]) / 60**count 55 | return coord_deg 56 | 57 | 58 | img_file = Image.open(args.PICTURE_FILE) 59 | exif_data = img_file._getexif() 60 | 61 | if exif_data is None: 62 | print("No EXIF data found") 63 | sys.exit() 64 | 65 | for name, value in exif_data.items(): 66 | gps_tag = TAGS.get(name, name) 67 | if gps_tag is not 'GPSInfo': 68 | continue 69 | 70 | lat_ref = value[1] == u'N' 71 | lat = process_coords(value[2]) 72 | if not lat_ref: 73 | lat = lat * -1 74 | 75 | lon_ref = value[3] == u'E' 76 | lon = process_coords(value[4]) 77 | if not lon_ref: 78 | lon = lon * -1 79 | 80 | kml = simplekml.Kml() 81 | kml.newpoint(name=args.PICTURE_FILE, coords=[(lon, lat)]) 82 | kml.save(args.PICTURE_FILE + ".kml") 83 | 84 | print("GPS Coordinates: {}, {}".format(lat, lon)) 85 | print("Google Maps URL: {}".format(gmaps.format(lat, lon))) 86 | print("OpenStreetMap URL: {}".format(open_maps.format(lat, lon))) 87 | print("KML File {} created".format(args.PICTURE_FILE + ".kml")) 88 | -------------------------------------------------------------------------------- /Chapter05/beautiful_preservation.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | import argparse 3 | from bs4 import BeautifulSoup, SoupStrainer 4 | from datetime import datetime 5 | import hashlib 6 | import logging 7 | import os 8 | import ssl 9 | import sys 10 | from urllib.request import urlopen 11 | import urllib.error 12 | 13 | """ 14 | MIT License 15 | 16 | Copyright (c) 2017 Chapin Bryce, Preston Miller 17 | 18 | Please share comments and questions at: 19 | https://github.com/PythonForensics/PythonForensicsCookbook 20 | or email pyforcookbook@gmail.com 21 | 22 | Permission is hereby granted, free of charge, to any person obtaining a copy 23 | of this software and associated documentation files (the "Software"), to deal 24 | in the Software without restriction, including without limitation the rights 25 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 26 | copies of the Software, and to permit persons to whom the Software is 27 | furnished to do so, subject to the following conditions: 28 | 29 | The above copyright notice and this permission notice shall be included in all 30 | copies or substantial portions of the Software. 31 | 32 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 33 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 34 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 35 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 36 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 37 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 38 | SOFTWARE. 39 | """ 40 | 41 | __authors__ = ["Chapin Bryce", "Preston Miller"] 42 | __date__ = 20170815 43 | __description__ = "BeautifulSoup Website Preservation Tool" 44 | 45 | logger = logging.getLogger(__name__) 46 | 47 | 48 | def main(website, output_dir): 49 | base_name = website.replace( 50 | "https://", "").replace("http://", "").replace("www.", "") 51 | link_queue = set() 52 | if "http://" not in website and "https://" not in website: 53 | logger.error( 54 | "Exiting preservation - invalid user input: {}".format( 55 | website)) 56 | sys.exit(1) 57 | logger.info("Accessing {} webpage".format(website)) 58 | context = ssl._create_unverified_context() 59 | 60 | try: 61 | index = urlopen(website, context=context).read().decode("utf-8") 62 | except urllib.error.HTTPError as e: 63 | logger.error( 64 | "Exiting preservation - unable to access page: {}".format( 65 | website)) 66 | sys.exit(2) 67 | logger.debug("Successfully accessed {}".format(website)) 68 | write_output(website, index, output_dir) 69 | link_queue = find_links(base_name, index, link_queue) 70 | logger.info("Found {} initial links on webpage".format( 71 | len(link_queue))) 72 | recurse_pages(website, link_queue, context, output_dir) 73 | logger.info("Completed preservation of {}".format(website)) 74 | 75 | 76 | def find_links(website, page, queue): 77 | for link in BeautifulSoup(page, "html.parser", 78 | parse_only=SoupStrainer("a", href=True)): 79 | if website in link.get("href"): 80 | if not os.path.basename(link.get("href")).startswith("#"): 81 | queue.add(link.get("href")) 82 | return queue 83 | 84 | 85 | def recurse_pages(website, queue, context, output_dir): 86 | processed = [] 87 | counter = 0 88 | while True: 89 | counter += 1 90 | if len(processed) == len(queue): 91 | break 92 | for link in queue.copy(): 93 | if link in processed: 94 | continue 95 | processed.append(link) 96 | try: 97 | page = urlopen(link, context=context).read().decode( 98 | "utf-8") 99 | except urllib.error.HTTPError as e: 100 | msg = "Error accessing webpage: {}".format(link) 101 | logger.error(msg) 102 | continue 103 | write_output(link, page, output_dir, counter) 104 | queue = find_links(website, page, queue) 105 | logger.info("Identified {} links throughout website".format( 106 | len(queue))) 107 | 108 | 109 | def hash_data(data): 110 | sha256 = hashlib.sha256() 111 | sha256.update(data.encode("utf-8")) 112 | return sha256.hexdigest() 113 | 114 | 115 | def hash_file(file): 116 | sha256 = hashlib.sha256() 117 | with open(file, "rb") as in_file: 118 | sha256.update(in_file.read()) 119 | return sha256.hexdigest() 120 | 121 | 122 | def write_output(name, data, output_dir, counter=0): 123 | name = name.replace("http://", "").replace("https://", "").rstrip("//") 124 | directory = os.path.join(output_dir, os.path.dirname(name)) 125 | if not os.path.exists(directory) and os.path.dirname(name) != "": 126 | os.makedirs(directory) 127 | 128 | logger.debug("Writing {} to {}".format(name, output_dir)) 129 | logger.debug("Data Hash: {}".format(hash_data(data))) 130 | path = os.path.join(output_dir, name) 131 | path = path + "_" + str(counter) 132 | with open(path, "w") as outfile: 133 | outfile.write(data) 134 | logger.debug("Output File Hash: {}".format(hash_file(path))) 135 | 136 | 137 | if __name__ == "__main__": 138 | parser = argparse.ArgumentParser( 139 | description=__description__, 140 | epilog="Developed by {} on {}".format( 141 | ", ".join(__authors__), __date__) 142 | ) 143 | parser.add_argument("DOMAIN", help="Website Domain") 144 | parser.add_argument("OUTPUT_DIR", help="Preservation Output Directory") 145 | parser.add_argument("-l", help="Log file path", 146 | default=__file__[:-3] + ".log") 147 | args = parser.parse_args() 148 | 149 | logger.setLevel(logging.DEBUG) 150 | msg_fmt = logging.Formatter("%(asctime)-15s %(funcName)-10s" 151 | "%(levelname)-8s %(message)s") 152 | strhndl = logging.StreamHandler(sys.stderr) 153 | strhndl.setFormatter(fmt=msg_fmt) 154 | fhndl = logging.FileHandler(args.l, mode='a') 155 | fhndl.setFormatter(fmt=msg_fmt) 156 | 157 | logger.addHandler(strhndl) 158 | logger.addHandler(fhndl) 159 | 160 | logger.info("Starting BS Preservation") 161 | logger.debug("Supplied arguments: {}".format(sys.argv[1:])) 162 | logger.debug("System " + sys.platform) 163 | logger.debug("Version " + sys.version) 164 | 165 | if not os.path.exists(args.OUTPUT_DIR): 166 | os.makedirs(args.OUTPUT_DIR) 167 | 168 | main(args.DOMAIN, args.OUTPUT_DIR) 169 | -------------------------------------------------------------------------------- /Chapter05/ief_parser.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | import argparse 3 | import csv 4 | import os 5 | import sqlite3 6 | import sys 7 | 8 | """ 9 | MIT License 10 | 11 | Copyright (c) 2017 Chapin Bryce, Preston Miller 12 | 13 | Please share comments and questions at: 14 | https://github.com/PythonForensics/PythonForensicsCookbook 15 | or email pyforcookbook@gmail.com 16 | 17 | Permission is hereby granted, free of charge, to any person obtaining a copy 18 | of this software and associated documentation files (the "Software"), to deal 19 | in the Software without restriction, including without limitation the rights 20 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 21 | copies of the Software, and to permit persons to whom the Software is 22 | furnished to do so, subject to the following conditions: 23 | 24 | The above copyright notice and this permission notice shall be included in all 25 | copies or substantial portions of the Software. 26 | 27 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 28 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 29 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 30 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 31 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 32 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 33 | SOFTWARE. 34 | """ 35 | 36 | __authors__ = ["Chapin Bryce", "Preston Miller"] 37 | __date__ = 20170815 38 | __description__ = "Utility to extract reports from IEF" 39 | 40 | 41 | def main(database, out_directory): 42 | print("[+] Connecting to SQLite database") 43 | conn = sqlite3.connect(database) 44 | c = conn.cursor() 45 | 46 | print("[+] Querying IEF database for list of all tables to extract") 47 | c.execute("select * from sqlite_master where type='table'") 48 | # Remove tables that start with "_" or end with "_DATA" 49 | tables = [x[2] for x in c.fetchall() if not x[2].startswith('_') and 50 | not x[2].endswith('_DATA')] 51 | 52 | print("[+] Dumping {} tables to CSV files in {}".format( 53 | len(tables), out_directory)) 54 | for table in tables: 55 | c.execute("pragma table_info('{}')".format(table)) 56 | table_columns = [x[1] for x in c.fetchall()] 57 | c.execute("select * from '{}'".format(table)) 58 | table_data = c.fetchall() 59 | 60 | csv_name = table + '.csv' 61 | csv_path = os.path.join(out_directory, csv_name) 62 | print('[+] Writing {} table to {} CSV file'.format(table, 63 | csv_name)) 64 | with open(csv_path, "w", newline="") as csvfile: 65 | csv_writer = csv.writer(csvfile) 66 | csv_writer.writerow(table_columns) 67 | csv_writer.writerows(table_data) 68 | 69 | 70 | if __name__ == '__main__': 71 | parser = argparse.ArgumentParser( 72 | description=__description__, 73 | epilog="Developed by {} on {}".format( 74 | ", ".join(__authors__), __date__) 75 | ) 76 | parser.add_argument("IEF_DATABASE", help="Input IEF database") 77 | parser.add_argument("OUTPUT_DIR", help="Output DIR") 78 | args = parser.parse_args() 79 | 80 | if not os.path.exists(args.OUTPUT_DIR): 81 | os.makedirs(args.OUTPUT_DIR) 82 | 83 | if os.path.exists(args.IEF_DATABASE) and \ 84 | os.path.isfile(args.IEF_DATABASE): 85 | main(args.IEF_DATABASE, args.OUTPUT_DIR) 86 | else: 87 | print("[-] Supplied input file {} does not exist or is not a " 88 | "file".format(args.IEF_DATABASE)) 89 | sys.exit(1) 90 | -------------------------------------------------------------------------------- /Chapter05/ief_yahoo_cache_parser.