Implemented manifest creation

Imanol-Mikel Barba Sabariego
1 parent dd26853c
Showing 9 changed files with 36 additions and 13 deletions
.idea/gravedigger.iml
.idea/misc.xml
digger.py
modules/edb.py
modules/evt.py
modules/info.py
modules/mft.py
modules/winreg.py
types.py
@@ -2,7 +2,7 @@
 <module type="PYTHON_MODULE" version="4">
   <component name="NewModuleRootManager">
     <content url="file://$MODULE_DIR$" />
-    <orderEntry type="inheritedJdk" />
+    <orderEntry type="jdk" jdkName="Python 3.5.2+ (/usr/bin/python3.5)" jdkType="Python SDK" />
     <orderEntry type="sourceFolder" forTests="false" />
   </component>
   <component name="TestRunnerService">
@@ -10,5 +10,5 @@
     <ConfirmationsSetting value="0" id="Add" />
     <ConfirmationsSetting value="0" id="Remove" />
   </component>
-  <component name="ProjectRootManager" version="2" project-jdk-name="Python 3.4.2 (/usr/bin/python3.4)" project-jdk-type="Python SDK" />
+  <component name="ProjectRootManager" version="2" project-jdk-name="Python 3.5.2+ (/usr/bin/python3.5)" project-jdk-type="Python SDK" />
 </project>
 \ No newline at end of file
@@ -18,6 +18,8 @@ import logger
 from consolelogger import ConsoleLogger
 from filelogger import FileLogger
 from hashlib import sha256
+import types
+import xml.etree.ElementTree
  
 def getModules():
     choiceList = []
@@ -54,7 +56,12 @@ def sha256sum(file):
  
 def bagAndTag():
     tombPath = tomb.getPath()
-    hashes = open(tombPath + "hashes.txt",'a+')
+    if os.path.isfile(tombPath + "MANIFEST.XML"):
+        tree = xml.etree.ElementTree.parse("MANIFEST.XML")
+        root = tree.getroot()
+    else:
+        root = xml.etree.ElementTree.Element("Manifest")
+        tree = xml.etree.ElementTree.ElementTree(root)
  
     boneList = []
  
@@ -62,17 +69,22 @@ def bagAndTag():
         for dir in dirnames:
             for subroot, subdirnames, subfilenames in os.walk(tombPath + dir):
                 for filename in subfilenames:
-                    boneList.append(subroot + "/" + filename)
+                    boneList.append({"path" : subroot + "/" + filename, "type": dir})
  
     d.gauge_start(title="Hashing all collected artifacts...",width=60,height=10)
     boneCount = 0
+    evidenceList = root.find("EvidenceList")
     for bone in boneList:
+        if evidenceList.find("./Evidence[@path='" + bone + "']") != None:
+            continue
+        hash = sha256sum(bone)
+        date = os.path.getmtime(bone["path"])
+        evidenceList.insert(len(evidenceList),xml.etree.ElementTree.Element("Evidence", hash=hash,path=bone["path"],type=bone["type"],date=date))
         d.gauge_update(text=bone,percent=int(boneCount*100/len(boneList)),update_text=True)
-        hashes.write(sha256sum(bone) + " " + bone + "\n")
         boneCount += 1
     d.gauge_update(text="Complete!",percent=100,update_text=True)
     time.sleep(1)
-    hashes.close()
+    tree.write(tombPath + "MANIFEST.XML")
  
 def finish(allSuccessful):
     bagAndTag()
@@ -6,7 +6,7 @@ import winver
 from modules.module import Module
 from mount import mount,umount
 from runcmd import runProcess
-
+import datetime
  
 def getInstance():
     return RegistryModule()
@@ -43,7 +43,7 @@ class RegistryModule(Module):
             else:
                 files += [mntpoint + "/ProgramData/Microsoft/Search/Data/Applications/Windows/Windows.edb"]
  
-            runProcess(["tar","-czvf",path + "evt_" + vol + ".tar.gz"] + files)
+            runProcess(["tar","-czvf",path + "evt_" + vol + "_" + str(datetime.datetime.now()) + ".tar.gz"] + files)
             try:
                 umount(mntid)
             except:
@@ -6,6 +6,7 @@ import winver
 from modules.module import Module
 from mount import mount,umount
 from runcmd import runProcess
+import datetime
  
  
 def getInstance():
@@ -46,7 +47,7 @@ class RegistryModule(Module):
             else:
                     files += [windir + "/System32/winevt/Logs" ]
  
-            runProcess(["tar","-czvf",path + "evt_" + vol + ".tar.gz"] + files)
+            runProcess(["tar","-czvf",path + "evt_" + vol + "_" + str(datetime.datetime.now()) + ".tar.gz"] + files)
             try:
                 umount(mntid)
             except:
@@ -3,6 +3,7 @@ import os
 import tomb
 from modules.module import Module
 from runcmd import runProcess
+import datetime
  
  
 def getInstance():
@@ -21,11 +22,11 @@ class INFOModule(Module):
         if(not os.path.exists(path)):
             os.mkdir(path)
         output,code = runProcess("lshw")
-        lshw = open(path + "lshw.txt", 'wb')
+        lshw = open(path + "lshw_" + str(datetime.datetime.now()) + ".txt", 'wb')
         lshw.write(output)
         lshw.close()
  
         output,code = runProcess("dmidecode")
-        lshw = open(path + "dmidecode.txt", 'wb')
+        lshw = open(path + "dmidecode_" + str(datetime.datetime.now()) + ".txt" 'wb')
         lshw.write(output)
         lshw.close()
 \ No newline at end of file
@@ -5,6 +5,7 @@ import tomb
 from modules.module import Module
 from runcmd import runProcess
 import pytsk3
+import datetime
  
  
 def getInstance():
@@ -46,5 +47,5 @@ class MFTModule(Module):
             os.mkdir(path)
             logger.msgLog("Extracting MFT from volumes: " + repr(self.vars['ntfsvol'].value), "mft", logger.TYPE_INFO)
         for vol in self.vars['ntfsvol'].value:
-            self.dumpMFT("/dev/" + vol,path + vol + ".bin")
+            self.dumpMFT("/dev/" + vol,path + vol + "_" + str(datetime.datetime.now()) + ".bin")
  
@@ -6,6 +6,7 @@ import winver
 from modules.module import Module
 from mount import mount,umount
 from runcmd import runProcess
+import datetime
  
  
 def getInstance():
@@ -64,7 +65,7 @@ class RegistryModule(Module):
                             #Vista+
                             files += [profile + "/AppData/Local/Microsoft/Windows/UsrClass.dat"]
  
-            runProcess(["tar","-czvf",path + "winreg_" + vol + ".tar.gz"] + files)
+            runProcess(["tar","-czvf",path + "winreg_" + vol + "-" + str(datetime.datetime.now()) + ".tar.gz"] + files)
             try:
                 umount(mntid)
             except:
+typeDefinitions = {
+    "mft":      0x00,
+    "winreg":   0x01,
+    "evt":      0x02,
+    "edb":      0x03,
+    "info":     0x04
+}
 \ No newline at end of file