Nugget is a domain specific language (DSL) for Digital Forensics. This is alpha software - expect bugs.
A docker container is provided which has sample forensic targets pre-loaded. Example Nugget queries are also included. To use:
docker pull cdstelly/nugget
docker run -it cdstelly/nugget
$ cd /nugget
$ ./nugget -input input.nug
The current alpha build depends upon libpcap for network forensics; have them installed.
sudo apt install libpcap-dev
To build from source:
git clone https://github.com/cdstelly/nugget.git
cd nugget
export GOPATH=`pwd`
go get ...
go build github.com/cdstelly/nugget
After either building from source or downloading binaries:
$ ./nugget -h
Usage of ./nugget:
-assembly_debug_log
If true, the github.com/google/gopacket/tcpassembly library will log verbose debugging information (at least one line per packet)
-assembly_memuse_log
If true, the github.com/google/gopacket/tcpassembly library will log information regarding its memory use every once in a while.
-input string
Path to input
-interactive
Interactive mode
nugget> myhashes = "file.dd" | extract as ntfs | filter filename == "*.pdf",ctime>"01/01/01" | md5
nugget> print myhashes.digest
[{c10c4d40735cc699bd16d4d18c2c6b09} {cc285f386f167c2206dd9ff6546dcd0a} ... }]
nugget> mypcap = "G:\school\sample.pcap" | extract as pcap
nugget> myhttp = mypcap | filter packetfilter == "tcp and port 80 and http"
nugget> print myhttp
[ GET /site=0000127709/mnum=0000162763/genr=1/logs=0/mdtm=1077726643/bins=1 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0) Opera 7.11 [en]
Host: opera2-servedby.advertising.com
Accept: application/x-shockwave-flash,text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,video/x-mng,image/png,image/jpeg,image/gif;q=0.2,text/css,*/*;q=0.1
Accept-Language: en
...
Nugget provides a mechanism which allows non-technical users add functionality by generating templated code and inserting specified keywords into its own grammar. See grammar builder.
Please use GitHub's issue tracker.