prefetch.py updated/enhanced

[PoorBillionaire]

Greetings--

Recently I refactored prefetch.py and added some things, which accomplished the following:

• Added CSV support
• Extended the support for sorting a directory of Prefetch files by last execution time. The script now extracts all execution timestamps (up to 8 in type 26 and 30), and includes them in the sort as well. This provides a more comprehensive view of application execution than sorting by most recent execution time only
• Left the Prefetch hash values in output to avoid confusion with duplicate executable names
• Shedded bloat: The script is 400+ lines shorter

Both my GitHub account and the script hosted on PyPI feature the latest update, and I'm hoping to get this improved iteration into SIFT.

If it is possible to get the updated version merged in, I'm not sure what the workflow looks like, or how that's handled. I glanced at the boostrap script, and it's not being installed via PyPI yet. I'm assuming it's being installed at line 482 when this is executed:

git clone --recursive https://github.com/sans-dfir/sift-files

Any guidance you can give on this would be appreciated. I have done testing, and it's stable.

Thanks!

Adam

[ekristen]

@PoorBillionaire if your stuff is ready via PyPi, lets remove it from sift-files and get it into the bootstrap script. Pull Requests to that end are greatly encouraged.

[PoorBillionaire]

Thanks Erik - I'll get that done at some point tonight.

[ekristen]

Perfect.