bodyfile

README

bodyfile

bodyfile is a Golang library used to parse and process bodyfile that can be generated by various tools like list_mft.py, regrippy and so on (mostly Forensics tools).

This library was built to support timeliner, an enhanced mactime-like.

Documentation

Index

• Constants
• type Entry
• type Reader
  • func NewReader(r io.Reader) *Reader
  • func NewStrictReader(r io.Reader) *Reader
  • func (r *Reader) AddFilter(filter string) (err error)
  • func (r *Reader) Match(entry *Entry) (bool, error)
  • func (r *Reader) Next() (*TimeStampedEntry, error)
  • func (r *Reader) Read() (*Entry, error)
  • func (r *Reader) Slurp() (int, error)
• type TimeStampedEntry

Constants

const (
	AccessTime = 1 << iota
	ModificationTime
	ChangeTime
	CreationTime
)

These constants are used as a bitmap in Entry.MatchingTimestamps, it is useful to know which timestamp matched the filter.

Types

type Entry

type Entry struct {
	// MD5|name|inode|mode_as_string|UID|GID|size|atime|mtime|ctime|crtime
	MD5              string
	Name             string
	Inode            string
	Mode             string
	UID              int
	GID              int
	Size             int64
	AccessTime       time.Time
	ModificationTime time.Time
	ChangeTime       time.Time
	CreationTime     time.Time

	MatchingTimestamp int
}

Entry represents one line of the bodyfile

type Reader

type Reader struct {
	Strict bool
	// contains filtered or unexported fields
}

Reader is the reading object

func NewReader

func NewReader(r io.Reader) *Reader

NewReader instantiates a Reader object

func NewStrictReader

func NewStrictReader(r io.Reader) *Reader

NewStrictReader instantiates a new Reader object with the Strict mode enabled

func (*Reader) AddFilter

func (r *Reader) AddFilter(filter string) (err error)

AddFilter adds a date restriction to filter the bodyfile

func (*Reader) Match

func (r *Reader) Match(entry *Entry) (bool, error)

Match filters the events

func (*Reader) Next

func (r *Reader) Next() (*TimeStampedEntry, error)

Next returns the next sorted elements

func (*Reader) Read

func (r *Reader) Read() (*Entry, error)

Read consumes CSV objects, instantiates them to Entry objects and applies filter

func (*Reader) Slurp

func (r *Reader) Slurp() (int, error)

Slurp reads all the content of the file in memory, filter out the non-matching events

type TimeStampedEntry

type TimeStampedEntry struct {
	Time  time.Time
	Entry *Entry
}

TimeStampedEntry is a wrapper around Entry to add an outer timestamp used for the sorted array