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | import argparse 3 | import csv 4 | import json 5 | import os 6 | import sqlite3 7 | import sys 8 | 9 | """ 10 | MIT License 11 | 12 | Copyright (c) 2017 Chapin Bryce, Preston Miller 13 | 14 | Please share comments and questions at: 15 | https://github.com/PythonForensics/PythonForensicsCookbook 16 | or email pyforcookbook@gmail.com 17 | 18 | Permission is hereby granted, free of charge, to any person obtaining a copy 19 | of this software and associated documentation files (the "Software"), to deal 20 | in the Software without restriction, including without limitation the rights 21 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 22 | copies of the Software, and to permit persons to whom the Software is 23 | furnished to do so, subject to the following conditions: 24 | 25 | The above copyright notice and this permission notice shall be included in all 26 | copies or substantial portions of the Software. 27 | 28 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 29 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 30 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 31 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 32 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 33 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 34 | SOFTWARE. 35 | """ 36 | 37 | __authors__ = ["Chapin Bryce", "Preston Miller"] 38 | __date__ = 20170815 39 | __description__ = "Utility to extract Yahoo! webmail contacts from IEF" 40 | 41 | 42 | def main(database, out_csv): 43 | print("[+] Connecting to SQLite database") 44 | conn = sqlite3.connect(database) 45 | c = conn.cursor() 46 | 47 | print("[+] Querying IEF database for Yahoo Contact Fragments from " 48 | "the Chrome Cache Records Table") 49 | try: 50 | c.execute( 51 | "select * from 'Chrome Cache Records' where URL like " 52 | "'https://data.mail.yahoo.com" 53 | "/classicab/v2/contacts/?format=json%'") 54 | except sqlite3.OperationalError: 55 | print("Received an error querying the database -- database may be" 56 | "corrupt or not have a Chrome Cache Records table") 57 | sys.exit(2) 58 | 59 | contact_cache = c.fetchall() 60 | contact_data = process_contacts(contact_cache) 61 | write_csv(contact_data, out_csv) 62 | 63 | 64 | def process_contacts(contact_cache): 65 | print("[+] Processing {} cache files matching Yahoo contact cache " 66 | " data".format(len(contact_cache))) 67 | results = [] 68 | for contact in contact_cache: 69 | url = contact[0] 70 | first_visit = contact[1] 71 | last_visit = contact[2] 72 | last_sync = contact[3] 73 | loc = contact[8] 74 | contact_json = json.loads(contact[7].decode()) 75 | total_contacts = contact_json["total"] 76 | total_count = contact_json["count"] 77 | 78 | if "contacts" not in contact_json: 79 | continue 80 | 81 | for c in contact_json["contacts"]: 82 | name, anni, bday, emails, phones, links = ( 83 | "", "", "", "", "", "") 84 | if "name" in c: 85 | name = c["name"]["givenName"] + " " + \ 86 | c["name"]["middleName"] + " " + c["name"]["familyName"] 87 | if "anniversary" in c: 88 | anni = c["anniversary"]["month"] + \ 89 | "/" + c["anniversary"]["day"] + "/" + \ 90 | c["anniversary"]["year"] 91 | if "birthday" in c: 92 | bday = c["birthday"]["month"] + "/" + \ 93 | c["birthday"]["day"] + "/" + c["birthday"]["year"] 94 | if "emails" in c: 95 | emails = ', '.join([x["ep"] for x in c["emails"]]) 96 | if "phones" in c: 97 | phones = ', '.join([x["ep"] for x in c["phones"]]) 98 | if "links" in c: 99 | links = ', '.join([x["ep"] for x in c["links"]]) 100 | 101 | company = c.get("company", "") 102 | title = c.get("jobTitle", "") 103 | notes = c.get("notes", "") 104 | 105 | results.append([ 106 | url, first_visit, last_visit, last_sync, loc, name, bday, 107 | anni, emails, phones, links, company, title, notes, 108 | total_contacts, total_count]) 109 | return results 110 | 111 | 112 | def write_csv(data, output): 113 | print("[+] Writing {} contacts to {}".format(len(data), output)) 114 | with open(output, "w", newline="") as csvfile: 115 | csv_writer = csv.writer(csvfile) 116 | csv_writer.writerow([ 117 | "URL", "First Visit (UTC)", "Last Visit (UTC)", 118 | "Last Sync (UTC)", "Location", "Contact Name", "Bday", 119 | "Anniversary", "Emails", "Phones", "Links", "Company", "Title", 120 | "Notes", "Total Contacts", "Count of Contacts in Cache"]) 121 | csv_writer.writerows(data) 122 | 123 | 124 | if __name__ == '__main__': 125 | parser = argparse.ArgumentParser( 126 | description=__description__, 127 | epilog="Developed by {} on {}".format( 128 | ", ".join(__authors__), __date__) 129 | ) 130 | parser.add_argument("IEF_DATABASE", help="Input IEF database") 131 | parser.add_argument("OUTPUT_CSV", help="Output CSV") 132 | args = parser.parse_args() 133 | 134 | directory = os.path.dirname(args.OUTPUT_CSV) 135 | if not os.path.exists(directory): 136 | os.makedirs(directory) 137 | 138 | if os.path.exists(args.IEF_DATABASE) and \ 139 | os.path.isfile(args.IEF_DATABASE): 140 | main(args.IEF_DATABASE, args.OUTPUT_CSV) 141 | else: 142 | print( 143 | "[-] Supplied input file {} does not exist or is not a " 144 | "file".format(args.IEF_DATABASE)) 145 | sys.exit(1) 146 | -------------------------------------------------------------------------------- /Chapter05/passive_lookup.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | import argparse 3 | import csv 4 | import json 5 | import os 6 | import subprocess 7 | import sys 8 | 9 | """ 10 | MIT License 11 | 12 | Copyright (c) 2017 Chapin Bryce, Preston Miller 13 | 14 | Please share comments and questions at: 15 | https://github.com/PythonForensics/PythonForensicsCookbook 16 | or email pyforcookbook@gmail.com 17 | 18 | Permission is hereby granted, free of charge, to any person obtaining a copy 19 | of this software and associated documentation files (the "Software"), to deal 20 | in the Software without restriction, including without limitation the rights 21 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 22 | copies of the Software, and to permit persons to whom the Software is 23 | furnished to do so, subject to the following conditions: 24 | 25 | The above copyright notice and this permission notice shall be included in all 26 | copies or substantial portions of the Software. 27 | 28 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 29 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 30 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 31 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 32 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 33 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 34 | SOFTWARE. 35 | """ 36 | 37 | __authors__ = ["Chapin Bryce", "Preston Miller"] 38 | __date__ = 20170815 39 | __description__ = "Utility to perform recon on IP addresses and domains" 40 | 41 | 42 | def main(domain_file, output): 43 | domains = set() 44 | with open(domain_file) as infile: 45 | for line in infile: 46 | domains.add(line.strip()) 47 | json_data = query_domains(domains) 48 | write_csv(json_data, output) 49 | 50 | 51 | def query_domains(domains): 52 | json_data = [] 53 | print("[+] Querying {} domains/IPs using PassiveTotal API".format( 54 | len(domains))) 55 | for domain in domains: 56 | if "https://" in domain: 57 | domain = domain.replace("https://", "") 58 | elif "http://" in domain: 59 | domain = domain.replace("http://", "") 60 | 61 | proc = subprocess.Popen( 62 | ["pt-client", "pdns", "-q", domain], stdout=subprocess.PIPE) 63 | results, err = proc.communicate() 64 | result_json = json.loads(results.decode()) 65 | if "message" in result_json: 66 | if "quota_exceeded" in result_json["message"]: 67 | print("[-] API Search Quota Exceeded") 68 | continue 69 | 70 | result_count = result_json["totalRecords"] 71 | 72 | print("[+] {} results for {}".format(result_count, domain)) 73 | if result_count == 0: 74 | pass 75 | else: 76 | json_data.append(result_json["results"]) 77 | 78 | return json_data 79 | 80 | 81 | def write_csv(data, output): 82 | if data == []: 83 | print("[-] No output results to write") 84 | sys.exit(2) 85 | 86 | print("[+] Writing output for {} domains/IPs with " 87 | "results to {}".format(len(data), output)) 88 | field_list = ["value", "firstSeen", "lastSeen", "collected", 89 | "resolve", "resolveType", "source", "recordType", 90 | "recordHash"] 91 | 92 | with open(output, "w", newline="") as csvfile: 93 | csv_writer = csv.DictWriter(csvfile, fieldnames=field_list) 94 | csv_writer.writeheader() 95 | for result in data: 96 | for dictionary in result: 97 | csv_writer.writerow(dictionary) 98 | 99 | 100 | if __name__ == '__main__': 101 | parser = argparse.ArgumentParser( 102 | description=__description__, 103 | epilog="Developed by {} on {}".format( 104 | ", ".join(__authors__), __date__) 105 | ) 106 | parser.add_argument("INPUT_DOMAINS", 107 | help="Text File containing Domains and/or IPs") 108 | parser.add_argument("OUTPUT_CSV", 109 | help="Output CSV with lookup results") 110 | args = parser.parse_args() 111 | 112 | directory = os.path.dirname(args.OUTPUT_CSV) 113 | if not os.path.exists(directory): 114 | os.makedirs(directory) 115 | 116 | if os.path.exists(args.INPUT_DOMAINS) and \ 117 | os.path.isfile(args.INPUT_DOMAINS): 118 | main(args.INPUT_DOMAINS, args.OUTPUT_CSV) 119 | else: 120 | print( 121 | "[-] Supplied input file {} does not exist or is not a " 122 | "file".format(args.INPUT_DOMAINS)) 123 | sys.exit(1) 124 | -------------------------------------------------------------------------------- /Chapter05/virus_hashset.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | import argparse 3 | import os 4 | import ssl 5 | import sys 6 | import tqdm 7 | from urllib.request import urlopen 8 | import urllib.error 9 | 10 | """ 11 | MIT License 12 | 13 | Copyright (c) 2017 Chapin Bryce, Preston Miller 14 | 15 | Please share comments and questions at: 16 | https://github.com/PythonForensics/PythonForensicsCookbook 17 | or email pyforcookbook@gmail.com 18 | 19 | Permission is hereby granted, free of charge, to any person obtaining a copy 20 | of this software and associated documentation files (the "Software"), to deal 21 | in the Software without restriction, including without limitation the rights 22 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 23 | copies of the Software, and to permit persons to whom the Software is 24 | furnished to do so, subject to the following conditions: 25 | 26 | The above copyright notice and this permission notice shall be included in all 27 | copies or substantial portions of the Software. 28 | 29 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 30 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 31 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 32 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 33 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 34 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 35 | SOFTWARE. 36 | """ 37 | 38 | __authors__ = ["Chapin Bryce", "Preston Miller"] 39 | __date__ = 20170815 40 | __description__ = "Utility to download and generate hashlists for malware" 41 | 42 | 43 | def main(hashset, **kwargs): 44 | url = "https://virusshare.com/hashes.4n6" 45 | print("[+] Identifying hash set range from {}".format(url)) 46 | context = ssl._create_unverified_context() 47 | 48 | try: 49 | index = urlopen(url, context=context).read().decode("utf-8") 50 | except urllib.error.HTTPError as e: 51 | print("[-] Error accessing webpage - exiting..") 52 | sys.exit(1) 53 | tag = index.rfind(r' stop: 62 | print("[-] Supplied start argument must be greater than or equal " 63 | "to zero but less than the latest hash list, " 64 | "currently: {}".format(stop)) 65 | sys.exit(2) 66 | 67 | print("[+] Creating a hashset from hash lists {} to {}".format( 68 | start, stop)) 69 | hashes_downloaded = 0 70 | for x in tqdm.trange(start, stop + 1, unit_scale=True, 71 | desc="Progress"): 72 | url_hash = "https://virusshare.com/hashes/VirusShare_"\ 73 | "{}.md5".format(str(x).zfill(5)) 74 | try: 75 | hashes = urlopen( 76 | url_hash, context=context).read().decode("utf-8") 77 | hashes_list = hashes.split("\n") 78 | except urllib.error.HTTPError as e: 79 | print("[-] Error accessing webpage for hash list {}" 80 | " - continuing..".format(x)) 81 | continue 82 | 83 | with open(hashset, "a+") as hashfile: 84 | for line in hashes_list: 85 | if not line.startswith("#") and line != "": 86 | hashes_downloaded += 1 87 | hashfile.write(line + '\n') 88 | 89 | print("[+] Finished downloading {} hashes into {}".format( 90 | hashes_downloaded, hashset)) 91 | 92 | 93 | if __name__ == '__main__': 94 | parser = argparse.ArgumentParser( 95 | description=__description__, 96 | epilog="Developed by {} on {}".format( 97 | ", ".join(__authors__), __date__) 98 | ) 99 | parser.add_argument("OUTPUT_HASH", help="Output Hashset") 100 | parser.add_argument("--start", type=int, 101 | help="Optional starting location") 102 | args = parser.parse_args() 103 | 104 | directory = os.path.dirname(args.OUTPUT_HASH) 105 | if not os.path.exists(directory): 106 | os.makedirs(directory) 107 | 108 | if args.start: 109 | main(args.OUTPUT_HASH, start=args.start) 110 | else: 111 | main(args.OUTPUT_HASH) 112 | -------------------------------------------------------------------------------- /Chapter06/eml_parser.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | from argparse import ArgumentParser, FileType 3 | from email import message_from_file 4 | import os 5 | import quopri 6 | import base64 7 | 8 | """ 9 | MIT License 10 | 11 | Copyright (c) 2017 Chapin Bryce, Preston Miller 12 | 13 | Please share comments and questions at: 14 | https://github.com/PythonForensics/PythonForensicsCookbook 15 | or email pyforcookbook@gmail.com 16 | 17 | Permission is hereby granted, free of charge, to any person obtaining a copy 18 | of this software and associated documentation files (the "Software"), to deal 19 | in the Software without restriction, including without limitation the rights 20 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 21 | copies of the Software, and to permit persons to whom the Software is 22 | furnished to do so, subject to the following conditions: 23 | 24 | The above copyright notice and this permission notice shall be included in all 25 | copies or substantial portions of the Software. 26 | 27 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 28 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 29 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 30 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 31 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 32 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 33 | SOFTWARE. 34 | """ 35 | 36 | __authors__ = ["Chapin Bryce", "Preston Miller"] 37 | __date__ = 20170815 38 | __description__ = "Utility to parse text and attachments from EML files" 39 | 40 | 41 | def process_payload(payload): 42 | print(payload.get_content_type() + "\n" + "=" * len( 43 | payload.get_content_type())) 44 | body = quopri.decodestring(payload.get_payload()) 45 | if payload.get_charset(): 46 | body = body.decode(payload.get_charset()) 47 | else: 48 | try: 49 | body = body.decode() 50 | except UnicodeDecodeError: 51 | body = body.decode('cp1252') 52 | 53 | if payload.get_content_type() == "text/html": 54 | outfile = os.path.basename(args.EML_FILE.name) + ".html" 55 | open(outfile, 'w').write(body) 56 | elif payload.get_content_type().startswith('application'): 57 | outfile = open(payload.get_filename(), 'wb') 58 | body = base64.b64decode(payload.get_payload()) 59 | outfile.write(body) 60 | outfile.close() 61 | print("Exported: {}\n".format(outfile.name)) 62 | else: 63 | print(body) 64 | 65 | 66 | def main(input_file): 67 | emlfile = message_from_file(input_file) 68 | 69 | # Start with the headers 70 | for key, value in emlfile._headers: 71 | print("{}: {}".format(key, value)) 72 | 73 | # Read payload 74 | print("\nBody\n") 75 | if emlfile.is_multipart(): 76 | for part in emlfile.get_payload(): 77 | process_payload(part) 78 | else: 79 | process_payload(emlfile[1]) 80 | 81 | 82 | if __name__ == '__main__': 83 | parser = ArgumentParser( 84 | description=__description__, 85 | epilog="Developed by {} on {}".format( 86 | ", ".join(__authors__), __date__) 87 | ) 88 | parser.add_argument("EML_FILE", 89 | help="Path to EML File", type=FileType('r')) 90 | args = parser.parse_args() 91 | 92 | main(args.EML_FILE) 93 | -------------------------------------------------------------------------------- /Chapter06/msg_parser.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | from argparse import ArgumentParser 3 | import os 4 | import win32com.client 5 | import pywintypes 6 | 7 | """ 8 | MIT License 9 | 10 | Copyright (c) 2017 Chapin Bryce, Preston Miller 11 | 12 | Please share comments and questions at: 13 | https://github.com/PythonForensics/PythonForensicsCookbook 14 | or email pyforcookbook@gmail.com 15 | 16 | Permission is hereby granted, free of charge, to any person obtaining a copy 17 | of this software and associated documentation files (the "Software"), to deal 18 | in the Software without restriction, including without limitation the rights 19 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 20 | copies of the Software, and to permit persons to whom the Software is 21 | furnished to do so, subject to the following conditions: 22 | 23 | The above copyright notice and this permission notice shall be included in all 24 | copies or substantial portions of the Software. 25 | 26 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 27 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 28 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 29 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 30 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 31 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 32 | SOFTWARE. 33 | """ 34 | 35 | __authors__ = ["Chapin Bryce", "Preston Miller"] 36 | __date__ = 20170815 37 | __description__ = "Utility to read content from MSG files" 38 | 39 | 40 | def extract_msg_body(msg, out_dir): 41 | # Extract HTML Data 42 | html_data = msg.HTMLBody.encode('cp1252') 43 | outfile = os.path.join(out_dir, os.path.basename(args.MSG_FILE)) 44 | open(outfile + ".body.html", 'wb').write(html_data) 45 | print("Exported: {}".format(outfile + ".body.html")) 46 | 47 | # Extract plain text 48 | body_data = msg.Body.encode('cp1252') 49 | open(outfile + ".body.txt", 'wb').write(body_data) 50 | print("Exported: {}".format(outfile + ".body.txt")) 51 | 52 | 53 | def extract_attachments(msg, out_dir): 54 | attachment_attribs = [ 55 | 'DisplayName', 'FileName', 'PathName', 'Position', 'Size' 56 | ] 57 | i = 1 # Attachments start at 1 58 | while True: 59 | try: 60 | attachment = msg.Attachments(i) 61 | except pywintypes.com_error: 62 | break 63 | 64 | print("\nAttachment {}".format(i)) 65 | print("=" * 15) 66 | for entry in attachment_attribs: 67 | print('{}: {}'.format(entry, getattr(attachment, entry, 68 | "N/A"))) 69 | outfile = os.path.join(os.path.abspath(out_dir), 70 | os.path.split(args.MSG_FILE)[-1]) 71 | if not os.path.exists(outfile): 72 | os.makedirs(outfile) 73 | outfile = os.path.join(outfile, attachment.FileName) 74 | attachment.SaveAsFile(outfile) 75 | print("Exported: {}".format(outfile)) 76 | i += 1 77 | 78 | 79 | def display_msg_attribs(msg): 80 | # Display Message Attributes 81 | attribs = [ 82 | 'Application', 'AutoForwarded', 'BCC', 'CC', 'Class', 83 | 'ConversationID', 'ConversationTopic', 'CreationTime', 84 | 'ExpiryTime', 'Importance', 'InternetCodePage', 'IsMarkedAsTask', 85 | 'LastModificationTime', 'Links', 'OriginalDeliveryReportRequested', 86 | 'ReadReceiptRequested', 'ReceivedTime', 'ReminderSet', 87 | 'ReminderTime', 'ReplyRecipientNames', 'Saved', 'Sender', 88 | 'SenderEmailAddress', 'SenderEmailType', 'SenderName', 'Sent', 89 | 'SentOn', 'SentOnBehalfOfName', 'Size', 'Subject', 90 | 'TaskCompletedDate', 'TaskDueDate', 'To', 'UnRead' 91 | ] 92 | print("\nMessage Attributes") 93 | print("==================") 94 | for entry in attribs: 95 | print("{}: {}".format(entry, getattr(msg, entry, 'N/A'))) 96 | 97 | 98 | def display_msg_recipients(msg): 99 | # Display Recipient Information 100 | recipient_attrib = [ 101 | 'Address', 'AutoResponse', 'Name', 'Resolved', 'Sendable' 102 | ] 103 | i = 1 104 | while True: 105 | try: 106 | recipient = msg.Recipients(i) 107 | except pywintypes.com_error: 108 | break 109 | 110 | print("\nRecipient {}".format(i)) 111 | print("=" * 15) 112 | for entry in recipient_attrib: 113 | print("{}: {}".format(entry, getattr(recipient, entry, 'N/A'))) 114 | i += 1 115 | 116 | 117 | def main(msg_file, output_dir): 118 | mapi = win32com.client.Dispatch( 119 | "Outlook.Application").GetNamespace("MAPI") 120 | msg = mapi.OpenSharedItem(os.path.abspath(args.MSG_FILE)) 121 | display_msg_attribs(msg) 122 | display_msg_recipients(msg) 123 | extract_msg_body(msg, output_dir) 124 | extract_attachments(msg, output_dir) 125 | 126 | 127 | if __name__ == '__main__': 128 | parser = ArgumentParser( 129 | description=__description__, 130 | epilog="Developed by {} on {}".format( 131 | ", ".join(__authors__), __date__) 132 | ) 133 | parser.add_argument("MSG_FILE", help="Path to MSG file") 134 | parser.add_argument("OUTPUT_DIR", help="Path to output folder") 135 | args = parser.parse_args() 136 | out_dir = args.OUTPUT_DIR 137 | if not os.path.exists(out_dir): 138 | os.makedirs(out_dir) 139 | main(args.MSG_FILE, args.OUTPUT_DIR) 140 | -------------------------------------------------------------------------------- /Chapter06/pff_parser.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | from argparse import ArgumentParser 3 | import csv 4 | import pypff 5 | import re 6 | 7 | """ 8 | MIT License 9 | 10 | Copyright (c) 2017 Chapin Bryce, Preston Miller 11 | 12 | Please share comments and questions at: 13 | https://github.com/PythonForensics/PythonForensicsCookbook 14 | or email pyforcookbook@gmail.com 15 | 16 | Permission is hereby granted, free of charge, to any person obtaining a copy 17 | of this software and associated documentation files (the "Software"), to deal 18 | in the Software without restriction, including without limitation the rights 19 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 20 | copies of the Software, and to permit persons to whom the Software is 21 | furnished to do so, subject to the following conditions: 22 | 23 | The above copyright notice and this permission notice shall be included in all 24 | copies or substantial portions of the Software. 25 | 26 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 27 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 28 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 29 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 30 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 31 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 32 | SOFTWARE. 33 | """ 34 | 35 | __authors__ = ["Chapin Bryce", "Preston Miller"] 36 | __date__ = 20170815 37 | __description__ = "Utility to read content and metadata from PSTs and OSTs" 38 | 39 | 40 | def process_folders(pff_folder): 41 | folder_name = pff_folder.name if pff_folder.name else "N/A" 42 | print("Folder: {} (sub-dir: {}/sub-msg: {})".format(folder_name, 43 | pff_folder.number_of_sub_folders, 44 | pff_folder.number_of_sub_messages)) 45 | 46 | # Process messages within a folder 47 | data_list = [] 48 | for msg in pff_folder.sub_messages: 49 | data_dict = process_message(msg) 50 | data_dict['folder'] = folder_name 51 | data_list.append(data_dict) 52 | 53 | # Process folders within a folder 54 | for folder in pff_folder.sub_folders: 55 | data_list += process_folders(folder) 56 | 57 | return data_list 58 | 59 | 60 | def process_message(msg): 61 | # Extract attributes 62 | attribs = ['conversation_topic', 'number_of_attachments', 63 | 'sender_name', 'subject'] 64 | data_dict = {} 65 | for attrib in attribs: 66 | data_dict[attrib] = getattr(msg, attrib, "N/A") 67 | 68 | if msg.transport_headers is not None: 69 | data_dict.update(process_headers(msg.transport_headers)) 70 | 71 | return data_dict 72 | 73 | 74 | def process_headers(header): 75 | # Read and process header information 76 | key_pattern = re.compile("^([A-Za-z\-]+:)(.*)$") 77 | header_data = {} 78 | for line in header.split("\r\n"): 79 | if len(line) == 0: 80 | continue 81 | 82 | reg_result = key_pattern.match(line) 83 | if reg_result: 84 | key = reg_result.group(1).strip(":").strip() 85 | value = reg_result.group(2).strip() 86 | else: 87 | value = line 88 | 89 | if key.lower() in header_data: 90 | if isinstance(header_data[key.lower()], list): 91 | header_data[key.lower()].append(value) 92 | else: 93 | header_data[key.lower()] = [header_data[key.lower()], 94 | value] 95 | else: 96 | header_data[key.lower()] = value 97 | return header_data 98 | 99 | 100 | def write_data(outfile, data_list): 101 | # Build out additional columns 102 | print("Writing Report: ", outfile) 103 | columns = ['folder', 'conversation_topic', 'number_of_attachments', 104 | 'sender_name', 'subject'] 105 | formatted_data_list = [] 106 | for entry in data_list: 107 | tmp_entry = {} 108 | 109 | for k, v in entry.items(): 110 | if k not in columns: 111 | columns.append(k) 112 | 113 | if isinstance(v, list): 114 | tmp_entry[k] = ", ".join(v) 115 | else: 116 | tmp_entry[k] = v 117 | formatted_data_list.append(tmp_entry) 118 | 119 | # Write CSV report 120 | with open(outfile, 'wb') as openfile: 121 | csvfile = csv.DictWriter(openfile, columns) 122 | csvfile.writeheader() 123 | csvfile.writerows(formatted_data_list) 124 | 125 | 126 | if __name__ == '__main__': 127 | parser = ArgumentParser( 128 | description=__description__, 129 | epilog="Developed by {} on {}".format( 130 | ", ".join(__authors__), __date__) 131 | ) 132 | parser.add_argument("PFF_FILE", help="Path to PST or OST File") 133 | parser.add_argument("CSV_REPORT", help="Path to CSV report location") 134 | args = parser.parse_args() 135 | 136 | # Open file 137 | pff_obj = pypff.file() 138 | pff_obj.open(args.PFF_FILE) 139 | 140 | # Parse and close file 141 | parsed_data = process_folders(pff_obj.root_folder) 142 | pff_obj.close() 143 | 144 | # Write CSV report 145 | write_data(args.CSV_REPORT, parsed_data) 146 | -------------------------------------------------------------------------------- /Chapter07/daily_parser.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | from argparse import ArgumentParser, FileType 3 | from datetime import datetime 4 | import csv 5 | 6 | """ 7 | MIT License 8 | 9 | Copyright (c) 2017 Chapin Bryce, Preston Miller 10 | 11 | Please share comments and questions at: 12 | https://github.com/PythonForensics/PythonForensicsCookbook 13 | or email pyforcookbook@gmail.com 14 | 15 | Permission is hereby granted, free of charge, to any person obtaining a copy 16 | of this software and associated documentation files (the "Software"), to deal 17 | in the Software without restriction, including without limitation the rights 18 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 19 | copies of the Software, and to permit persons to whom the Software is 20 | furnished to do so, subject to the following conditions: 21 | 22 | The above copyright notice and this permission notice shall be included in all 23 | copies or substantial portions of the Software. 24 | 25 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 26 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 27 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 28 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 29 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 30 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 31 | SOFTWARE. 32 | """ 33 | 34 | __authors__ = ["Chapin Bryce", "Preston Miller"] 35 | __date__ = 20170815 36 | __description__ = "Utility to interpret the daily.out log" 37 | 38 | 39 | class ProcessDailyOut(object): 40 | def __init__(self, daily_out): 41 | self.daily_out = daily_out 42 | self.disk_status_columns = [ 43 | 'Filesystem', 'Size', 'Used', 'Avail', 'Capacity', 'iused', 44 | 'ifree', '%iused', 'Mounted on'] 45 | self.report_columns = ['event_date', 'event_tz'] + \ 46 | self.disk_status_columns 47 | 48 | def process_disk(self, disk_lines, event_dates): 49 | if len(disk_lines) == 0: 50 | return {} 51 | 52 | processed_data = [] 53 | for line_count, line in enumerate(disk_lines): 54 | if line_count == 0: 55 | continue 56 | prepped_lines = [x for x in line.split(" ") 57 | if len(x.strip()) != 0] 58 | disk_info = { 59 | "event_date": event_dates[0], 60 | "event_tz": event_dates[1] 61 | } 62 | for col_count, entry in enumerate(prepped_lines): 63 | curr_col = self.disk_status_columns[col_count] 64 | if "/Volumes/" in entry: 65 | disk_info[curr_col] = " ".join( 66 | prepped_lines[col_count:]) 67 | break 68 | disk_info[curr_col] = entry.strip() 69 | processed_data.append(disk_info) 70 | return processed_data 71 | 72 | def process_event(self, event_lines): 73 | section_header = "" 74 | section_data = [] 75 | event_data = {} 76 | for line in event_lines: 77 | if line.endswith(":"): 78 | if len(section_data) > 0: 79 | event_data[section_header] = section_data 80 | section_data = [] 81 | section_header = "" 82 | 83 | section_header = line.strip(":") 84 | 85 | elif line.count(":") == 2: 86 | try: 87 | split_line = line.split() 88 | timezone = split_line[4] 89 | date_str = " ".join(split_line[:4] + [split_line[-1]]) 90 | try: 91 | date_val = datetime.strptime( 92 | date_str, "%a %b %d %H:%M:%S %Y") 93 | except ValueError: 94 | date_val = datetime.strptime( 95 | date_str, "%a %b %d %H:%M:%S %Y") 96 | event_data["event_date"] = [date_val, timezone] 97 | section_data = [] 98 | section_header = "" 99 | except ValueError: 100 | section_data.append(line) 101 | except IndexError: 102 | section_data.append(line) 103 | 104 | else: 105 | if len(line): 106 | section_data.append(line) 107 | return self.process_disk(event_data.get("Disk status", []), 108 | event_data.get("event_date", [])) 109 | 110 | def run(self): 111 | event_lines = [] 112 | parsed_events = [] 113 | for raw_line in self.daily_out: 114 | line = raw_line.strip() 115 | if line == '-- End of daily output --': 116 | parsed_events += self.process_event(event_lines) 117 | event_lines = [] 118 | else: 119 | event_lines.append(line) 120 | return parsed_events 121 | 122 | 123 | def write_csv(outfile, fieldnames, data): 124 | with open(outfile, 'w', newline="") as open_outfile: 125 | csvfile = csv.DictWriter(open_outfile, fieldnames) 126 | csvfile.writeheader() 127 | csvfile.writerows(data) 128 | 129 | 130 | if __name__ == '__main__': 131 | parser = ArgumentParser( 132 | description=__description__, 133 | epilog="Developed by {} on {}".format( 134 | ", ".join(__authors__), __date__) 135 | ) 136 | parser.add_argument("daily_out", help="Path to daily.out file", 137 | type=FileType('r')) 138 | parser.add_argument("output_report", help="Path to csv report") 139 | args = parser.parse_args() 140 | 141 | processor = ProcessDailyOut(args.daily_out) 142 | parsed_events = processor.run() 143 | write_csv(args.output_report, processor.report_columns, parsed_events) 144 | -------------------------------------------------------------------------------- /Chapter07/date_parser.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | from argparse import ArgumentParser, ArgumentDefaultsHelpFormatter 3 | from datetime import datetime as dt 4 | from datetime import timedelta 5 | 6 | """ 7 | MIT License 8 | 9 | Copyright (c) 2017 Chapin Bryce, Preston Miller 10 | 11 | Please share comments and questions at: 12 | https://github.com/PythonForensics/PythonForensicsCookbook 13 | or email pyforcookbook@gmail.com 14 | 15 | Permission is hereby granted, free of charge, to any person obtaining a copy 16 | of this software and associated documentation files (the "Software"), to deal 17 | in the Software without restriction, including without limitation the rights 18 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 19 | copies of the Software, and to permit persons to whom the Software is 20 | furnished to do so, subject to the following conditions: 21 | 22 | The above copyright notice and this permission notice shall be included in all 23 | copies or substantial portions of the Software. 24 | 25 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 26 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 27 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 28 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 29 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 30 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 31 | SOFTWARE. 32 | """ 33 | 34 | __authors__ = ["Chapin Bryce", "Preston Miller"] 35 | __date__ = 20170815 36 | __description__ = "Utility to interpret date values" 37 | 38 | 39 | class ParseDate(object): 40 | def __init__(self, date_value, source, data_type): 41 | self.date_value = date_value 42 | self.source = source 43 | self.data_type = data_type 44 | self.timestamp = None 45 | 46 | def run(self): 47 | if self.source == 'unix-epoch': 48 | self.parse_unix_epoch() 49 | elif self.source == 'unix-epoch-ms': 50 | self.parse_unix_epoch(True) 51 | elif self.source == 'windows-filetime': 52 | self.parse_windows_filetime() 53 | 54 | @classmethod 55 | def get_supported_formats(cls): 56 | return ['unix-epoch', 'unix-epoch-ms', 'windows-filetime'] 57 | 58 | def parse_unix_epoch(self, milliseconds=False): 59 | if self.data_type == 'hex': 60 | conv_value = int(self.date_value) 61 | if milliseconds: 62 | conv_value = conv_value / 1000.0 63 | elif self.data_type == 'number': 64 | conv_value = float(self.date_value) 65 | if milliseconds: 66 | conv_value = conv_value / 1000.0 67 | else: 68 | print("Unsupported data type '{}' provided".format( 69 | self.data_type)) 70 | sys.exit('1') 71 | 72 | ts = dt.fromtimestamp(conv_value) 73 | self.timestamp = ts.strftime('%Y-%m-%d %H:%M:%S.%f') 74 | 75 | def parse_windows_filetime(self): 76 | if self.data_type == 'hex': 77 | microseconds = int(self.date_value, 16) / 10.0 78 | elif self.data_type == 'number': 79 | microseconds = float(self.date_value) / 10 80 | else: 81 | print("Unsupported data type '{}' provided".format( 82 | self.data_type)) 83 | sys.exit('1') 84 | 85 | ts = dt(1601, 1, 1) + timedelta(microseconds=microseconds) 86 | self.timestamp = ts.strftime('%Y-%m-%d %H:%M:%S.%f') 87 | 88 | 89 | if __name__ == '__main__': 90 | parser = ArgumentParser( 91 | description=__description__, 92 | formatter_class=ArgumentDefaultsHelpFormatter, 93 | epilog="Developed by {} on {}".format( 94 | ", ".join(__authors__), __date__) 95 | ) 96 | parser.add_argument("date_value", help="Raw date value to parse") 97 | parser.add_argument("source", help="Source format of date", 98 | choices=ParseDate.get_supported_formats()) 99 | parser.add_argument("type", help="Data type of input value", 100 | choices=('number', 'hex'), default='int') 101 | args = parser.parse_args() 102 | 103 | date_parser = ParseDate(args.date_value, args.source, args.type) 104 | date_parser.run() 105 | print(date_parser.timestamp) 106 | -------------------------------------------------------------------------------- /Chapter07/iis_parser.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | from argparse import ArgumentParser, FileType 3 | import re 4 | import shlex 5 | import logging 6 | import sys 7 | import csv 8 | 9 | """ 10 | MIT License 11 | 12 | Copyright (c) 2017 Chapin Bryce, Preston Miller 13 | 14 | Please share comments and questions at: 15 | https://github.com/PythonForensics/PythonForensicsCookbook 16 | or email pyforcookbook@gmail.com 17 | 18 | Permission is hereby granted, free of charge, to any person obtaining a copy 19 | of this software and associated documentation files (the "Software"), to deal 20 | in the Software without restriction, including without limitation the rights 21 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 22 | copies of the Software, and to permit persons to whom the Software is 23 | furnished to do so, subject to the following conditions: 24 | 25 | The above copyright notice and this permission notice shall be included in all 26 | copies or substantial portions of the Software. 27 | 28 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 29 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 30 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 31 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 32 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 33 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 34 | SOFTWARE. 35 | """ 36 | 37 | __authors__ = ["Chapin Bryce", "Preston Miller"] 38 | __date__ = 20170815 39 | __description__ = "Utility to parse IIS logs" 40 | logger = logging.getLogger(__file__) 41 | 42 | iis_log_format = [ 43 | ("date", re.compile(r"\d{4}-\d{2}-\d{2}")), 44 | ("time", re.compile(r"\d\d:\d\d:\d\d")), 45 | ("s-ip", re.compile( 46 | r"((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\.|$)){4}")), 47 | ("cs-method", re.compile( 48 | r"(GET)|(POST)|(PUT)|(DELETE)|(OPTIONS)|(HEAD)|(CONNECT)")), 49 | ("cs-uri-stem", re.compile(r"([A-Za-z0-1/\.-]*)")), 50 | ("cs-uri-query", re.compile(r"([A-Za-z0-1/\.-]*)")), 51 | ("s-port", re.compile(r"\d*")), 52 | ("cs-username", re.compile(r"([A-Za-z0-1/\.-]*)")), 53 | ("c-ip", re.compile( 54 | r"((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\.|$)){4}")), 55 | ("cs(User-Agent)", re.compile(r".*")), 56 | ("sc-status", re.compile(r"\d*")), 57 | ("sc-substatus", re.compile(r"\d*")), 58 | ("sc-win32-status", re.compile(r"\d*")), 59 | ("time-taken", re.compile(r"\d*")) 60 | ] 61 | 62 | 63 | def main(iis_log, report_file, logger): 64 | parsed_logs = [] 65 | for raw_line in iis_log: 66 | line = raw_line.strip() 67 | log_entry = {} 68 | if line.startswith("#") or len(line) == 0: 69 | continue 70 | if '\"' in line: 71 | line_iter = shlex.shlex(line_iter) 72 | else: 73 | line_iter = line.split(" ") 74 | for count, split_entry in enumerate(line_iter): 75 | col_name, col_pattern = iis_log_format[count] 76 | if col_pattern.match(split_entry): 77 | log_entry[col_name] = split_entry 78 | else: 79 | logger.error("Unknown column pattern discovered. " 80 | "Line preserved in full below") 81 | logger.error("Unparsed Line: {}".format(line)) 82 | 83 | parsed_logs.append(log_entry) 84 | 85 | logger.info("Parsed {} lines".format(len(parsed_logs))) 86 | 87 | cols = [x[0] for x in iis_log_format] 88 | logger.info("Creating report file: {}".format(report_file)) 89 | write_csv(report_file, cols, parsed_logs) 90 | logger.info("Report created") 91 | 92 | 93 | def write_csv(outfile, fieldnames, data): 94 | with open(outfile, 'w', newline="") as open_outfile: 95 | csvfile = csv.DictWriter(open_outfile, fieldnames) 96 | csvfile.writeheader() 97 | csvfile.writerows(data) 98 | 99 | 100 | if __name__ == '__main__': 101 | parser = ArgumentParser( 102 | description=__description__, 103 | epilog="Developed by {} on {}".format( 104 | ", ".join(__authors__), __date__) 105 | ) 106 | parser.add_argument('iis_log', help="Path to IIS Log", 107 | type=FileType('r')) 108 | parser.add_argument('csv_report', help="Path to CSV report") 109 | parser.add_argument('-l', help="Path to processing log", 110 | default=__name__ + '.log') 111 | args = parser.parse_args() 112 | 113 | logger.setLevel(logging.DEBUG) 114 | msg_fmt = logging.Formatter("%(asctime)-15s %(funcName)-10s " 115 | "%(levelname)-8s %(message)s") 116 | 117 | strhndl = logging.StreamHandler(sys.stdout) 118 | strhndl.setFormatter(fmt=msg_fmt) 119 | fhndl = logging.FileHandler(args.log, mode='a') 120 | fhndl.setFormatter(fmt=msg_fmt) 121 | 122 | logger.addHandler(strhndl) 123 | logger.addHandler(fhndl) 124 | 125 | logger.info("Starting IIS Parsing ") 126 | logger.debug("Supplied arguments: {}".format(", ".join(sys.argv[1:]))) 127 | logger.debug("System " + sys.platform) 128 | logger.debug("Version " + sys.version) 129 | main(args.iis_log, args.csv_report, logger) 130 | logger.info("IIS Parsing Complete") 131 | -------------------------------------------------------------------------------- /Chapter07/yara_scanner.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | from argparse import ArgumentParser, ArgumentDefaultsHelpFormatter 3 | import os 4 | import csv 5 | import yara 6 | 7 | """ 8 | MIT License 9 | 10 | Copyright (c) 2017 Chapin Bryce, Preston Miller 11 | 12 | Please share comments and questions at: 13 | https://github.com/PythonForensics/PythonForensicsCookbook 14 | or email pyforcookbook@gmail.com 15 | 16 | Permission is hereby granted, free of charge, to any person obtaining a copy 17 | of this software and associated documentation files (the "Software"), to deal 18 | in the Software without restriction, including without limitation the rights 19 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 20 | copies of the Software, and to permit persons to whom the Software is 21 | furnished to do so, subject to the following conditions: 22 | 23 | The above copyright notice and this permission notice shall be included in all 24 | copies or substantial portions of the Software. 25 | 26 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 27 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 28 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 29 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 30 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 31 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 32 | SOFTWARE. 33 | """ 34 | 35 | __authors__ = ["Chapin Bryce", "Preston Miller"] 36 | __date__ = 20170815 37 | __description__ = "Utility to scan for matching patterns within files" 38 | 39 | 40 | def process_directory(yrules, folder_path): 41 | match_info = [] 42 | for root, _, files in os.walk(folder_path): 43 | for entry in files: 44 | file_entry = os.path.join(root, entry) 45 | match_info += process_file(yrules, file_entry) 46 | return match_info 47 | 48 | 49 | def process_file(yrules, file_path): 50 | match = yrules.match(file_path) 51 | match_info = [] 52 | for rule_set in match: 53 | for hit in rule_set.strings: 54 | match_info.append({ 55 | 'file_name': file_path, 56 | 'rule_name': rule_set.rule, 57 | 'rule_tag': ",".join(rule_set.tags), 58 | 'hit_offset': hit[0], 59 | 'rule_string': hit[1], 60 | 'hit_value': hit[2] 61 | }) 62 | return match_info 63 | 64 | 65 | def write_csv(outfile, fieldnames, data): 66 | with open(outfile, 'w', newline="") as open_outfile: 67 | csvfile = csv.DictWriter(open_outfile, fieldnames) 68 | csvfile.writeheader() 69 | csvfile.writerows(data) 70 | 71 | 72 | def write_stdout(columns, match_info): 73 | for entry in match_info: 74 | for col in columns: 75 | print("{}: {}".format(col, entry[col])) 76 | print("=" * 30) 77 | 78 | 79 | def main(yara_rules, path_to_scan, output): 80 | if os.path.isdir(yara_rules): 81 | yrules = yara.compile(yara_rules) 82 | else: 83 | yrules = yara.compile(filepath=yara_rules) 84 | 85 | if os.path.isdir(path_to_scan): 86 | match_info = process_directory(yrules, path_to_scan) 87 | else: 88 | match_info = process_file(yrules, path_to_scan) 89 | 90 | columns = ['rule_name', 'hit_value', 'hit_offset', 'file_name', 91 | 'rule_string', 'rule_tag'] 92 | 93 | if output is None: 94 | write_stdout(columns, match_info) 95 | else: 96 | write_csv(output, columns, match_info) 97 | 98 | 99 | if __name__ == '__main__': 100 | parser = ArgumentParser( 101 | description=__description__, 102 | formatter_class=ArgumentDefaultsHelpFormatter, 103 | epilog="Developed by {} on {}".format( 104 | ", ".join(__authors__), __date__) 105 | ) 106 | parser.add_argument( 107 | 'yara_rules', 108 | help="Path to Yara rule to scan with. May be file or folder path.") 109 | parser.add_argument( 110 | 'path_to_scan', 111 | help="Path to file or folder to scan") 112 | parser.add_argument( 113 | '--output', 114 | help="Path to output a CSV report of scan results") 115 | args = parser.parse_args() 116 | 117 | main(args.yara_rules, args.path_to_scan, args.output) 118 | -------------------------------------------------------------------------------- /Chapter08/evidence_metadata.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | import argparse 3 | import os 4 | import pytsk3 5 | import pyewf 6 | import sys 7 | from tabulate import tabulate 8 | 9 | """ 10 | MIT License 11 | 12 | Copyright (c) 2017 Chapin Bryce, Preston Miller 13 | 14 | Please share comments and questions at: 15 | https://github.com/PythonForensics/PythonForensicsCookbook 16 | or email pyforcookbook@gmail.com 17 | 18 | Permission is hereby granted, free of charge, to any person obtaining a copy 19 | of this software and associated documentation files (the "Software"), to deal 20 | in the Software without restriction, including without limitation the rights 21 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 22 | copies of the Software, and to permit persons to whom the Software is 23 | furnished to do so, subject to the following conditions: 24 | 25 | The above copyright notice and this permission notice shall be included in all 26 | copies or substantial portions of the Software. 27 | 28 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 29 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 30 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 31 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 32 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 33 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 34 | SOFTWARE. 35 | """ 36 | 37 | __authors__ = ["Chapin Bryce", "Preston Miller"] 38 | __date__ = 20170815 39 | __description__ = "Utility to gather metadata from evidence containers" 40 | 41 | 42 | class EWFImgInfo(pytsk3.Img_Info): 43 | def __init__(self, ewf_handle): 44 | self._ewf_handle = ewf_handle 45 | super(EWFImgInfo, self).