Skip to content

Instantly share code, notes, and snippets.

@ilyaglow
Last active May 16, 2019 14:05
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
Star You must be signed in to star a gist
Save ilyaglow/cfa8b3565a5312e4111529500ecbce2c to your computer and use it in GitHub Desktop.
#!/usr/bin/env python3
#
# Converter based on volatility timeliner json output
# you need to install python-dateutil to use it:
# pip3 install python-dateutil --user
#
# Volatility json output has following columns:
# [u'Start', u'Header', u'Item', u'Details']
#
# The data row:
# [u'2015-11-24 21:12:38 UTC+0000', u'[PROCESS]', u' smss.exe',
# u' PID: 328/PPID: 4/POffset: 0x1005fa900']
#
# Mandatory timesketch fields:
# message,timestamp,datetime,timestamp_desc
#
# How I map those fields:
# Item -> message, Start -> timestamp, Start -> datetime,
# Header -> timestamp_desc, Details -> details
#
import json
import sys
import csv
import time
import dateutil.parser as parser
USAGE = """
./volatility_to_timesketch.py INPUTFILE OUTPUTFILE
INPUTFILE is volatility's timeliner output file (JSON type)
OUTPUTFILE is the result CSV file ready to import to Timesketch
"""
def converter(row):
timestamp = 0
datetime = '1970-01-01T00:00:00Z'
if row[0] != '-':
date = parser.parse(row[0])
timestamp = time.mktime(date.timetuple())*1000000
datetime = date.isoformat()
message = row[2]
timestamp_desc = row[1].lstrip('[').rstrip(']')
details = row[3]
return [message, timestamp, datetime, timestamp_desc, details]
if __name__ == '__main__':
if len(sys.argv) < 3:
print(USAGE)
exit(1)
with open(sys.argv[1]) as f:
vol_timeliner = json.load(f)
with open(sys.argv[2], 'w') as o:
ts_writer = csv.writer(o)
ts_writer.writerow(['message',
'timestamp',
'datetime',
'timestamp_desc',
'details'])
for row in vol_timeliner['rows']:
ts_writer.writerow(converter(row))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment