a ruby toolkit for working with FTK output
Latest commit 5a5e3c5 Aug 24, 2011 Bess Sadler Adding some inline comments


Ruby FTK Toolkit

This is a ruby library for manipulating the output of Forensic Toolkit (http://accessdata.com/products/computer-forensics/ftk). It was built for a project called Hypatia (http://wiki.duraspace.org/display/HYPAT/Charter) but can be used elsewhere. It makes certain assumptions about how FTK outputs data, which will be documented here soon.

The XML output that FTK creates is an XML-FO document that isn’t easy to read or understand. This library can do that for you. To turn an FTK report into something that’s easier to work with, follow this example:

		require 'ruby_ftk_toolkit'
      	report = File.join(File.dirname(__FILE__), "/spec/fixtures/Gould_FTK_Report.xml")
		ftk_processor = FtkProcessor.new(:ftk_report => report)
		# You can get collection level data 
		ftk_processor.collection_title # => "Stephen Jay Gould papers"
		ftk_processor.call_number 	# => "M1437"
		ftk_processor.series # => "Series 6: Born Digital Materials"
		ftk_processor.file_count # => "56"
		# And you can get file level data in the form of FtkFile objects
		ftk_processor.files.each do |ftk_file|
			puts ftk_file[1].filename
			puts ftk_file[1].id
			puts ftk_file[1].md5

You might want to create BagIt packages for each file from your FTK output:

# Assemble FTK output into objects for Hypatia. my_fedora_config = "/path/to/fedora.yml" my_bag_dir = "/path/to/where/my/bags/should/be/created" ftk_report = "/path/to/FTK_Report.xml" file_dir = "/path/to/exported/ftk/file/directory" hfo = HypatiaFileObjectAssembler.new(:fedora_config => my_fedora_config, :bag_destination => my_bag_dir) hfo.process(ftk_report, file_dir)