diff --git a/config/dpkg/changelog b/config/dpkg/changelog index e0a46281c6..d9d18b7466 100644 --- a/config/dpkg/changelog +++ b/config/dpkg/changelog @@ -2,4 +2,4 @@ python-plaso (1.3.0-1) unstable; urgency=low * Auto-generated - -- Log2Timeline Wed, 10 Jun 2015 10:01:09 +0200 + -- Log2Timeline diff --git a/config/macosx/Readme.txt b/config/macosx/Readme.txt index c5daceb3e1..8724681df4 100644 --- a/config/macosx/Readme.txt +++ b/config/macosx/Readme.txt @@ -9,6 +9,7 @@ be installed and work as it should. What the installer does is to install all dependencies to plaso as well as plaso and dfvfs as separate packages. -More documentation: http://plaso.kiddaland.net +More documentation: https://github.com/log2timeline/plaso/wiki +Build instructions: https://github.com/log2timeline/plaso/wiki/Development-release-Mac-OS-X Questions/comments/thoughts? send them to log2timeline-discuss@googlegroups.com diff --git a/config/macosx/install.sh.in b/config/macosx/install.sh.in index af7e17bfbd..cf918bb9e2 100755 --- a/config/macosx/install.sh.in +++ b/config/macosx/install.sh.in @@ -52,5 +52,16 @@ find ${VOLUME_NAME} -name "*.pkg" -exec sudo installer -target / -pkg {} \; echo "Done."; +# Check for the existence of two versions of the pyparsing module. +if test -f "/System/Library/Frameworks/Python.framework/Versions/2.7/Extras/lib/python/pyparsing.pyc"; +then + if test -f "/Library/Python/2.7/site-packages/pyparsing.py"; + then + echo "Two versions of the pyparsing module exist. Deleting the system provided one."; + # Removing the pyparsing library, including the .py, .pyc and .pyo file if they exist. + /bin/rm -rf "/System/Library/Frameworks/Python.framework/Versions/2.7/Extras/lib/python/pyparsing.*" + fi +fi + exit ${EXIT_SUCCESS}; diff --git a/config/macosx/make_dist.sh b/config/macosx/make_dist.sh index 16dd3e4f25..51ed61d424 100755 --- a/config/macosx/make_dist.sh +++ b/config/macosx/make_dist.sh @@ -49,7 +49,7 @@ rm -rf build dist ${DISTDIR} ../${PKG_FILENAME} ../plaso-${PLASO_VERSION}_macosx python setup.py bdist -mkdir dist/tmp +mkdir -p dist/tmp cd dist/tmp tar xfvz ../*.tar.gz cd ../.. diff --git a/plaso/cli/storage_media_tool.py b/plaso/cli/storage_media_tool.py index 16a4669acc..7b95e40558 100644 --- a/plaso/cli/storage_media_tool.py +++ b/plaso/cli/storage_media_tool.py @@ -41,7 +41,7 @@ def __init__(self, input_reader=None, output_writer=None): input_reader=input_reader, output_writer=output_writer) self._filter_file = None # TODO: refactor to partitions. - self._partition_number = None + self._partition_string = None self._partition_offset = None self._process_vss = False # TODO: refactor to front-end. @@ -90,7 +90,7 @@ def _FormatHumanReadableSize(self, size): # TODO: refactor this method that it become more clear what it is # supposed to do. def _GetTSKPartitionIdentifiers( - self, scan_node, partition_number=None, partition_offset=None): + self, scan_node, partition_string=None, partition_offset=None): """Determines the TSK partition identifiers. This method first checks for the preferred partition number, then for @@ -99,8 +99,8 @@ def _GetTSKPartitionIdentifiers( Args: scan_node: the scan node (instance of dfvfs.ScanNode). - partition_number: Optional preferred partition number. The default is - None. + partition_string: Optional preferred partition number string. The default + is None. partition_offset: Optional preferred partition byte offset. The default is None. @@ -126,15 +126,25 @@ def _GetTSKPartitionIdentifiers( logging.info(u'No partitions found.') return - if partition_number == u'all': + if partition_string == u'all': + return volume_identifiers + + if partition_string is not None and not partition_string.startswith(u'p'): return volume_identifiers + partition_number = None + if partition_string: + try: + partition_number = int(partition_string[1:], 10) + except ValueError: + pass + if partition_number is not None and partition_number > 0: # Plaso uses partition numbers starting with 1 while dfvfs expects # the volume index to start with 0. volume = volume_system.GetVolumeByIndex(partition_number - 1) if volume: - return [partition_number - 1] + return [u'p{0:d}'.format(partition_number)] logging.warning(u'No such partition: {0:d}.'.format(partition_number)) @@ -233,17 +243,18 @@ def _ParseStorageMediaImageOptions(self, options): Raises: BadConfigOption: if the options are invalid. """ - self._partition_number = getattr(options, u'partition_number', None) - if self._partition_number not in [None, u'all']: - if not isinstance(self._partition_number, basestring): + self._partition_string = getattr(options, u'partition_number', None) + if self._partition_string not in [None, u'all']: + if not isinstance(self._partition_string, basestring): raise errors.BadConfigOption( u'Invalid partition number {0!s}.'.format( - self._partition_number)) + self._partition_string)) try: - self._partition_number = int(self._partition_number, 10) + partition_number = int(self._partition_string, 10) + self._partition_string = u'p{0:d}'.format(partition_number) except ValueError: raise errors.BadConfigOption( - u'Invalid partition number: {0:s}.'.format(self._partition_number)) + u'Invalid partition number: {0:s}.'.format(self._partition_string)) self._partition_offset = getattr(options, u'image_offset_bytes', None) if (self._partition_offset is not None and @@ -549,12 +560,12 @@ def _ScanVolume(self, volume_scan_node): parent=sub_scan_node.path_spec) self._source_path_specs.append(path_spec) - # TODO: move the TSK current volume scan node to the same level as - # the VSS scan node. - for sub_scan_node in scan_node.sub_nodes: - if sub_scan_node.type_indicator == ( - dfvfs_definitions.TYPE_INDICATOR_TSK): - self._source_path_specs.append(sub_scan_node.path_spec) + # TODO: move the TSK current volume scan node to the same level as + # the VSS scan node. + for sub_scan_node in scan_node.sub_nodes: + if sub_scan_node.type_indicator == ( + dfvfs_definitions.TYPE_INDICATOR_TSK): + self._source_path_specs.append(sub_scan_node.path_spec) # TODO: replace check with dfvfs_definitions.FILE_SYSTEM_TYPE_INDICATORS. elif scan_node.type_indicator == dfvfs_definitions.TYPE_INDICATOR_TSK: @@ -713,7 +724,7 @@ def ScanSource(self, front_end): partition_identifiers = None else: partition_identifiers = self._GetTSKPartitionIdentifiers( - scan_node, partition_number=self._partition_number, + scan_node, partition_string=self._partition_string, partition_offset=self._partition_offset) if not partition_identifiers: