Learning Python for Forensics
上QQ阅读APP看书,第一时间看更新

Overview

Before developing any code, let's identify the requirements and features our script must possess to accomplish the desired task. We will need to execute the following steps:

  1. Open the log file and read all lines
  2. In each line, check for indicators of a USB device entry
  3. Parse responsive lines for timestamp and device information
  4. Output the result to the user

Now, let's examine the log file of interest to determine repetitive structures that we can use as footholds in our script to parse the relevant data. In the following sample USB entry, we can see the device information on line 1 following the text Device Install (Hardware initiated). This device information contains the VID, PID, device revision, and the unique ID of the device. Each of these elements is separated by either a & or _ character and may contain some additional inconsequential characters. The installation time is recorded on line 2, following the Section start text. For our purposes, we are only interested in these two lines. All other surrounding lines will be ignored, as they relate to operating system driver information:

001 >>>  [Setup online Device Install (Hardware initiated) - pciven_15ad&dev_07a0&subsys_07a015ad&rev_013&18d45aa6&0&a9]
002 >>> Section start 2010/11/10 10:21:12.593
003 ump: Creating Install Process: DrvInst.exe 10:21:12.593
004 ndv: Retrieving device info...
005 ndv: Setting device parameters...
006 ndv: Searching Driver Store and Device Path...
007 dvi: {Build Driver List} 10:21:12.640