Skip to content

Instantly share code, notes, and snippets.

@davehull
Created December 11, 2011 23:37
Show Gist options
  • Save davehull/1463512 to your computer and use it in GitHub Desktop.
Save davehull/1463512 to your computer and use it in GitHub Desktop.
This Python function builds a dictionary from the lines of a bodyfile as produced by The Sleuth Kit's fls command
def get_meta(bodyfile):
fname_skip_cnt = bad_line = total_lines = 0
meta = {}
fi = open(bodyfile, 'rb')
for line in fi:
total_lines += 1
try:
md5,ppath,inode,mode,uid,gid,size,atime,mtime,ctime,crtime = line.rstrip().split("|")
except:
bad_line += 1
continue
fname = os.path.basename(ppath).rstrip()
if fname == ".." or fname == ".":
fname_skip_cnt += 1
continue
pname = os.path.dirname(ppath).rstrip()
if pname not in meta:
meta[pname] = {}
meta[pname][fname] = {}
meta[pname][fname]['meta_addr'] = inode
meta[pname][fname]['perm'] = mode
meta[pname][fname]['uid'] = uid
meta[pname][fname]['gid'] = gid
meta[pname][fname]['atime'] = atime
meta[pname][fname]['mtime'] = mtime
meta[pname][fname]['ctime'] = ctime
meta[pname][fname]['crtime'] = crtime
print "[+] Discarded %d files named .. or ." % (fname_skip_cnt)
print "[+] Discarded %d bad lines from %s." % (bad_line, args.filename)
print "[+] Added %d paths to meta." % (len(meta))
return meta
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment