Python信息取证

注册表mac地址取证

管理员身份运行

from winreg import *
import re

def vlal2addr(val): 
	addr = ""
	i = 1
	for ch in val:
		ret = re.match(r"^0x(\w*)",hex(ch))
		addr += ret.group(1)
		if i < 6:
		  addr += ":"
		i +=1
	return addr

def printNets():
	net = r"SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Unmanaged"
	key = OpenKey(HKEY_LOCAL_MACHINE,net)
	print("Networks You are join")
	for i in range(100):
		try:
			guid = EnumKey(key,i)
			netkey = OpenKey(key,str(guid))
			(n,addr,t) = EnumValue(netkey,5)
			(n,name,t) = EnumValue(netkey,4)
			if addr == None:
				continue
			macaddr = vlal2addr(addr)
			print(str(name)+"的MAC地址是:  "+macaddr)
			CloseKey(netkey)
		except:
	 		break

if __name__ == '__main__':
	printNets()

回收站取证

管理员身份运行

#管理员身份运行
import os
from winreg import *


def returndir():
    wenjian = ["c:\\recycler\\","c:\\recycled\\","c:\\$Recycle.Bin\\"]
    for i in wenjian:
        if os.path.isdir(i):
            print("存在："+i)
            return i
    return None




def sid2user(sid):
    net = r"SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList"+'\\'+sid
    try:
        Key = OpenKey(HKEY_LOCAL_MACHINE,net)
                
        (value,type) = QueryValueEx(Key,'ProfileImagePath') #查找ProfileImagePath的值
       
        #print(value)
        user = value.split('\\')[-1]
        #print(user)
        #print(type)
        return user
    except:
        pass
        

def find(recy):
    dirlist = os.listdir(recy)	#把文件下的文件名添加到列表
    #print(dirlist)
    for i in dirlist:
        
        files = os.listdir(recy + i)
        user = sid2user(i)
        #print(i)
        print("user is :" + str(user))
        for file in files:
            print("found : " +file)
            

if __name__ == '__main__':
	recy = returndir()
	find(recy)

pdf取证

import PyPDF2
from PyPDF2 import PdfFileReader

def printMeta(filename):
    pdffile = PdfFileReader(filename,"rb") #创建一个PdfFileReader类
    docinfo = pdffile.getDocumentInfo() #调用类里的getDocumentInfo方法
    for i in docinfo:
        print(i+':'+docinfo[i])

if __name__ == '__main__':
	printMeta('/root/桌面/a.pdf')  #填写Pdf文件路径

照片GPS取证

import exifread
import re



def main(imagename):
    f = open(imagename,"rb")
    tags = exifread.process_file(f)
    #print(tags)
    GPS = {}
    for tag , value in tags.items():
        if "GPS GPSLatitude" in tag:
            GPS['纬度'] = str(tags['GPS GPSLatitude'])
        elif "GPS GPSLongitude" in tag:
            GPS['经度'] = str(value)
        elif "Image DateTime" in tag:
            GPS['时间'] = str(value)
    print(GPS)
    
if __name__ == "__main__":
    main('/root/桌面/c.jpg')