diff --git a/.idea/gravedigger.iml b/.idea/gravedigger.iml index 6711606..a151692 100644 --- a/.idea/gravedigger.iml +++ b/.idea/gravedigger.iml @@ -2,7 +2,7 @@ - + diff --git a/.idea/misc.xml b/.idea/misc.xml index aa314da..8829a96 100644 --- a/.idea/misc.xml +++ b/.idea/misc.xml @@ -10,5 +10,5 @@ - + \ No newline at end of file diff --git a/digger.py b/digger.py index d1988c6..49ae963 100644 --- a/digger.py +++ b/digger.py @@ -18,6 +18,8 @@ import logger from consolelogger import ConsoleLogger from filelogger import FileLogger from hashlib import sha256 +import types +import xml.etree.ElementTree def getModules(): choiceList = [] @@ -54,7 +56,12 @@ def sha256sum(file): def bagAndTag(): tombPath = tomb.getPath() - hashes = open(tombPath + "hashes.txt",'a+') + if os.path.isfile(tombPath + "MANIFEST.XML"): + tree = xml.etree.ElementTree.parse("MANIFEST.XML") + root = tree.getroot() + else: + root = xml.etree.ElementTree.Element("Manifest") + tree = xml.etree.ElementTree.ElementTree(root) boneList = [] @@ -62,17 +69,22 @@ def bagAndTag(): for dir in dirnames: for subroot, subdirnames, subfilenames in os.walk(tombPath + dir): for filename in subfilenames: - boneList.append(subroot + "/" + filename) + boneList.append({"path" : subroot + "/" + filename, "type": dir}) d.gauge_start(title="Hashing all collected artifacts...",width=60,height=10) boneCount = 0 + evidenceList = root.find("EvidenceList") for bone in boneList: + if evidenceList.find("./Evidence[@path='" + bone + "']") != None: + continue + hash = sha256sum(bone) + date = os.path.getmtime(bone["path"]) + evidenceList.insert(len(evidenceList),xml.etree.ElementTree.Element("Evidence", hash=hash,path=bone["path"],type=bone["type"],date=date)) d.gauge_update(text=bone,percent=int(boneCount*100/len(boneList)),update_text=True) - hashes.write(sha256sum(bone) + " " + bone + "\n") boneCount += 1 d.gauge_update(text="Complete!",percent=100,update_text=True) time.sleep(1) - hashes.close() + tree.write(tombPath + "MANIFEST.XML") def finish(allSuccessful): bagAndTag() diff --git a/modules/edb.py b/modules/edb.py index b3e00d6..1784274 100644 --- a/modules/edb.py +++ b/modules/edb.py @@ -6,7 +6,7 @@ import winver from modules.module import Module from mount import mount,umount from runcmd import runProcess - +import datetime def getInstance(): return RegistryModule() @@ -43,7 +43,7 @@ class RegistryModule(Module): else: files += [mntpoint + "/ProgramData/Microsoft/Search/Data/Applications/Windows/Windows.edb"] - runProcess(["tar","-czvf",path + "evt_" + vol + ".tar.gz"] + files) + runProcess(["tar","-czvf",path + "evt_" + vol + "_" + str(datetime.datetime.now()) + ".tar.gz"] + files) try: umount(mntid) except: diff --git a/modules/evt.py b/modules/evt.py index f51bf8f..e77a959 100644 --- a/modules/evt.py +++ b/modules/evt.py @@ -6,6 +6,7 @@ import winver from modules.module import Module from mount import mount,umount from runcmd import runProcess +import datetime def getInstance(): @@ -46,7 +47,7 @@ class RegistryModule(Module): else: files += [windir + "/System32/winevt/Logs" ] - runProcess(["tar","-czvf",path + "evt_" + vol + ".tar.gz"] + files) + runProcess(["tar","-czvf",path + "evt_" + vol + "_" + str(datetime.datetime.now()) + ".tar.gz"] + files) try: umount(mntid) except: diff --git a/modules/info.py b/modules/info.py index 1ca9916..65be8bd 100644 --- a/modules/info.py +++ b/modules/info.py @@ -3,6 +3,7 @@ import os import tomb from modules.module import Module from runcmd import runProcess +import datetime def getInstance(): @@ -21,11 +22,11 @@ class INFOModule(Module): if(not os.path.exists(path)): os.mkdir(path) output,code = runProcess("lshw") - lshw = open(path + "lshw.txt", 'wb') + lshw = open(path + "lshw_" + str(datetime.datetime.now()) + ".txt", 'wb') lshw.write(output) lshw.close() output,code = runProcess("dmidecode") - lshw = open(path + "dmidecode.txt", 'wb') + lshw = open(path + "dmidecode_" + str(datetime.datetime.now()) + ".txt" 'wb') lshw.write(output) lshw.close() \ No newline at end of file diff --git a/modules/mft.py b/modules/mft.py index 89f6985..e990928 100644 --- a/modules/mft.py +++ b/modules/mft.py @@ -5,6 +5,7 @@ import tomb from modules.module import Module from runcmd import runProcess import pytsk3 +import datetime def getInstance(): @@ -46,5 +47,5 @@ class MFTModule(Module): os.mkdir(path) logger.msgLog("Extracting MFT from volumes: " + repr(self.vars['ntfsvol'].value), "mft", logger.TYPE_INFO) for vol in self.vars['ntfsvol'].value: - self.dumpMFT("/dev/" + vol,path + vol + ".bin") + self.dumpMFT("/dev/" + vol,path + vol + "_" + str(datetime.datetime.now()) + ".bin") diff --git a/modules/winreg.py b/modules/winreg.py index aef65a1..dab0b5e 100644 --- a/modules/winreg.py +++ b/modules/winreg.py @@ -6,6 +6,7 @@ import winver from modules.module import Module from mount import mount,umount from runcmd import runProcess +import datetime def getInstance(): @@ -64,7 +65,7 @@ class RegistryModule(Module): #Vista+ files += [profile + "/AppData/Local/Microsoft/Windows/UsrClass.dat"] - runProcess(["tar","-czvf",path + "winreg_" + vol + ".tar.gz"] + files) + runProcess(["tar","-czvf",path + "winreg_" + vol + "-" + str(datetime.datetime.now()) + ".tar.gz"] + files) try: umount(mntid) except: diff --git a/types.py b/types.py new file mode 100644 index 0000000..bc4f5dd --- /dev/null +++ b/types.py @@ -0,0 +1,7 @@ +typeDefinitions = { + "mft": 0x00, + "winreg": 0x01, + "evt": 0x02, + "edb": 0x03, + "info": 0x04 +} \ No newline at end of file