The ArtifactExtractor class raises an exception if the subclass does not implement the process_fs_object function.
However, it is necessary that ArtifactExtractor classes have certain attributes for recurse_files to work.
starting_path - A String that specifies paths to recurse into in the case of the module, can be empty if we want to recurse into the entire disk (for the RegistryExtractor for instance, we want to go into Windows/System32/config but not anywhere else).
Extra: Make sure this path is always valid and lowercase.
Another issue specifies that this should perhaps be a list of paths in the future. Empty string for recursing through the entire disk.
processable_file_names - A List of lowercase file names to call process_fs_object on, empty to process all of them.
processable_directories - A List of lowercase directory names to call process_fs_object on, empty to process all of them.
The ArtifactExtractor class raises an exception if the subclass does not implement the
process_fs_object
function. However, it is necessary that ArtifactExtractor classes have certain attributes forrecurse_files
to work.starting_path
- A String that specifies paths to recurse into in the case of the module, can be empty if we want to recurse into the entire disk (for the RegistryExtractor for instance, we want to go into Windows/System32/config but not anywhere else).Extra: Make sure this path is always valid and lowercase.
Another issue specifies that this should perhaps be a list of paths in the future. Empty string for recursing through the entire disk.
processable_file_names
- A List of lowercase file names to callprocess_fs_object
on, empty to process all of them.processable_directories
- A List of lowercase directory names to callprocess_fs_object
on, empty to process all of them.https://github.com/CTM1/win_ewf_extract/blob/main/modules/artifact_extraction.py#L4