Learning Python for Forensics
上QQ阅读APP看书,第一时间看更新

Adding to the parse_setup_api() function

This function has minor modifications that are focused on storing unique entries from the log file. We created a new variable named unique_list that is a set data type on line 76. Recall that a set must consist of hashable and unique elements, making it a perfect fit for this solution. Though it seems duplicative to have a list and set holding similar data, for simplicity of comparison and demonstration, we have created the second variable:

068 def parse_setupapi(setup_log):
069 """
070 Read data from provided file for Device Install Events for
071 USB Devices
072 :param setup_log: str - Path to valid setup api log
073 :return: tuple of str - Device name and date
074 """
075 device_list = list()
076 unique_list = set()
077 with open(setup_log) as in_file:
078 for line in in_file:

On line 79, we convert the line into lowercase to ensure that our comparisons are case-insensitive. At this point, we use the same logic to process the device_name and date values on lines 83 through 84. We have moved the code from the second iteration, which verified the device type, into our new parse_device_info() function:

079         lower_line = line.lower()
080 if 'device install (hardware initiated)' in \
081 lower_line and ('vid' in lower_line or
082 'ven' in lower_line):
083 device_name = line.split('-')[1].strip()
084 date = next(in_file).split('start')[1].strip()

Before we store the device_name and date information in our device_list, we check to ensure that the device_name does not already exist in our unique_list. If it doesn't, we add the tuple on line 86, which contains the device_name and date. Afterward, we prevent that same device from being processed again by adding the entry to our unique_list. On line 89, we return our built list of tuples for the next stage of processing:

085             if device_name not in unique_list:
086 device_list.append((device_name, date))
087 unique_list.add(device_name)
088
089 return device_list