-
Notifications
You must be signed in to change notification settings - Fork 13
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Added support for Windows XP artifacts - Added support for selection of specific artifacts
- Loading branch information
1 parent
245bbb1
commit 460cb63
Showing
3 changed files
with
197 additions
and
70 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,108 @@ | ||
import argparse | ||
|
||
from argparse import RawTextHelpFormatter | ||
|
||
|
||
def parse_selection(artifacts): | ||
std_7 = {'reg', 'regb', 'ntuser', 'usrclass', 'evtl', 'setupapi', 'prefetch', 'amcache', 'srum', 'sccm', 'lnk', | ||
'jmp', 'iehist'} | ||
std_xp = {'reg', 'regb_xp', 'ntuser', 'usrclass_xp', 'evtl_xp', 'setupapi_xp', 'prefetch', 'lnk_xp', 'iehist_xp'} | ||
all_7 = std_7 | {'recycle', 'mft', 'usnjrnl', 'logfile'} | ||
all_xp = std_xp | {'recycle_xp', 'mft', 'usnjrnl', 'logfile'} | ||
supported = all_7 | all_xp | {'std', 'std_xp', 'all', 'all_xp'} | ||
|
||
selection = artifacts.split(',') | ||
selection = set(selection) | ||
|
||
# remove unsupported artifacts | ||
unsupported = set() | ||
for selected in selection: | ||
if selected not in supported: | ||
print("{} artifact is not supported.\n".format(selected)) | ||
unsupported.add(selected) | ||
selection = selection - unsupported | ||
|
||
# expand std, std_xp, all, all_xp | ||
if 'std' in selection: | ||
selection = selection | std_7 | ||
if 'std_xp' in selection: | ||
selection = selection | std_xp | ||
if 'all' in selection: | ||
selection = selection | all_7 | ||
if 'all_xp' in selection: | ||
selection = selection | all_xp | ||
|
||
# remove std, std_xp, all_7, all_xp | ||
selection = selection - {'std', 'std_xp', 'all', 'all_xp'} | ||
|
||
if len(selection) == 0: | ||
selection = None | ||
|
||
return selection | ||
|
||
|
||
def get_selection(): | ||
argument_parser = argparse.ArgumentParser(description=( | ||
'ArtifactExtractor extracts selected Windows artifacts from forensic images and VSCs.\n' | ||
'It utilises various libraries and example code written by Joachim Metz.\n\n' | ||
|
||
'Supported Artifacts: \n' | ||
'\t std \t\t reg, regb, ntuser, usrclass, evtl, setupapi, prefetch, amcache, srum, sccm, lnk, jmp, iehist\n' | ||
'\t std_xp \t reg, regb_xp, ntuser, usrclass_xp, evtl_xp, setupapi_xp, prefetch, lnk_xp, iehist_xp\n' | ||
'\t all \t\t all (Windows 7+) - WARNING: SLOW!\n' | ||
'\t all_xp \t all (Windows XP) - WARNING: SLOW!\n' | ||
'\t reg \t\t registry hives\n' | ||
'\t regb \t\t backup registry hives (Windows 7+)\n' | ||
'\t regb_xp \t backup registry hives (Windows XP)\n' | ||
'\t ntuser \t users\' ntuser hive\n' | ||
'\t usrclass \t users\' usrclass hive (Windows 7+)\n' | ||
'\t usrclass_xp \t users\' usrclass (Windows XP)\n' | ||
'\t evtl \t\t event logs (Windows 7+)\n' | ||
'\t evtl_xp \t event logs (Windows XP)\n' | ||
'\t setupapi \t setupapi log (Windows 7+)\n' | ||
'\t setupapi_xp \t setupapi log (Windows XP)\n' | ||
'\t prefetch \t prefetch\n' | ||
'\t amcache \t amcache and/or recentfilecache.bcf\n' | ||
'\t srum \t\t system resource usage monitor\n' | ||
'\t sccm \t\t system center configuration manager software metering\n' | ||
'\t lnk \t\t users\' lnk files (Windows 7+)\n' | ||
'\t lnk_xp \t users\' lnk files (Windows XP)\n' | ||
'\t jmp \t\t users\' jmp lists\n' | ||
'\t iehist \t users\' ie history (Windows 7+)\n' | ||
'\t iehist_xp \t users\' ie history (Windows XP)\n' | ||
'\t recycle \t users\' recycle bin files (Windows 7+) - does not provide owner or original file name\n' | ||
'\t recycle_xp \t users\' recycle bin files (Windows XP) - does not provide owner\n' | ||
'\t mft \t\t ntfs mft\n' | ||
