Merge pull request #24 from dfir-dd/23-usage-of-pure-rust-scca-library

23 usage of pure rust scca library

.github/workflows/cargo_publish.yml

@@ -8,10 +8,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
         - uses: actions/checkout@v2
-
-        - name: Install required libscca-dev
-          run: sudo apt install -y libscca-dev
-
+
         - uses: actions-rs/toolchain@v1
           with:
               toolchain: stable

.github/workflows/cargo_test.yml

@@ -9,9 +9,6 @@ jobs:
     steps:
       - uses: actions/checkout@v2
 
-      - name: Install required libscca-dev
-        run: sudo apt install -y libscca-dev
-
       - uses: actions-rs/toolchain@v1
         with:
           toolchain: stable

.github/workflows/coverage.yml

@@ -8,9 +8,6 @@ jobs:
     steps:
 
       - uses: actions/checkout@v1
-
-      - name: Install required libscca-dev
-        run: sudo apt install -y libscca-dev
 
       - uses: actions-rs/toolchain@v1
         with:

.github/workflows/rust-clippy.yml

@@ -37,9 +37,6 @@ jobs:
           toolchain: stable
           components: clippy
           override: true
-
-      - name: Install required libscca-dev
-        run: sudo apt install -y libscca-dev
 
       - name: Install required cargo
         run: cargo install clippy-sarif sarif-fmt

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "dfir-toolkit"
-version = "0.10.0"
+version = "0.10.1"
 edition = "2021"
 authors = ["Jan Starke <jan.starke@posteo.de>", "Deborah Mahn <deborah.mahn@dfir-dd.de>"]
 description = "CLI tools for digital forensics and incident response"
@@ -99,7 +99,7 @@ evtx2bodyfile = ["evtx", "getset", "ouroboros", "indicatif"]
 ipgrep = []
 ts2date = ["regex"]
 lnk2bodyfile = ["lnk"]
-pf2bodyfile = ["num", "libc"]
+pf2bodyfile = ["num", "libc", "frnsc-prefetch", "forensic-rs"]
 
 regdump = ["nt_hive2"]
 hivescan = ["nt_hive2"]
@@ -176,6 +176,8 @@ lnk = {version="0.5.1", optional=true}
 # pf2bodyfile
 libc = {version="0.2", optional=true}
 num = {version="0", optional=true}
+frnsc-prefetch = {version="0.9", optional=true}
+forensic-rs = {version="0.9.1", optional=true}
 
 [dev-dependencies]
 

src/bin/pf2bodyfile/cli.rs

@@ -1,6 +1,6 @@
 use clap::Parser;
 use clap::ValueHint;
-use clio::Input;
+use clio::ClioPath;
 use dfir_toolkit::common::HasVerboseFlag;
 use getset::Getters;
 use log::LevelFilter;
@@ -12,7 +12,11 @@ use log::LevelFilter;
 pub(crate) struct Cli {
     /// names of the prefetch files (commonly files with 'pf' extension in 'C:\Windows\Prefetch')
     #[clap(value_hint=ValueHint::FilePath)]
-    prefetch_files: Vec<Input>,
+    prefetch_files: Vec<ClioPath>,
+
+    /// show not only the executed files, but all references files -- such as libraries -- as well
+    #[clap(short='I')]
+    include_metrics: bool,
 
     #[clap(flatten)]
     verbose: clap_verbosity_flag::Verbosity,

src/bin/pf2bodyfile/main.rs

@@ -1,38 +1,93 @@
 mod cli;
+
 use cli::Cli;
 use dfir_toolkit::common::bodyfile::Bodyfile3Line;
 use dfir_toolkit::common::FancyParser;
-use dfir_toolkit::scca::File;
+use forensic_rs::prelude::*;
+use frnsc_prefetch::prelude::*;
+use log::{error, warn};
+use std::path::Path;
 
 fn main() -> anyhow::Result<()> {
     let cli = Cli::parse_cli();
 
-    if cli.prefetch_files().iter().any(|f| !f.can_seek()) {
-        anyhow::bail!(
-            "{} cannot read from a stream; you must specify a file",
-            env!("CARGO_BIN_NAME")
-        );
+    if cli.prefetch_files().iter().any(|f| !f.path().exists()) {
+        anyhow::bail!("some files you specified do not exist");
     }
-
-    if cli.prefetch_files().iter().any(|f| ! f.path().is_file()) {
-        anyhow::bail!(
-            "{} you must specify a file",
-            env!("CARGO_BIN_NAME")
-        );
+    if cli.prefetch_files().iter().any(|f| !f.path().is_file()) {
+        anyhow::bail!("some paths you specified are no files");
     }
 
