davehull

[CmdletBinding()]
Param(
[Parameter(Mandatory=$True,Position=0)]
    [String]$GUID
)

function Resolve-KnownFolderGuid {
Param(
[Parameter(Mandatory=$True,Position=0)]
    [String]$GUID

davehull

Takes the unsorted Python dictionary of file system metadata created by 
git://gist.github.com/1463512.git and converts it to a sorted list of dictionaries containing
files and their metadata elements.

def get_meta_by_dir(dictionary):
    # Sort the dictionary, return a list of dictionaries
    items = [(pname, fname) for pname, fname in dictionary.items()]
    items.sort()
    return items

davehull

Give this method the output of git://gist.github.com/1464048.git and it will go through the list
and calculate the distribution of uids on a per directory basis. It could be easily modified to do
the same for gids and permissions.

This may be useful to find malicious files in a file system that have unusual uids, say for instance
in a directory like /usr/lib where everything is normally uid 0, an attacker may have an archive that
drops files in the directory with different uids. Yes, I've seen this before.

def get_uid_freq_by_dir(items):
    for path_name, file_name in items:

davehull

def get_meta(bodyfile):
    fname_skip_cnt = bad_line = total_lines = 0
    meta = {}

    fi = open(bodyfile, 'rb')
    for line in fi:
        total_lines += 1
        try:
            md5,ppath,inode,mode,uid,gid,size,atime,mtime,ctime,crtime = line.rstrip().split("|")
        except:

davehull

#!/usr/bin/env python
#
# script name: meta-outliers.py
# 
# In the spirit of release early, release often, here's a script
# that's part of a larger project I'm working on.
#
# What does it do?
# Parses the output from the Sleuth Kit's fls command.
# More specifically fls -arp run against a disk image or dev.

davehull

#!/bin/bash

# determines number of proccessors, splits a large file into sizes that 
# can be consumed by n-1 sort processes (where n is the number of processors)
#
# After the file has been split up properly, it will run a sort on each split
# file in parallel. Once all processes have completed, a merge sort is executed.
#
# mthomas@n2o:~/words [100%] $ du -h big
# 1.7G	big