silv3rhorn / artifactextractor

Extract common Windows artifacts from source images and VSCs

artifactextractor's Issues

Error when no vss is chosen

If you elect not to enter a value for vss with the compiled EXE you get the following error:

Traceback (most recent call last):
File "artifact_extractor.py", line 309, in
File "artifact_extractor.py", line 284, in main
File "dfvfs\helpers\volume_scanner.pyc", line 387, in GetBasePathSpecs
File "dfvfs\helpers\volume_scanner.pyc", line 211, in _ScanVolume
File "dfvfs\helpers\volume_scanner.pyc", line 247, in _ScanVolumeScanNode
File "dfvfs\helpers\volume_scanner.pyc", line 304, in _ScanVolumeScanNodeVSS
AttributeError: 'str' object has no attribute 'reverse'

Is this something to be checked in the source or perhaps on my end?

UnicodeEncodeError

Hi,

I run the extractor against a windows 7 ultimate system and encountered the following errors:

UnicodeEncodeError: 'ascii' codec can't encode characters in position 125-128: ordinal not in range(128)

The registry and ntuser files are not extracted after I ran them. Not sure if you encountered the same issue as well. Just curious, if there are more then one partitions on the system (e.g. C, D and E), does the extractor extract the $J from these 3 partitions?

I hope this helps. Thank you.

support for XP

would be great if you could also support win xp

Does not support certain VMDKs

To reproduce the issue

• Merge multiple VMDKs into a single VMDK with vmware-vdiskmanager.exe
• Run ArtifactExtractor on the merged VMDK file

Preserve timestamps of extracted lnk files

As per subject

additional artifacts

just curious, are you able to extract UsnJrnl:J and files that exists in Recycle Bin?

Add support for extraction of registry transaction logs

As per title

extracted output will be similar to host directory

I was thinking if you would be able to amend the extracted output to be stored as such, it will be good! for example,

HOSTNAME/C
HOSTNAME/C/Windows/System32/config/SOFTWARE
HOSTNAME/C/Windows/System32/config/SYSTEM
HOSTNAME/C/Windows/System32/config/SAM
HOSTNAME/C/Windows/System32/config/SECURITY
HOSTNAME/C/Windows/System32/winevt/Logs/Security.evtx
HOSTNAME/C/Windows/System32/winevt/Logs/Application.evtx
HOSTNAME/C/Windows/inf/setupapi.log
HOSTNAME/C/Windows/inf/setupapi.dev.log

need your input on this. Thank you.