Learning Python for Forensics
上QQ阅读APP看书,第一时间看更新

Running the script

In this iteration, we address several issues from the proof of concept. These changes include the following:

  • The improvement of resource management by iterating through a file rather than reading the entire file into a variable
  • The addition of an argument to allow the user to provide the setupapi.dev.log file to parse
  • The validation of the input file from the user
  • The filtering of responsive hits to reduce noise in the output
  • Improved formatting of our output for ease of review

The following screenshot shows a snippet of the output of our script upon execution:

Last but not least, we achieved considerable performance improvements over our previous design. The following screenshots display the impact on the machine's memory utilization. The first iteration is displayed on the left and the second is displayed on the right. The red lines highlight the start and finish time of our script. As we can see, we have reduced our resource utilization by iterating across the lines of the file with the for loop over the readlines() method. This is a small-scale example of resource management, but a larger input file would have a more dramatic impact on the system: