analyzeMFT | exploring digital forensics for many years | Cybersecurity library

by dkovar Python Version: 2.0.19 License: Non-SPDX

X-Ray Key Features Code Snippets Community Discussions(2)Vulnerabilities Install Support

kandi X-RAY | analyzeMFT Summary

analyzeMFT is a Python library typically used in Security, Cybersecurity applications. analyzeMFT has no bugs, it has no vulnerabilities, it has build file available and it has low support. However analyzeMFT has a Non-SPDX License. You can install using 'pip install analyzeMFT' or download it from GitHub, PyPI.

This project was my passion and my vehicle for exploring digital forensics for many years as well as a means for giving back to a community that gave me so much. Unfortunately, I am no doing forensics on Windows filesystems and am not contributing to this project anymore. If someone else wishes to adopt it, please let me know.

Support

Quality

Security

License

Reuse

Support

analyzeMFT has a low active ecosystem.

It has 322 star(s) with 101 fork(s). There are 40 watchers for this library.

It had no major release in the last 12 months.

There are 24 open issues and 14 have been closed. On average issues are closed in 46 days. There are 2 open pull requests and 0 closed requests.

It has a neutral sentiment in the developer community.

The latest version of analyzeMFT is 2.0.19

Quality

analyzeMFT has no bugs reported.

Security

analyzeMFT has no vulnerabilities reported, and its dependent libraries have no vulnerabilities reported.

License

analyzeMFT has a Non-SPDX License.

Non-SPDX licenses can be open source with a non SPDX compliant license, or non open source licenses, and you need to review them closely before use.

Reuse

analyzeMFT releases are not available. You will need to build from source code and install.

Deployable package is available in PyPI.

Build file is available. You can build the component from source.

Installation instructions, examples and code snippets are available.

Top functions reviewed by kandi - BETA

kandi has reviewed analyzeMFT and discovered the below as its top functions. This is intended to give you an instant insight into analyzeMFT implemented functionality, and help decide if they suit your requirements.

Parse a MFT record
Parse datarun string into a list of dataruns
Detect anomaly times
Decode an ATR header
Convert a MFT record to CSV format
Decode MFT record to Active flag
Decode MFT record
Decode the MFT Magic record
Process a MFT file
Calculate filepaths
Return the folder name for a record
Build filepaths
Parse little endian signed from a buffer
Parse a little endian negative signed integer
Parse the little endian signed by the buffer
Open files
Return options for MFT files
Process the MFT file
Print a hexdump of characters

Get all kandi verified functions for this library.

analyzeMFT Key Features

No Key Features are available at this moment for analyzeMFT.

analyzeMFT Examples and Code Snippets

No Code Snippets are available at this moment for analyzeMFT.

Community Discussions

Trending Discussions on analyzeMFT

Python Tkinter- method for printing not working after being called from another script

Printing the output of a script to a window in python

QUESTION

Python Tkinter- method for printing not working after being called from another script

Asked 2017-Jul-24 at 21:02

Before you say this is a duplicate or downvote, please read through. I have a class called app.py within that class there's a method called print_raw_records_screen here's the part of the class and the method

...

ANSWER

Answered 2017-Jul-24 at 19:36

From what I can see here you have a few issues causing problems.

you are importing app.py on mftsession.py instead importing mftsession.py on app.py.
You are trying to use appi.print_raw_records_screen(raw_record) on a completely different instance of the Example() class with appi = app.Example(root) remove that part all together.
It is bad practice to importing inside a function. Import at the start of each py file.

There is so many things going on in your code I had to create a Minimal, Complete, and Verifiable example example of my own to illustrate the relation between files.

Here is a simple example of how the 2 files can interact and the way I think you are trying to do things.

Here I have created a main file called app.py:

Source https://stackoverflow.com/questions/45282561

QUESTION

Printing the output of a script to a window in python

Asked 2017-Jul-24 at 14:07

I am trying to create a GUI for the analyzeMFT python program. So far this is what i have

...

ANSWER

Answered 2017-Jul-24 at 12:05

Instead of using print like you would normally use to display results to the console you can use insert() on your text box.

EDIT:

First change:

Source https://stackoverflow.com/questions/45264826

Community Discussions, Code Snippets contain sources that include Stack Exchange Network

Vulnerabilities

No vulnerabilities reported

Install analyzeMFT

You should now be able to install analyzeMFT with pip:. My original inspiration was a combination of MFT Ripper (thus the current output format) and the SANS 508.1 study guide. I couldn’t bear to read about NTFS structures again, particularly since the information didn’t "stick". I also wanted to learn Python so I figured that using it to tear apart the MFT file was a reasonably sized project. Many of the variable names are taken directly from Brian Carrier’s The Sleuth Kit. His code, plus his book "File System Forensic Analysis", was very helpful in my efforts to write this code. The output format is almost identical to Mark Menz’s MFT Ripper. His tool really inspired me to learn more about the structure of the MFT and to learn what additional information I could glean from the data. I also am getting much more interested in timeline analysis and figured that really understanding the the MFT and having a tool that could parse it might serve as a good foundation for further research in that area.

Support

For any new features, suggestions and bugs create an issue on GitHub. If you have any questions check and ask questions on community page Stack Overflow .

Find more information at: