View extract_unallocated.py
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/usr/bin/env python3 | |
# (c) Maxim Suhanov | |
# 2020 | |
import sys | |
if len(sys.argv) != 4: | |
print('Usage: extract_unallocated.py <bitmap file> <flat image> <cluster size (in bytes)') | |
sys.exit(0) |
View print_ts_la.py
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/usr/bin/env python3 | |
import os | |
from time import sleep | |
FILE_PATH = 'ts.txt' | |
def get_atime_1(): | |
result = os.stat(FILE_PATH, follow_symlinks = False) | |
return result.st_atime |
View extract_cit.py
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/usr/bin/env python3 | |
from yarp import * | |
import sys | |
if len(sys.argv) != 2: | |
sys.exit('No file specified!') | |
with open(sys.argv[1], 'rb') as hive_file: | |
hive = Registry.RegistryHive(hive_file) |