search

PoorBillionaire / USN-Journal-Parser

Python script to parse the NTFS USN Journal
Other
107 stars 15 forks source link

Updated for Python 3, addl tweaks #14

Open digitalsleuth opened 2 years ago

digitalsleuth commented 2 years ago

Not sure if you're looking for any pull requests or assistance on this, but I was messing around with the USN Journal the other day and thought I could help bring this up to Python 3 spec.

Modified the epoch timestamp for milliseconds, added the filetime timestamp as the "timestamp" value (the hex version, as it exists on disk / in the file), removed the Python 2 future and Unicode requirements (u''), and re-ordered the JSON output to show more relevant data first (personal preference, can be reverted by removing two lines).

Added a missing Attribute (INTEGRITY_CHANGE) and did some PEP8 cleanup.

Hope this helps!

PoorBillionaire commented 2 years ago

Nice, thank you! I'll have a look at this tonight and get it merged.

PoorBillionaire commented 2 years ago

Been busy but this is still on my mind.

Adam

digitalsleuth commented 2 years ago

No worries at all, I definitely get being busy :)