tommy/dfdewey
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Updates for bulk_extractor v2.0.3 (#33)

Browse source 
Slight change to command line arguments for bulk_extractor v2
This commit is contained in:
Jason 2023-10-16 11:29:26 +11:00 committed by GitHub
parent 5da497d49c
commit 4ce3ab9872
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
README.md
View file

@ -20,7 +20,7 @@ sudo apt install -y bulk-extractor
bulk_extractor can also be downloaded and built from source here: bulk_extractor can also be downloaded and built from source here:
https://github.com/simsong/bulk_extractor https://github.com/simsong/bulk_extractor
Note: bulk_extractor v1.6.0 is recommended (v2.0.0 is not yet supported). Note: bulk_extractor v2.0.3 or greater is required.
### dfVFS ### dfVFS
[dfVFS](https://github.com/log2timeline/dfvfs) is required for image parsing. It [dfVFS](https://github.com/log2timeline/dfvfs) is required for image parsing. It

2
dfdewey/utils/image_processor.py
View file

@ -415,7 +415,7 @@ class ImageProcessor():
if self.options.unzip: if self.options.unzip:
cmd.extend(['-e', 'zip']) cmd.extend(['-e', 'zip'])
cmd.extend(['-S', 'strings=YES', '-S', 'word_max=1000000']) cmd.extend(['-S', 'strings=1', '-S', 'word_max=1000000'])
cmd.append(self.image_path) cmd.append(self.image_path)
log.info('Running bulk_extractor: [%s]', ' '.join(cmd)) log.info('Running bulk_extractor: [%s]', ' '.join(cmd))

4
dfdewey/utils/image_processor_test.py
View file

@ -169,7 +169,7 @@ class ImageProcessorTest(unittest.TestCase):
mock_subprocess.assert_called_once_with([ mock_subprocess.assert_called_once_with([
'bulk_extractor', '-o', '/tmp/tmpxaemz75r', '-x', 'all', '-e', 'bulk_extractor', '-o', '/tmp/tmpxaemz75r', '-x', 'all', '-e',
'wordlist', '-e', 'base64', '-e', 'gzip', '-e', 'zip', '-S', 'wordlist', '-e', 'base64', '-e', 'gzip', '-e', 'zip', '-S',
'strings=YES', '-S', 'word_max=1000000', TEST_IMAGE 'strings=1', '-S', 'word_max=1000000', TEST_IMAGE
]) ])
# Test options # Test options
@ -180,7 +180,7 @@ class ImageProcessorTest(unittest.TestCase):
image_processor._extract_strings() image_processor._extract_strings()
mock_subprocess.assert_called_once_with([ mock_subprocess.assert_called_once_with([
'bulk_extractor', '-o', '/tmp/tmpxaemz75r', '-x', 'all', '-e', 'bulk_extractor', '-o', '/tmp/tmpxaemz75r', '-x', 'all', '-e',
'wordlist', '-S', 'strings=YES', '-S', 'word_max=1000000', TEST_IMAGE 'wordlist', '-S', 'strings=1', '-S', 'word_max=1000000', TEST_IMAGE
]) ])
# Test error in processing # Test error in processing