'\t usnjrnl \t ntfs usnjurnl - WARNING: SLOW!\n' | ||
'\t logfile \t ntfs logfile\n\n' | ||
|
||
'Usage: \n' | ||
'\t Extract essential (in developer\'s opinion) artifacts\n' | ||
'\t artifact_extractor <forensic image> <dest> -a std\n\n' | ||
|
||
'\t Extract essential (in developer\'s opinion) artifacts + $MFT\n' | ||
'\t artifact_extractor <forensic image> <dest> -a std,mft\n\n'), formatter_class=RawTextHelpFormatter) | ||
|
||
argument_parser.add_argument('source', nargs='?', metavar='image.raw', default=None, help=( | ||
'path of the directory or filename of a storage media image containing the file.')) | ||
argument_parser.add_argument('dest', nargs='?', metavar='destination', default=None, help=( | ||
'destination directory where the output will be stored.')) | ||
argument_parser.add_argument('-a', '--artifact', default=None, help=( | ||
'artifacts to extract. See above for list of supported artifacts.')) | ||
|
||
options = argument_parser.parse_args() | ||
|
||
if not options.source or not options.dest: | ||
print('One or more arguments is missing.\n') | ||
argument_parser.print_help() | ||
print('') | ||
return False | ||
|
||
if not options.artifact: | ||
options.artifact = 'std' | ||
options.artifact = parse_selection(options.artifact) | ||
|
||
if options.artifact is None: | ||
return False | ||
else: | ||
return options |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,55 +1,73 @@ | ||
LOC_REG = u'/Windows/System32/config/' | ||
LOC_WINEVT = u'/Windows/System32/winevt/logs/' | ||
LOC_WINEVT = LOC_REG | ||
LOC_WINEVTX = u'/Windows/System32/winevt/logs/' | ||
LOC_AMCACHE = u'/Windows/AppCompat/Programs/' | ||
LOC_RECENT = u'/AppData/Roaming/Microsoft/Windows/Recent/' | ||
|
||
SYSTEM_FILE = [ # [artifact_path, destination_directory] | ||
[LOC_REG + u'SAM', u'/Registry/'], | ||
[LOC_REG + u'SECURITY', u'/Registry/'], | ||
[LOC_REG + u'SOFTWARE', u'/Registry/'], | ||
[LOC_REG + u'SYSTEM', u'/Registry/'], | ||
|
||
[LOC_REG + u'RegBack/SAM', u'/Registry/RegBack/'], | ||
[LOC_REG + u'RegBack/SECURITY', u'/Registry/RegBack/'], | ||
[LOC_REG + u'RegBack/SOFTWARE', u'/Registry/RegBack/'], | ||
[LOC_REG + u'RegBack/SYSTEM', u'/Registry/RegBack/'], | ||
|
||
[LOC_WINEVT + u'Application.evtx', u'/OSLogs/'], | ||
[LOC_WINEVT + u'Security.evtx', u'/OSLogs/'], | ||
[LOC_WINEVT + u'Setup.evtx', u'/OSLogs/'], | ||
[LOC_WINEVT + u'System.evtx', u'/OSLogs/'], | ||
[LOC_WINEVT + u'Microsoft-Windows-DriverFrameworks-UserMode%4Operational.evtx', u'/OSLogs/'], | ||
[LOC_WINEVT + u'Microsoft-Windows-PowerShell%4Operational.evtx', u'/OSLogs/'], | ||
[LOC_WINEVT + u'Microsoft-Windows-TaskScheduler%4Operational.evtx', u'/OSLogs/'], | ||
[LOC_WINEVT + u'Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx', u'/OSLogs/'], | ||
[LOC_WINEVT + u'Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx', u'/OSLogs/'], | ||
[LOC_WINEVT + u'Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx', u'/OSLogs/'], | ||
|
||
[LOC_AMCACHE + u'Amcache.hve', u'/MRU/Prog/'], | ||
[LOC_AMCACHE + u'RecentFileCache.bcf', u'/MRU/Prog/'], | ||
|
||
[u'/Windows/Inf/setupapi.dev.log', u'/Registry/'] | ||
['reg', LOC_REG + u'SAM', u'/Registry/'], | ||
['reg', LOC_REG + u'SECURITY', u'/Registry/'], | ||
['reg', LOC_REG + u'SOFTWARE', u'/Registry/'], | ||
['reg', LOC_REG + u'SYSTEM', u'/Registry/'], | ||
|
||
['regb', LOC_REG + u'RegBack/SAM', u'/Registry/RegBack/'], | ||
['regb', LOC_REG + u'RegBack/SECURITY', u'/Registry/RegBack/'], | ||
['regb', LOC_REG + u'RegBack/SOFTWARE', u'/Registry/RegBack/'], | ||
['regb', LOC_REG + u'RegBack/SYSTEM', u'/Registry/RegBack/'], | ||
|
||
['regb_xp', LOC_REG + u'Repair/SAM', u'/Registry/Repair/'], | ||
