(May 17, 2017 12:35 PM)Goodies Wrote:  It'd be nice to see these be modular and actually exist inside of an idiomatically-designed framework.

Aside from that, after looking it over for a few minutes, I'd be surprised if all of these scripts ran. I see some indentation issue like here: https://github.com/MonroCoury/Forensic-Tools/blob/master/common_methods.py#L39

Also, in that same function, do not call sys.exit from inside your function. Functions should often return statuses if they're not going to return values. If the file exists, raise the exception! The caller should be performing the error handling.

You should also be using context managers more than you are. Some of this code, if it fails, will never close certain objects properly as they are not in context managers and have no finally clause on their try/except statements.

This was just a couple things I saw in the first script I looked at. I'm guessing the hundreds of other SLOC were done in a similar fashion. I'm also guessing that you primarily just want to get pen to paper and get a working POC, not trying to perfect your source.

All in all, I really like the idea of a modular forensics framework/toolkit that will perform commonly employed forensic techniques (file signature analysis, integrity checking, etc), but the presentation of it is just as important if you want it in widespread use. I'd recommend making a nice CLI interface. You can use metasploit or w3af as examples. Something where you can load modules and execute them with parameters.

Ideally, you'd be able to provide your own modules fairly simply.