search

simsong / bulk_extractor

This is the development tree. Production downloads are at:
https://github.com/simsong/bulk_extractor/releases
Other
1.08k stars 185 forks source link

Set filename of carved ZIP components to be the forensic path, not a monetonically increasing number #203

Closed simsong closed 3 years ago

simsong commented 3 years ago

BE 1.6 zip carver output on nps-2010-emails:

-rw-r--r--  1 simsong  staff   1312 Jan  1  1980 666749-ZIP-0-ZIP-0__Content_Types_.xml
-rw-r--r--  1 simsong  staff    995 Jan  1  1980 666749-ZIP-1731-ZIP-0_word__rels_document.xml.rels
-rw-r--r--  1 simsong  staff   1333 Jan  1  1980 666749-ZIP-2355-ZIP-0_word_document.xml
-rw-r--r--  1 simsong  staff   6992 Jan  1  1980 666749-ZIP-2979-ZIP-0_word_theme_theme1.xml
-rw-r--r--  1 simsong  staff   1558 Jan  1  1980 666749-ZIP-4716-ZIP-0_word_settings.xml
-rw-r--r--  1 simsong  staff   1031 Jan  1  1980 666749-ZIP-5452-ZIP-0_word_fontTable.xml
-rw-r--r--  1 simsong  staff    260 Jan  1  1980 666749-ZIP-5880-ZIP-0_word_webSettings.xml
-rw-r--r--  1 simsong  staff    712 Jan  1  1980 666749-ZIP-6117-ZIP-0_docProps_app.xml
-rw-r--r--  1 simsong  staff    765 Jan  1  1980 666749-ZIP-6799-ZIP-0_docProps_core.xml
-rw-r--r--  1 simsong  staff  15125 Jan  1  1980 666749-ZIP-7493-ZIP-0_word_styles.xml
-rw-r--r--  1 simsong  staff    590 Jan  1  1980 666749-ZIP-927-ZIP-0__rels_.rels
...

BE 2.0 zip carver output:

-rw-r--r--  1 simsong  staff      540 Jan  2  1980 00000000_[Content_Types].xml
-rw-r--r--  1 simsong  staff      310 Jan  2  1980 00000001__rels_.rels
-rw-r--r--  1 simsong  staff      138 Jul 11 17:57 00000002_theme_theme_themeManager.xml
-rw-r--r--  1 simsong  staff     7559 Jul 11 17:57 00000003_theme_theme_theme1.xml
-rw-r--r--  1 simsong  staff      283 Jul 11 17:57 00000004_theme_theme__rels_themeManager.xml.rels
-rw-r--r--  1 simsong  staff     1364 Jan  2  1980 00000005_[Content_Types].xml
-rw-r--r--  1 simsong  staff      735 Jan  2  1980 00000006__rels_.rels
-rw-r--r--  1 simsong  staff      993 Jul 11 17:57 00000007_word__rels_document.xml.rels
-rw-r--r--  1 simsong  staff     1543 Jan  2  1980 00000008_word_document.xml
-rw-r--r--  1 simsong  staff     1683 Jan  2  1980 00000009_word_settings.xml
-rw-r--r--  1 simsong  staff     1359 Jan  2  1980 00000010_word_fontTable.xml
-rw-r--r--  1 simsong  staff      276 Jan  2  1980 00000011_word_webSettings.xml
-rw-r--r--  1 simsong  staff      726 Jan  2  1980 00000012_docProps_core.xml

The forensic path in the filename is more useful. I'm not sure why I lost this functionality, but it needs to be restored.

simsong commented 3 years ago

fixed:

(base) simsong@nimi bulk_extractor % ls -l  out-ubnist1/zip/000                                                                    (slg-dev)bulk_extractor
total 7856
-rw-r--r--  1 simsong  staff   15824 Feb  8  1987 1083312640-ZIP-0_[Content_Types].xml
-rw-r--r--  1 simsong  staff     737 Feb  8  1987 1083314528-ZIP-0__rels_.rels
-rw-r--r--  1 simsong  staff    5934 Aug 15 20:21 1083315350-ZIP-0_ppt_drawings_drawing1.xml
-rw-r--r--  1 simsong  staff     582 Aug 15 20:21 1083316481-ZIP-0_ppt_slides__rels_slide14.xml.rels
-rw-r--r--  1 simsong  staff     599 Aug 15 20:21 1083316772-ZIP-0_ppt_slides__rels_slide12.xml.rels
-rw-r--r--  1 simsong  staff     312 Aug 15 20:21 1083317077-ZIP-0_ppt_slides__rels_slide15.xml.rels
-rw-r--r--  1 simsong  staff     463 Aug 15 20:21 1083317851-ZIP-0_ppt_slides__rels_slide11.xml.rels
-rw-r--r--  1 simsong  staff     447 Aug 15 20:21 1083318647-ZIP-0_ppt_slides__rels_slide16.xml.rels
-rw-r--r--  1 simsong  staff     597 Aug 15 20:21 1083318928-ZIP-0_ppt_slides__rels_slide9.xml.rels
-rw-r--r--  1 simsong  staff     312 Aug 15 20:21 1083319229-ZIP-0_ppt_slides__rels_slide20.xml.rels
-rw-r--r--  1 simsong  staff    7114 Aug 15 20:21 1083319487-ZIP-0_ppt__rels_presentation.xml.rels
-rw-r--r--  1 simsong  staff     597 Aug 15 20:21 1083320432-ZIP-0_ppt_slides__rels_slide1.xml.rels
-rw-r--r--  1 simsong  staff     462 Aug 15 20:21 1083320733-ZIP-0_ppt_slides__rels_slide2.xml.rels
-rw-r--r--  1 simsong  staff     462 Aug 15 20:21 1083321010-ZIP-0_ppt_slides__rels_slide3.xml.rels
...