['regb_xp', LOC_REG + u'Repair/SECURITY', u'/Registry/Repair/'], | ||
['regb_xp', LOC_REG + u'Repair/SOFTWARE', u'/Registry/Repair/'], | ||
['regb_xp', LOC_REG + u'Repair/SYSTEM', u'/Registry/Repair/'], | ||
|
||
['evtl', LOC_WINEVTX + u'Application.evtx', u'/OSLogs/'], | ||
['evtl', LOC_WINEVTX + u'Security.evtx', u'/OSLogs/'], | ||
['evtl', LOC_WINEVTX + u'Setup.evtx', u'/OSLogs/'], | ||
['evtl', LOC_WINEVTX + u'System.evtx', u'/OSLogs/'], | ||
['evtl', LOC_WINEVTX + u'Microsoft-Windows-DriverFrameworks-UserMode%4Operational.evtx', u'/OSLogs/'], | ||
['evtl', LOC_WINEVTX + u'Microsoft-Windows-PowerShell%4Operational.evtx', u'/OSLogs/'], | ||
['evtl', LOC_WINEVTX + u'Microsoft-Windows-TaskScheduler%4Operational.evtx', u'/OSLogs/'], | ||
['evtl', LOC_WINEVTX + u'Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx', u'/OSLogs/'], | ||
['evtl', LOC_WINEVTX + u'Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx', u'/OSLogs/'], | ||
['evtl', LOC_WINEVTX + u'Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx', u'/OSLogs/'], | ||
|
||
['evtl_xp', LOC_WINEVT + u'AppEvent.evt', u'/OSLogs/'], | ||
['evtl_xp', LOC_WINEVT + u'SecEvent.evt', u'/OSLogs/'], | ||
['evtl_xp', LOC_WINEVT + u'SysEvent.evt', u'/OSLogs/'], | ||
|
||
['amcache', LOC_AMCACHE + u'Amcache.hve', u'/MRU/Prog/'], | ||
['amcache', LOC_AMCACHE + u'RecentFileCache.bcf', u'/MRU/Prog/'], | ||
|
||
['setupapi', u'/Windows/Inf/setupapi.dev.log', u'/Registry/'], | ||
['setupapi_xp', u'/Windows/setupapi.log', u'/Registry/'], | ||
|
||
['mft', u'/$MFT', u'/Filesystem/'], | ||
['logfile', u'/$LogFile', u'/Filesystem/'] | ||
] | ||
|
||
SYSTEM_DIR = [ # [artifact_path, destination_directory, isRecursive] | ||
# [u'/$Recycle.Bin', u'/Recycle/', True], | ||
[u'/Windows/Prefetch', u'/MRU/Prog/prefetch/', False], | ||
[u'/Windows/System32/sru', u'/MRU/Prog/srum/', False], | ||
[u'/Windows/System32/wbem/Repository', u'/MRU/Prog/sccm/', False] | ||
['recycle', u'/$Recycle.Bin', u'/Recycle/', True], | ||
['recycle_xp', u'/RECYCLER', u'/Recycle/', True], | ||
['prefetch', u'/Windows/Prefetch', u'/MRU/Prog/prefetch/', False], | ||
['srum', u'/Windows/System32/sru', u'/MRU/Prog/srum/', False], | ||
['sccm', u'/Windows/System32/wbem/Repository', u'/MRU/Prog/sccm/', False] | ||
] | ||
|
||
USER_FILE = [ # [artifact_path, destination_directory] | ||
[u'/NTUSER.DAT', u'/Registry/'], | ||
[u'/AppData/Local/Microsoft/Windows/UsrClass.dat', u'/Registry/'] | ||
['ntuser', u'/NTUSER.DAT', u'/Registry/'], | ||
['usrclass', u'/AppData/Local/Microsoft/Windows/UsrClass.dat', u'/Registry/'], | ||
['usrclass_xp', u'/Local Settings/Application Data/Microsoft/Windows/UsrClass.dat', u'/Registry/'] | ||
] | ||
|
||
USER_DIR = [ # [artifact_path, destination_directory, isRecursive] | ||
[LOC_RECENT, u'MRU/Files/lnk/', False], | ||
[LOC_RECENT + u'AutomaticDestinations', u'/MRU/Files/jmp/', False], | ||
[LOC_RECENT + u'CustomDestinations', u'/MRU/Files/jmp/', False], | ||
[u'/AppData/Local/Microsoft/Windows/WebCache', u'/MRU/Files/webcache/', False] | ||
['lnk', LOC_RECENT, u'MRU/Files/lnk/', False], | ||
['lnk_xp', u'/Recent/', u'MRU/Files/lnk/', False], | ||
['jmp', LOC_RECENT + u'AutomaticDestinations', u'/MRU/Files/jmp/', False], | ||
['jmp', LOC_RECENT + u'CustomDestinations', u'/MRU/Files/jmp/', False], | ||
['iehist', u'/AppData/Local/Microsoft/Windows/WebCache', u'/MRU/Files/iehist/', False], | ||
['iehist_xp', u'/Local Settings/History/History.IE5', u'/MRU/Files/iehist/', True] | ||
] | ||
|
||
FILE_ADS = [ # [artifact_path, destination_directory, ADS Name] | ||
# [u'/$Extend/$UsnJrnl', u'/filesystem/', u'$J'] | ||
['usnjrnl', u'/$Extend/$UsnJrnl', u'/Filesystem/', u'$J'] | ||
] |