+    let vfs = Box::new(StdVirtualFS::new());
+
     for input in cli.prefetch_files().iter() {
-        let path = input.path().as_os_str().to_string_lossy();
-        let pf_file = input.path().file_name().unwrap().to_string_lossy();
-        let file = File::open(&path)?;
-        let executable = file.utf8_executable_filename()?;
-        let run_count = file.run_count()?;
-        for time in file.last_run_times()? {
+        match input.parent() {
+            Some(parent) => {
+                let mut fs = ChRootFileSystem::new(parent, vfs.clone());
+                if let Some(pf_os_filename) = input.path().file_name() {
+                    if let Some(pf_filename) = pf_os_filename.to_str() {
+                        let pf_file = read_prefetch_file(
+                            pf_filename,
+                            fs.open(Path::new(&pf_filename.to_string()))?,
+                        )?;
+
+                        pf_file.display_prefetch_file(pf_filename, *cli.include_metrics())?;
+                    } else {
+                        error!("invalid Unicode characters in filename: '{pf_os_filename:?}'")
+                    }
+                } else {
+                    warn!("unable to handle directories; you must specify concrete file names");
+                }
+            }
+            None => {
+                error!("specified path has no parent: {input}")
+            }
+        }
+    }
+    Ok(())
+}
+
+trait DisplayPrefetchFile {
+    fn display_prefetch_file(
+        &self,
+        pf_file_name: &str,
+        include_metrics: bool,
+    ) -> anyhow::Result<()>;
+}
+
+impl DisplayPrefetchFile for PrefetchFile {
+    fn display_prefetch_file(
+        &self,
+        pf_file_name: &str,
+        include_metrics: bool,
+    ) -> anyhow::Result<()> {
+        for time in &self.last_run_times {
+            let accessed =
+                winstructs::timestamp::WinTimestamp::new(&time.filetime().to_le_bytes())?
+                    .to_datetime()
+                    .into();
+
             let bf_line = Bodyfile3Line::new()
-                .with_owned_name(format!("Prefetch: '{executable}' (run {run_count} times, read from '{pf_file}')"))
-                .with_atime(time.into());
+                .with_owned_name(format!(
+                    "Prefetch: run '{}' (run {} times, read from '{pf_file_name}')",
+                    self.name, self.run_count
+                ))
+                .with_atime(accessed);
             println!("{bf_line}");
+
+            if include_metrics {
+                for metric in &self.metrics {
+                    let mf = &metric.file;
+                    let bf_line = Bodyfile3Line::new()
+                        .with_owned_name(format!(
+                            "Prefetch: running '{} possibly loaded '{mf}', read from '{pf_file_name}')",
+                            self.name
+                        ))
+                        .with_atime(accessed);
+                    println!("{bf_line}");
+                }
+            }
         }
+        Ok(())
     }
-    Ok(())
-}
+}

src/common/bodyfile/times.rs

@@ -2,13 +2,13 @@ use crate::common::bodyfile::Bodyfile3ParserError;
 use std::fmt::Display;
 use chrono::{DateTime, NaiveDateTime, Utc};
 
-#[derive(Debug, Default, Eq, PartialEq, Ord, PartialOrd)]
+#[derive(Debug, Clone, Copy, Default, Eq, PartialEq, Ord, PartialOrd)]
 pub struct Accessed(Option<i64>);
-#[derive(Debug, Default, Eq, PartialEq, Ord, PartialOrd)]
+#[derive(Debug, Clone, Copy, Default, Eq, PartialEq, Ord, PartialOrd)]
 pub struct Modified(Option<i64>);
-#[derive(Debug, Default, Eq, PartialEq, Ord, PartialOrd)]
+#[derive(Debug, Clone, Copy, Default, Eq, PartialEq, Ord, PartialOrd)]
 pub struct Changed(Option<i64>);
-#[derive(Debug, Default, Eq, PartialEq, Ord, PartialOrd)]
+#[derive(Debug, Clone, Copy, Default, Eq, PartialEq, Ord, PartialOrd)]
 pub struct Created(Option<i64>);
 
 pub trait BehavesLikeI64: From<i64> + From<Option<i64>> {

src/common/forensics_timestamp.rs

@@ -15,7 +15,9 @@ lazy_static! {
                 eprintln!();
                 eprintln!("Please take a look at");
                 eprintln!();
-                eprintln!("        <https://docs.rs/chrono/latest/chrono/format/strftime/index.html>");
+                eprintln!(
+                    "        <https://docs.rs/chrono/latest/chrono/format/strftime/index.html>"
+                );
                 eprintln!();
                 eprintln!("to see which format strings are accepted.");
                 eprintln!();
@@ -28,7 +30,8 @@ lazy_static! {
         }
     };
     static ref ZERO: DateTime<FixedOffset> =
-        DateTime::<FixedOffset>::parse_from_rfc3339("0000-00-00T00:00:00+00:00").unwrap();
+        DateTime::<FixedOffset>::parse_from_rfc3339("0000-00-00T00:00:00+00:00")
+            .expect("unable to parse literal timestamp");
 }
 
 pub struct ForensicsTimestamp {
@@ -63,10 +66,11 @@ impl ForensicsTimestamp {
 impl Display for ForensicsTimestamp {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         if self.unix_ts >= 0 {
-            let src_timestamp = match self
-                .src_zone
-                .from_local_datetime(&NaiveDateTime::from_timestamp_opt(self.unix_ts, 0).unwrap())
-            {
+            let src_timestamp = match self.src_zone.from_local_datetime(
+                &NaiveDateTime::from_timestamp_opt(self.unix_ts, 0).unwrap_or_else(|| {
+                    panic!("unable to convert '{}' into unix timestamp", self.unix_ts)
+                }),
+            ) {
                 LocalResult::None => {
                     panic!("INVALID DATETIME");
                 }

src/lib.rs

@@ -1,7 +1,6 @@
 pub mod registry;
 pub mod common;
 pub mod evtx;
-pub mod scca;
 
 #[cfg(feature="elastic")]
 pub mod es4forensics;