Automation script development
Budget: $10 – $30 USD
Development of a Jupyter Notebook that is capable of performing the following actions:
Execute different processing options (Modules) of the KAPE tool (https://www.kroll.com/en/insights/publications/cyber/kroll-artifact-parser-extractor-kape) on a triage obtained with said tool, it is that is, a .zip file that stores a directory tree with different files.
Execute the aforementioned modules on an E01 image that needs to be mounted, for which the Arsenal-Image-Mounter-master \ Command line applications \ aim_cli.exe tool can be used.
Run the log2timeline / plaso tool (https://github.com/log2timeline/plaso) on the output of a triage obtained using KAPE, as well as a forensic image of a system in E01 format.
The idea is to be able to analyze from a single triage or disk to several, so it must be developed to choose the evidence to analyze and also think about the development for multithreading since the tools are single-threaded and allow the parallelization of jobs
Execute different processing options (Modules) of the KAPE tool (https://www.kroll.com/en/insights/publications/cyber/kroll-artifact-parser-extractor-kape) on a triage obtained with said tool, it is that is, a .zip file that stores a directory tree with different files.
Execute the aforementioned modules on an E01 image that needs to be mounted, for which the Arsenal-Image-Mounter-master \ Command line applications \ aim_cli.exe tool can be used.
Run the log2timeline / plaso tool (https://github.com/log2timeline/plaso) on the output of a triage obtained using KAPE, as well as a forensic image of a system in E01 format.
The idea is to be able to analyze from a single triage or disk to several, so it must be developed to choose the evidence to analyze and also think about the development for multithreading since the tools are single-threaded and allow the parallelization of jobs