search

orlikoski / CDQR

The Cold Disk Quick Response (CDQR) tool is a fast and easy to use forensic artifact parsing tool that works on disk images, mounted drives and extracted artifacts from Windows, Linux, MacOS, and Android devices
GNU General Public License v3.0
332 stars 51 forks source link

Unknown parser or plugin names in element(s): "bash" #54

Closed nannib closed 4 years ago

nannib commented 4 years ago

Hi, I have log2timeline plaso - log2timeline version 20190916 and CDQR 5.1.0 in Ubuntu 18.04 I got this error: 2019-10-29 10:27:14,880 [ERROR] (MainProcess) PID:2845 Unknown parser or plugin names in element(s): "bash" of parser filter expression: bash,bencode,binary_cookies,chrome_cache,chrome_preferences,czip,esedb,esedb/msie_webcache,filestat,firefox_cache,java_idx,lnk,mcafee_protection,msiecf,olecf,opera_global,opera_typed_history,pe,plist/safari_history,prefetch,recycle_bin,recycle_bin_info2,sccm,sophos_av,sqlite,sqlite/chrome_27_history,sqlite/chrome_8_history,sqlite/chrome_autofill,sqlite/chrome_cookies,sqlite/chrome_extension_activity,sqlite/firefox_cookies,sqlite/firefox_downloads,sqlite/firefox_history,symantec_scanlog,winevt,winevtx,winfirewall,winjob,winreg,zsh_extended_history

when I launch: ./cdqr.py disk.dd

orlikoski commented 4 years ago

CDQR 5.1.0 hasn't been tested with Plaso 20190916 and that error is due to a parser name that isn't supported inside of Plaso. Something probably changed with Plaso between the versions that is causing it to error in that way. Try using the Plaso v20190708 as that is the version 5.1.0 supports

nannib commented 4 years ago

If you are thinking to release a compatible version of CDQR, I could wait ;-)

orlikoski commented 4 years ago

I do not have any plans to write a new version myself. Please see more details in my Open Letter to the users of Skadi, CyLR, and CDQR