-
Notifications
You must be signed in to change notification settings - Fork 165
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Upgrade bulk extractor #1381
Upgrade bulk extractor #1381
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM, small nits. As @aarontp is the official lead for Turbinia I will let him hit the final approval button.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM @aarontp PTAL
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good, just a couple small things. Thanks for the contribution!
LGTM, thanks! |
Description of the change
Even though the Issue resolved by this pull request (#1263) was initially about the
Strings
-Job, it came clear, thatbulk-extractor
is able to to all desired work. Therefore in accordance with the discussion on the issue, several changes were made to thebulk-extractor
-wrapper.This pull request therefore changes a couple of things regarding the
bulk-extractor
in turbinia. The following list gives an overview:evidence
types: It now supportsDirectory
andCompressedDirectory
as well. In both cases theR
-Flag is used to scan the evidence recursively.TASK_CONFIG
-Parameter:regex_pattern_files
lets you list one or many files that include regular expressions separated by newline. This does not break the possibility to pass other parameters tobulk-extractor
usingbulk_extractor_args
including other regex-pattern-files passed directly to the tool. These are then passed to thebulk-extractor
using theF
-Flag and results are listed infind.txt
generate_summary_report
already generates a report. This report is now written to file in the output-directory.An example recipe e.g. would be a yaml file with the following content:
An example file in path
/evidence/regex_pattern_file
would look e.g. like this:Applicable issues
Additional information
Apart from extending the functionality of the bulk-extractor this pull request includes code that creates an
enhanced report. This includes writing the report to file at the end and displaying the hits as table instead of a bulleted list.
Checklist