Skip to content

Commit

Permalink
Merge branch 'upgrade-and-refactor'
Browse files Browse the repository at this point in the history
  • Loading branch information
anarchivist committed Sep 24, 2013
2 parents 2454b85 + df80f62 commit 4a07dc6
Show file tree
Hide file tree
Showing 26 changed files with 92 additions and 51,388 deletions.
13 changes: 13 additions & 0 deletions LICENSE
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
Copyright 2012-2013 Mark A. Matienzo <mark@matienzo.org>

Licensed under the Apache License, Version 2.0 (the "License"); you may not
use this file except in compliance with the License. You may obtain a copy of
the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
License for the specific language governing permissions and limitations under
the License.
36 changes: 16 additions & 20 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,14 +1,14 @@
Fiwalk DGI scripts
==================

These are Domex Gateway Interface ("DGI") scripts for Simson Garfinkel's
[fiwalk](http://afflib.org/software/fiwalk), a command-line tool
that processes a forensic disk image. DGI is a plug-in mechanism for fiwalk
that allows an external program to return metadata or other structured
These are Domex Gateway Interface ("DGI") scripts for [fiwalk](https://github.com/sleuthkit/sleuthkit/tree/master/tools/fiwalk),
a command-line tool that uses [The Sleuth Kit](http://sleuthkit.org/) to
extract metadata from a forensic disk image. DGI is a plug-in mechanism for
fiwalk that allows an external program to return metadata or other structured
information to fiwalk as key/value pairs. fiwalk outputs in a variety of
formats including Digital Forensics XML (DFXML) and ARFF.

More information on fiwalk and DFXML can be found in the link above and in Garfinkel 2012 ([10.1016/j.diin.2011.11.002](http://dx.doi.org/10.1016/j.diin.2011.11.002); [preprint available](http://simson.net/ref/2011/dfxml.pdf)).
More information on fiwalk and DFXML can be found in the link above and in Garfinkel 2012 ([doi:10.1016/j.diin.2011.11.002](http://dx.doi.org/10.1016/j.diin.2011.11.002); [preprint available](http://simson.net/ref/2011/dfxml.pdf)).

DGI key-value format
--------------------
Expand Down Expand Up @@ -41,24 +41,20 @@ Included Scripts
* get-mediainfo.rb: Uses MediaInfo for AV technical metadata extraction
* virusscan.rb: Uses ClamAV and libclamav gem for virus/malware scanning (slow; proof of concept)

Updating FIDO
-------------
The dependencies for the Python scripts can be installed with the following commands:

The Python scripts include [FIDO](https://github.com/openplanets/fido) for
file format identification, which has been brought into the source tree
using Git's [subtree merging](http://www.kernel.org/pub/software/scm/git/docs/v1.7.10/howto/using-merge-subtree.html) technique.

To update FIDO when a new version is released, ensure that you have the
FIDO repository set up as a remote:

$ git remote add -f fido git://github.com/openplanets/fido

Then pull in the changes accordingly:

$ git pull -s subtree fido master
$ cd python ; pip install -r requirements.txt

Author
------

* Mark A. Matienzo (mark at matienzo dot org)
* Contributors/authors of included code listed in source or licenses.
* Contributors/authors of included code listed in source or licenses where
applicable.

License
-------

Apache 2.0

Feel free to contact me if for some reason this will not work for your use.
31 changes: 13 additions & 18 deletions python/accession.py
Original file line number Diff line number Diff line change
Expand Up @@ -5,27 +5,22 @@
"""

import sys
from optparse import OptionParser
from pronom_ident import pronom_ident
from virusscan import virusscan
from argparse import ArgumentParser
from pronom_ident import main as pronom_ident
from virusscan import main as virusscan

def main():
parser = OptionParser()
parser.add_option('-m', '--method', dest='method',
def main(arglist=None):
if arglist == None:
arglist = sys.argv[1:]
parser = ArgumentParser()
parser.add_argument('file', default=[], metavar='FILE', help='File to identify')
parser.add_argument('-m', '--method', dest='method',
default='socket', help='define method of interaction with clamav')
parser.add_option('-s', '--socket', dest='socket',
parser.add_argument('-s', '--socket', dest='socket',
default='/tmp/clamd.socket', help='clamav unix socket to use')
opts, args = parser.parse_args()

if len(args) < 1:
parser.print_help()
exit(-1)

filename = args[0]
out = dict(pronom_ident(filename).items() + virusscan(filename).items())
for k, v in out.items():
if v is not None:
print k + ': ' + str(v)
args = parser.parse_args(arglist)
virusscan(arglist)
pronom_ident(arglist)

if __name__ == "__main__":
sys.exit(main())
16 changes: 0 additions & 16 deletions python/fido/LICENSE.txt

This file was deleted.

Empty file removed python/fido/__init__.py
Empty file.
Loading

0 comments on commit 4a07dc6

Please sign in to comment.