__init__(url="", 46 | type=pytsk3.TSK_IMG_TYPE_EXTERNAL) 47 | 48 | def close(self): 49 | self._ewf_handle.close() 50 | 51 | def read(self, offset, size): 52 | self._ewf_handle.seek(offset) 53 | return self._ewf_handle.read(size) 54 | 55 | def get_size(self): 56 | return self._ewf_handle.get_media_size() 57 | 58 | 59 | def main(image, img_type, part_type): 60 | print("[+] Opening {}".format(image)) 61 | if img_type == "ewf": 62 | try: 63 | filenames = pyewf.glob(image) 64 | except IOError: 65 | print("[-] Invalid EWF format:\n {}".format(e)) 66 | sys.exit(2) 67 | 68 | ewf_handle = pyewf.handle() 69 | ewf_handle.open(filenames) 70 | e01_metadata(ewf_handle) 71 | 72 | # Open PYTSK3 handle on EWF Image 73 | img_info = EWFImgInfo(ewf_handle) 74 | else: 75 | img_info = pytsk3.Img_Info(image) 76 | 77 | try: 78 | if part_type is not None: 79 | attr_id = getattr(pytsk3, "TSK_VS_TYPE_" + part_type) 80 | volume = pytsk3.Volume_Info(img_info, attr_id) 81 | else: 82 | volume = pytsk3.Volume_Info(img_info) 83 | except IOError: 84 | _, e, _ = sys.exc_info() 85 | print("[-] Unable to read partition table:\n {}".format(e)) 86 | sys.exit(3) 87 | part_metadata(volume) 88 | 89 | 90 | def part_metadata(vol): 91 | table = [["Index", "Type", "Offset Start (Sectors)", 92 | "Length (Sectors)"]] 93 | for part in vol: 94 | table.append([part.addr, part.desc.decode("utf-8"), part.start, 95 | part.len]) 96 | print("\n Partition Metadata") 97 | print("-" * 20) 98 | print(tabulate(table, headers="firstrow")) 99 | 100 | 101 | def e01_metadata(e01_image): 102 | print("\nEWF Acquisition Metadata") 103 | print("-" * 20) 104 | headers = e01_image.get_header_values() 105 | hashes = e01_image.get_hash_values() 106 | for k in headers: 107 | print("{}: {}".format(k, headers[k])) 108 | for h in hashes: 109 | print("Acquisition {}: {}".format(h, hashes[h])) 110 | print("Bytes per Sector: {}".format(e01_image.bytes_per_sector)) 111 | print("Number of Sectors: {}".format( 112 | e01_image.get_number_of_sectors())) 113 | print("Total Size: {}".format(e01_image.get_media_size())) 114 | 115 | 116 | if __name__ == '__main__': 117 | parser = argparse.ArgumentParser( 118 | description=__description__, 119 | epilog="Developed by {} on {}".format( 120 | ", ".join(__authors__), __date__) 121 | ) 122 | parser.add_argument("EVIDENCE_FILE", help="Evidence file path") 123 | parser.add_argument("TYPE", help="Type of Evidence", 124 | choices=("raw", "ewf")) 125 | parser.add_argument("-p", help="Partition Type", 126 | choices=("DOS", "GPT", "MAC", "SUN")) 127 | args = parser.parse_args() 128 | 129 | if os.path.exists(args.EVIDENCE_FILE) and \ 130 | os.path.isfile(args.EVIDENCE_FILE): 131 | main(args.EVIDENCE_FILE, args.TYPE, args.p) 132 | else: 133 | print("[-] Supplied input file {} does not exist or is not a " 134 | "file".format(args.EVIDENCE_FILE)) 135 | sys.exit(1) 136 | -------------------------------------------------------------------------------- /Chapter08/open_evidence.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | import argparse 3 | import os 4 | import pytsk3 5 | import pyewf 6 | import sys 7 | from tabulate import tabulate 8 | 9 | """ 10 | MIT License 11 | 12 | Copyright (c) 2017 Chapin Bryce, Preston Miller 13 | 14 | Please share comments and questions at: 15 | https://github.com/PythonForensics/PythonForensicsCookbook 16 | or email pyforcookbook@gmail.com 17 | 18 | Permission is hereby granted, free of charge, to any person obtaining a copy 19 | of this software and associated documentation files (the "Software"), to deal 20 | in the Software without restriction, including without limitation the rights 21 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 22 | copies of the Software, and to permit persons to whom the Software is 23 | furnished to do so, subject to the following conditions: 24 | 25 | The above copyright notice and this permission notice shall be included in all 26 | copies or substantial portions of the Software. 27 | 28 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 29 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 30 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 31 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 32 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 33 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 34 | SOFTWARE. 35 | """ 36 | 37 | __authors__ = ["Chapin Bryce", "Preston Miller"] 38 | __date__ = 20170815 39 | __description__ = "Utility to gather open evidence containers" 40 | 41 | 42 | class EWFImgInfo(pytsk3.Img_Info): 43 | def __init__(self, ewf_handle): 44 | self._ewf_handle = ewf_handle 45 | super(EWFImgInfo, self).__init__(url="", 46 | type=pytsk3.TSK_IMG_TYPE_EXTERNAL) 47 | 48 | def close(self): 49 | self._ewf_handle.close() 50 | 51 | def read(self, offset, size): 52 | self._ewf_handle.seek(offset) 53 | return self._ewf_handle.read(size) 54 | 55 | def get_size(self): 56 | return self._ewf_handle.get_media_size() 57 | 58 | 59 | def main(image, img_type, offset): 60 | print("[+] Opening {}".format(image)) 61 | if img_type == "ewf": 62 | try: 63 | filenames = pyewf.glob(image) 64 | except IOError: 65 | _, e, _ = sys.exc_info() 66 | print("[-] Invalid EWF format:\n {}".format(e)) 67 | sys.exit(2) 68 | ewf_handle = pyewf.handle() 69 | ewf_handle.open(filenames) 70 | # Open PYTSK3 handle on EWF Image 71 | img_info = EWFImgInfo(ewf_handle) 72 | else: 73 | img_info = pytsk3.Img_Info(image) 74 | 75 | # Get Filesystem Handle 76 | try: 77 | fs = pytsk3.FS_Info(img_info, offset) 78 | except IOError: 79 | _, e, _ = sys.exc_info() 80 | print("[-] Unable to open FS:\n {}".format(e)) 81 | exit() 82 | 83 | root_dir = fs.open_dir(path="/") 84 | table = [["Name", "Type", "Size", "Create Date", "Modify Date"]] 85 | for f in root_dir: 86 | name = f.info.name.name 87 | if f.info.meta.type == pytsk3.TSK_FS_META_TYPE_DIR: 88 | f_type = "DIR" 89 | else: 90 | f_type = "FILE" 91 | size = f.info.meta.size 92 | create = f.info.meta.crtime 93 | modify = f.info.meta.mtime 94 | table.append([name, f_type, size, create, modify]) 95 | print(tabulate(table, headers="firstrow")) 96 | 97 | 98 | if __name__ == '__main__': 99 | parser = argparse.ArgumentParser( 100 | description=__description__, 101 | epilog="Developed by {} on {}".format( 102 | ", ".join(__authors__), __date__) 103 | ) 104 | parser.add_argument("EVIDENCE_FILE", help="Evidence file path") 105 | parser.add_argument("TYPE", 106 | help="Type of evidence: raw (dd) or EWF (E01)", 107 | choices=("raw", "ewf")) 108 | parser.add_argument("-o", "--offset", 109 | help="Partition byte offset", type=int) 110 | args = parser.parse_args() 111 | 112 | if os.path.exists(args.EVIDENCE_FILE) and \ 113 | os.path.isfile(args.EVIDENCE_FILE): 114 | main(args.EVIDENCE_FILE, args.TYPE, args.offset) 115 | else: 116 | print("[-] Supplied input file {} does not exist or is not a " 117 | "file".format(args.EVIDENCE_FILE)) 118 | sys.exit(1) 119 | -------------------------------------------------------------------------------- /Chapter10/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/PythonForensics/Python-Digital-Forensics-Cookbook/18a7bec2d70321db820b07c10bf311428efe3950/Chapter10/.DS_Store -------------------------------------------------------------------------------- /Chapter10/utility/__init__.py: -------------------------------------------------------------------------------- 1 | import pytskutil 2 | -------------------------------------------------------------------------------- /Chapter10/utility/vss.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python 2 | # -*- coding: utf-8 -*- 3 | # Copyright 2012 The Plaso Project Authors. 4 | # Please see the AUTHORS file for details on individual authors. 5 | # 6 | # Licensed under the Apache License, Version 2.0 (the "License"); 7 | # you may not use this file except in compliance with the License. 8 | # You may obtain a copy of the License at 9 | # 10 | # http://www.apache.org/licenses/LICENSE-2.0 11 | # 12 | # Unless required by applicable law or agreed to in writing, software 13 | # distributed under the License is distributed on an "AS IS" BASIS, 14 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 15 | # See the License for the specific language governing permissions and 16 | # limitations under the License. 17 | #This file was copied from https://code.google.com/p/plaso/source/browse/plaso/pvfs/vss.py 18 | 19 | """This file contains a simple library to read files stored in VSS.""" 20 | import logging 21 | import os 22 | 23 | import pytsk3 24 | import pyvshadow 25 | 26 | 27 | class VShadowImgInfo(pytsk3.Img_Info): 28 | """Extending the TSK Img_Info to allow VSS images to be read in.""" 29 | 30 | def __init__(self, store): 31 | self._store = store 32 | super(VShadowImgInfo, self).__init__() 33 | 34 | # Implementing an interface 35 | def read(self, offset, size): 36 | self._store.seek(offset) 37 | return self._store.read(size) 38 | 39 | # Implementing an interface 40 | def get_size(self): 41 | return self._store.get_size() 42 | 43 | 44 | class VShadowVolume(object): 45 | """Disk file implementation faking volume file. 46 | pyvhsadow does not support disk images, only volume based ones. 47 | In order for us to be able to use disk images we need to provide 48 | an interface that exposes volumes inside of a disk image. 49 | """ 50 | 51 | def __init__(self, file_path, offset=0, sector_size=512): 52 | """Provide a file like object of a volume inside a disk image. 53 | Args: 54 | file_path: String, denoting the file path to the disk image. 55 | offset: An offset in bytes to the volume within the disk. 56 | sector_size: The size in bytes of a single sector, defaults to 512. 57 | """ 58 | self._block_size = 0 59 | self._offset_start = 0 60 | self._orig_offset = offset 61 | 62 | ofs = int(offset / sector_size) 63 | self._block_size, self._image_size = GetImageSize(file_path, ofs) 64 | 65 | self._fh = open(file_path, 'rb') 66 | self._fh.seek(0, os.SEEK_END) 67 | self._fh_size = self._fh.tell() 68 | self._image_offset = ofs 69 | 70 | if self._block_size: 71 | self._offset_start = self._image_offset * self._block_size 72 | self._fh.seek(self._offset_start, 0) 73 | 74 | def read(self, size=None): 75 | """"Return read bytes from volume as denoted by the size parameter.""" 76 | if not self._orig_offset: 77 | return self._fh.read(size) 78 | 79 | # Check upper bounds, we need to return empty values for above bounds. 