Forensics
Forensics copied to clipboard
Scripts and code referenced in CrowdStrike blog posts
I am getting the following errors while executing. I have made changes in the script for line 97 to 100 since the .core_analytics files are now located in the Retired...
Got an exception when running coreAnalyticsParser.py as sudo on local disk on macOS 10.13. ` [+] Found 4 .core_analytics files to parse. [+] Found 3 aggregate files to parse. Traceback...
I receive the following error occasionally. Traceback (most recent call last): File "C:\Users\REDACTED\Documents\ForensicTools\UAL analyzer\Forensics-master\ual-analyzer\ual-analyzer.py", line 30, in for row in reader: File "C:\Users\REDACTED\AppData\Local\Programs\Python\Python37-32\lib\csv.py", line 112, in __next__ row = next(self.reader)...
from `ual-analyzer` and `ual-analyzer/plugins` packages cannot initialize.
Hello! I am currently operating on Mac OS 10.13.6. The .core_analytics files are now located in the Retired folder of Diagnostic Reports. I have implemented the following changes to lines...
Use "which" to determine path to vol.py, volatility, and bulk_extractor instead of hard-coded path. Closes CrowdStrike#1. Yes, I accidentally created a pull request against my own fork at first. I...