search

MarkBaggett / srum-dump

A forensics tool to convert the data in the Windows srum (System Resource Usage Monitor) database to an xlsx spreadsheet.
GNU General Public License v3.0
594 stars 97 forks source link

Output path for srum_dump_csv #13

Closed Beercow closed 5 years ago

Beercow commented 5 years ago

Could you add an output path like there is in srum_dump? This will be helpful for adding a module to KAPE.

MarkBaggett commented 5 years ago

The option has been added to the CSV version. You can specify the output path to which all the CSV files will be written with -o or --OUT_PATH

$ python3 srum_dump_csv.py -h usage: srum_dump_csv.py [-h] [--SRUM_INFILE SRUM_INFILE] [--XLSX_TEMPLATE XLSX_TEMPLATE] [--REG_HIVE REGHIVE] [--OUT_PATH OUT_PATH] [--quiet]

Given an SRUM database it will create an XLS spreadsheet with analysis of the data in the database.

optional arguments: -h, --help show this help message and exit --SRUM_INFILE SRUM_INFILE, -i SRUM_INFILE Specify the ESE (.dat) file to analyze. Provide a valid path to the file. --XLSX_TEMPLATE XLSX_TEMPLATE, -t XLSX_TEMPLATE The Excel Template that specifies what data to extract from the srum database. You can create templates with ese_template.py. --REG_HIVE REGHIVE, -r REGHIVE If a registry hive is provided then the names of the network profiles will be resolved. --OUT_PATH OUT_PATH, -o OUT_PATH Directory to which the file will be written. --quiet, -q Supress unneeded output messages.

I've done testing on the new feature and it appears to work properly on both Windows and Linux. If this doesn't do what you need let me know. If it works properly please close the ticket. If I don't hear anything more I'll close the ticket eventually.

Beercow commented 5 years ago

Thanks for adding this back. Will test tomorrow and make a module to run it through KAPE (as long as no one else beats me to it).

Beercow commented 5 years ago

Thank you for the prompt update. Everything works.