80 | if size + self.tell() > self._offset_start + self._image_size: 81 | size = self._offset_start + self._image_size - self.tell() 82 | 83 | if size < 1: 84 | return '' 85 | 86 | return self._fh.read(size) 87 | 88 | def get_size(self): 89 | """Return the size in bytes of the volume.""" 90 | if self._block_size: 91 | return self._block_size * self._image_size 92 | 93 | return self._fh_size 94 | 95 | def close(self): 96 | self._fh.close() 97 | 98 | def seek(self, offset, whence=os.SEEK_SET): 99 | """Seek into the volume.""" 100 | if not self._block_size: 101 | self._fh.seek(offset, whence) 102 | return 103 | 104 | ofs = 0 105 | abs_ofs = 0 106 | if whence == os.SEEK_SET: 107 | ofs = offset + self._offset_start 108 | abs_ofs = ofs 109 | elif whence == os.SEEK_CUR: 110 | ofs = offset 111 | abs_ofs = self.tell() + ofs 112 | elif whence == os.SEEK_END: 113 | size_diff = self._fh_size - (self._offset_start + self._image_size) 114 | ofs = offset - size_diff 115 | abs_ofs = self._image_size + self._offset_start + offset 116 | else: 117 | raise RuntimeError('Illegal whence value %s' % whence) 118 | 119 | # check boundary 120 | if abs_ofs < self._offset_start: 121 | raise IOError('Invalid seek, out of bounds. Seek before start.') 122 | 123 | self._fh.seek(ofs, whence) 124 | 125 | def tell(self): 126 | if not self._block_size: 127 | return self._fh.tell() 128 | 129 | return self._fh.tell() - self._offset_start 130 | 131 | def get_offset(self): 132 | return self.tell() 133 | 134 | 135 | def GetVssStoreCount(image, offset=0): 136 | """Return the number of VSS stores available in an image.""" 137 | volume = pyvshadow.volume() 138 | fh = VShadowVolume(image, offset) 139 | try: 140 | volume.open_file_object(fh) 141 | return volume.number_of_stores 142 | except IOError as e: 143 | logging.warning('Error while trying to read VSS information: %s', e) 144 | 145 | return 0 146 | 147 | 148 | def GetImageSize(file_path, offset): 149 | """Read the partition information to gather volume size.""" 150 | if not offset: 151 | return 0, 0 152 | 153 | img = pytsk3.Img_Info(file_path) 154 | try: 155 | volume = pytsk3.Volume_Info(img) 156 | except IOError: 157 | return 0, 0 158 | 159 | size = 0 160 | for vol in volume: 161 | if vol.start == offset: 162 | size = vol.len 163 | break 164 | 165 | size *= volume.info.block_size 166 | return volume.info.block_size, size 167 | -------------------------------------------------------------------------------- /Chapter10/vss_explorer.py: -------------------------------------------------------------------------------- 1 | from __future__ import print_function 2 | import argparse 3 | from datetime import datetime, timedelta 4 | import os 5 | import pytsk3 6 | import pyewf 7 | import pyvshadow 8 | import sys 9 | import unicodecsv as csv 10 | from utility import vss 11 | from utility.pytskutil import TSKUtil 12 | from utility import pytskutil 13 | 14 | """ 15 | MIT License 16 | 17 | Copyright (c) 2017 Chapin Bryce, Preston Miller 18 | 19 | Please share comments and questions at: 20 | https://github.com/PythonForensics/PythonForensicsCookbook 21 | or email pyforcookbook@gmail.com 22 | 23 | Permission is hereby granted, free of charge, to any person obtaining a copy 24 | of this software and associated documentation files (the "Software"), to deal 25 | in the Software without restriction, including without limitation the rights 26 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 27 | copies of the Software, and to permit persons to whom the Software is 28 | furnished to do so, subject to the following conditions: 29 | 30 | The above copyright notice and this permission notice shall be included in all 31 | copies or substantial portions of the Software. 32 | 33 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 34 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 35 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 36 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 37 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 38 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 39 | SOFTWARE. 40 | """ 41 | 42 | __authors__ = ["Chapin Bryce", "Preston Miller"] 43 | __date__ = 20170815 44 | __description__ = "Utility to explore VSS on NTFS volumes" 45 | 46 | 47 | def main(evidence, output): 48 | # Create TSK object and query path for prefetch files 49 | tsk_util = TSKUtil(evidence, "raw") 50 | img_vol = tsk_util.return_vol() 51 | if img_vol is not None: 52 | for part in img_vol: 53 | if tsk_util.detect_ntfs(img_vol, part): 54 | print("Exploring NTFS Partition for VSS") 55 | explore_vss(evidence, part.start * img_vol.info.block_size, 56 | output) 57 | else: 58 | print("[-] Must be a physical preservation to be compatible " 59 | "with this script") 60 | sys.exit(2) 61 | 62 | 63 | def explore_vss(evidence, part_offset, output): 64 | vss_volume = pyvshadow.volume() 65 | vss_handle = vss.VShadowVolume(evidence, part_offset) 66 | vss_count = vss.GetVssStoreCount(evidence, part_offset) 67 | if vss_count > 0: 68 | vss_volume.open_file_object(vss_handle) 69 | vss_data = [] 70 | for x in range(vss_count): 71 | print("Gathering data for VSC {} of {}".format(x, vss_count)) 72 | vss_store = vss_volume.get_store(x) 73 | image = vss.VShadowImgInfo(vss_store) 74 | vss_data.append(pytskutil.openVSSFS(image, x)) 75 | 76 | write_csv(vss_data, output) 77 | 78 | 79 | def write_csv(data, output): 80 | if data == []: 81 | print("[-] No output results to write") 82 | sys.exit(3) 83 | 84 | print("[+] Writing output to {}".format(output)) 85 | if os.path.exists(output): 86 | append = True 87 | with open(output, "ab") as csvfile: 88 | csv_writer = csv.writer(csvfile) 89 | headers = ["VSS", "File", "File Ext", "File Type", "Create Date", 90 | "Modify Date", "Change Date", "Size", "File Path"] 91 | if not append: 92 | csv_writer.writerow(headers) 93 | for result_list in data: 94 | csv_writer.writerows(result_list) 95 | 96 | 97 | if __name__ == "__main__": 98 | parser = argparse.ArgumentParser( 99 | description=__description__, 100 | epilog="Developed by {} on {}".format( 101 | ", ".join(__authors__), __date__) 102 | ) 103 | parser.add_argument("EVIDENCE_FILE", help="Evidence file path") 104 | parser.add_argument("OUTPUT_CSV", 105 | help="Output CSV with VSS file listing") 106 | args = parser.parse_args() 107 | 108 | directory = os.path.dirname(args.OUTPUT_CSV) 109 | if not os.path.exists(directory) and directory != "": 110 | os.makedirs(directory) 111 | 112 | if os.path.exists(args.EVIDENCE_FILE) and \ 113 | os.path.isfile(args.EVIDENCE_FILE): 114 | main(args.EVIDENCE_FILE, args.OUTPUT_CSV) 115 | else: 116 | print("[-] Supplied input file {} does not exist or is not a " 117 | "file".format(args.EVIDENCE_FILE)) 118 | sys.exit(1) 119 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2017 Packt 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Python Digital Forensics Cookbook 2 | This is the code repository for [Python Digital Forensics Cookbook](https://www.packtpub.com/networking-and-servers/python-digital-forensics-cookbook?utm_source=github&utm_medium=repository&utm_campaign=9781783987467), published by [Packt](https://www.packtpub.com/?utm_source=github). It contains all the supporting project files necessary to work through the book from start to finish. 3 | ## About the Book 4 | Technology plays an increasingly large role in our daily lives and shows no sign of stopping. Now, more than ever, it is paramount that an investigator develops programming expertise to deal with increasingly large datasets. 5 | ## Instructions and Navigation 6 | All of the code is organized into folders. Each folder starts with a number followed by the application name. For example, Chapter02. 7 | 8 | This is the code bundle for the book, Python Digital Forensics Cookbook, published by Packt. 9 | 10 | All the code files are arracnged in the folder of respective chapter. 11 | 12 | The code will look like the following: 13 | ``` 14 | def hello_world(): 15 | print(“Hello World!”) 16 | hello_world() 17 | ``` 18 | 19 | In order to follow along with and execute the recipes within this cookbook, use a computer with an Internet connection and the latest Python 2.7 and Python 3.5 installations. Recipes may require additional third-party libraries to be installed; instructions for doing that are provided in the recipe. For ease of development and implementation of these recipes, it is recommended that you set up and configure an Ubuntu virtual machine for development. These recipes, unless otherwise noted, were built and tested within an Ubuntu 16.04 environment with both Python 2.7 and 3.5. Several recipes will require the use of a Windows operating system, as many forensic tools operate onlyon this platform. 20 | 21 | ## Related Products 22 | * [wxPython Application Development Cookbook](https://www.packtpub.com/application-development/wxpython-application-development-cookbook?utm_source=github&utm_medium=repository&utm_campaign=9781785287732) 23 | 24 | * [wxPython 2.8 Application Development Cookbook](https://www.packtpub.com/application-development/wxpython-28-application-development-cookbook?utm_source=github&utm_medium=repository&utm_campaign=9781849511780) 25 | 26 | * [Python: End-to-end Data Analysis](https://www.packtpub.com/big-data-and-business-intelligence/python-end-end-data-analysis?utm_source=github&utm_medium=repository&utm_campaign=9781788394697) 27 | 28 | ### Suggestions and Feedback 29 | [Click here](https://docs.google.com/forms/d/e/1FAIpQLSe5qwunkGf6PUvzPirPDtuy1Du5Rlzew23UBp2S-P3wB-GcwQ/viewform) if you have any feedback or suggestions. 30 | --------------------------------------------------------------------------------