MarkBaggett
commented
5 years ago No. I know exactly where the error is. Thanks so much for reporting this. Sorry for the inconvenience. I’ll get this fixed.
Mark
On Jul 22, 2019, at 9:26 AM, johnmccash notifications@github.com wrote:
I get the following error when running srum_dump_csv:
C:\Software\srum-dump>srum_dump_csv What is the path to the SRUDB.DAT file? (Ex: \image-mount-point\Windows\system32\sru\srudb.dat) : E:\DFIRNW-19.2\endpoint\windows\vanko-c-drive\vanko-c-drive.CYLR\G\Windows\System32\sru\SRUDB.dat What XLS Template should I use? (Press enter for the default SRUM_TEMPLATE.XLSX) : What is the full path of the SOFTWARE registry hive? Usually \image-mount-point\Windows\System32\config\SOFTWARE (or press enter to skip Network resolution) : E:\DFIRNW-19.2\endpoint\windows\vanko-c-drive\vanko-c-drive.CYLR\G\Windows\System32\config\SOFTWARE
Creating CSV for Network Usage While you wait, did you know ... Check out SANS Automating Infosec with Python SEC573 to learn to write program like this on your own.
Finished processing Network Usage. Writing Output File.
Creating CSV for Application Resource Usage While you wait, did you know ... To learn how SRUM and other artifacts can enhance your forensics investigations check out SANS Windows Forensics FOR500/408
Finished processing Application Resource Usage. Writing Output File.
Creating CSV for Network Connections While you wait, did you know ... This program uses the function BinarySIDtoStringSID from the GRR code base to convert binary data into a user SID and relies heavily on the CoreSecurity Impacket ESE module. This works because of them. Check them out!
Finished processing Network Connections. Writing Output File.
Creating CSV for Push Notification Data While you wait, did you know ... Yogesh Khatri's paper at https://files.sans.org/summit/Digital_Forensics_and_Incident_Response_Summit_2015/PDFs/Windows8SRUMForensicsYogeshKhatri.pdf was essential in the creation of this tool.
Finished processing Push Notification Data. Writing Output File.
Creating CSV for Energy Usage (Long Term) While you wait, did you know ... By modifying the template file you have control of what ends up in the analyzed results. Try creating an alternate template and passing it with the --XLSX_TEMPLATE option.
Finished processing Energy Usage (Long Term). Writing Output File.
Creating CSV for Energy Usage While you wait, did you know ... This program was written by Twitter:@MarkBaggett and @donaldjwilliam5 because @ovie said so.
Finished processing Energy Usage. Writing Output File.
Creating CSV for Undocumented Windows 10 Table While you wait, did you know ... Check out SANS Automating Infosec with Python SEC573 to learn to write program like this on your own.
Traceback (most recent call last): File "srum_dump_csv.py", line 385, in for ese_row in ese_getnextrow(ese_table): File "srum_dump_csv.py", line 94, in ese_getnextrow current_row[reverse_column_lookup[each_column]] = smart_retrieve(ese_table, ese_row_num, each_column) File "srum_dump_csv.py", line 104, in smart_retrieve col_data = "" if not col_data else col_data.encode("HEX") AttributeError: 'bytes' object has no attribute 'encode' [13228] Failed to execute script srum_dump_csv
C:\Software\srum-dump>
Do you need a copy of the test DB & Software hive, or is the error sufficint?
Thanks John
— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.
johnmccash
I get the following error when running srum_dump_csv:
C:\Software\srum-dump>srum_dump_csv What is the path to the SRUDB.DAT file? (Ex: \image-mount-point\Windows\system32\sru\srudb.dat) : E:\DFIRNW-19.2\endpoint\windows\vanko-c-drive\vanko-c-drive.CYLR\G\Windows\System32\sru\SRUDB.dat What XLS Template should I use? (Press enter for the default SRUM_TEMPLATE.XLSX) : What is the full path of the SOFTWARE registry hive? Usually \image-mount-point\Windows\System32\config\SOFTWARE (or press enter to skip Network resolution) : E:\DFIRNW-19.2\endpoint\windows\vanko-c-drive\vanko-c-drive.CYLR\G\Windows\System32\config\SOFTWARE
Creating CSV for Network Usage While you wait, did you know ... Check out SANS Automating Infosec with Python SEC573 to learn to write program like this on your own.
Finished processing Network Usage. Writing Output File.
Creating CSV for Application Resource Usage While you wait, did you know ... To learn how SRUM and other artifacts can enhance your forensics investigations check out SANS Windows Forensics FOR500/408
Finished processing Application Resource Usage. Writing Output File.
Creating CSV for Network Connections While you wait, did you know ... This program uses the function BinarySIDtoStringSID from the GRR code base to convert binary data into a user SID and relies heavily on the CoreSecurity Impacket ESE module. This works because of them. Check them out!
Finished processing Network Connections. Writing Output File.
Creating CSV for Push Notification Data While you wait, did you know ... Yogesh Khatri's paper at https://files.sans.org/summit/Digital_Forensics_and_Incident_Response_Summit_2015/PDFs/Windows8SRUMForensicsYogeshKhatri.pdf was essential in the creation of this tool.
Finished processing Push Notification Data. Writing Output File.
Creating CSV for Energy Usage (Long Term) While you wait, did you know ... By modifying the template file you have control of what ends up in the analyzed results. Try creating an alternate template and passing it with the --XLSX_TEMPLATE option.
Finished processing Energy Usage (Long Term). Writing Output File.
Creating CSV for Energy Usage While you wait, did you know ... This program was written by Twitter:@markbaggett and @donaldjwilliam5 because @ovie said so.
Finished processing Energy Usage. Writing Output File.
Creating CSV for Undocumented Windows 10 Table While you wait, did you know ... Check out SANS Automating Infosec with Python SEC573 to learn to write program like this on your own.
Traceback (most recent call last): File "srum_dump_csv.py", line 385, in
for ese_row in ese_getnextrow(ese_table):
File "srum_dump_csv.py", line 94, in ese_getnextrow
current_row[reverse_column_lookup[each_column]] = smart_retrieve(ese_table, ese_row_num, each_column)
File "srum_dump_csv.py", line 104, in smart_retrieve
col_data = "" if not col_data else col_data.encode("HEX")
AttributeError: 'bytes' object has no attribute 'encode'
[13228] Failed to execute script srum_dump_csv
C:\Software\srum-dump>
Do you need a copy of the test DB & Software hive, or is the error sufficint?
Thanks John