def convert_windate(timestamp):
    try:
        return datetime.datetime.fromtimestamp(change_to_MKTime(timestamp)).strftime("%Y-%m-%d %H:%M:%S")
    except:
        return 0
 def dosdate(_dosdate, _dostime):
    """
    _dosdate: 2 bytes, little endian.
    _dostime: 2 bytes, little endian.
    returns: datetime.datetime or datetime.datetime.min on error
    """
    try:
        t = ord(_dosdate[1]) << 8
        t |= ord(_dosdate[0])
        day = t & 0b0000000000011111
        month = (t & 0b0000000111100000) >> 5
        year = (t & 0b1111111000000000) >> 9
        year += 1980

        t = ord(_dostime[1]) << 8
        t |= ord(_dostime[0])
        sec = t & 0b0000000000011111
        sec *= 2
        minute = (t & 0b0000011111100000) >> 5
        hour = (t & 0b1111100000000000) >> 11

        return datetime.datetime(year, month, day, hour, minute, sec)
    except:
        return datetime.datetime.min
 def get_csv_writer(csvfile):
    return UnicodeWriter(csvfile, quoting=csv.QUOTE_ALL)
 def get_json_writer(json_file):
    return UnicodeJsonDumper(json_file)
 def write_list_to_json(arr_data, json_writer):
    """Write list data in json files using UTF-8"""
    json_writer.list_to_json(arr_data)
 def write_dict_json(arr_data, json_writer):
    json_writer.dump_json(arr_data)
    json_writer.close_current()
 def write_list_to_csv(arr_data, csv_writer):
    """Writes a list"s contents to a CSV file using UTF-8"""
    csv_writer.writerows(arr_data)
 def process_hashes(path):
    content = open(path, "rb").read()
    return hashlib.md5(content).hexdigest(), hashlib.sha1(content).hexdigest(), hashlib.sha256(content).hexdigest()
 def close_json_writer(json_writer):
    json_writer.close_current()
 def record_sha256_logs(fr, fw):
    with open(fw, "a") as hash_file:
        m = process_sha256(fr)
        hash_file.write(fr + "," + m + "\n")
        hash_file.close()
 class _VSS(object):
    """
    _VSS is a singleton aimed at creating a shadow copy of the disk
    in order to access files that are locked by the system
    """

    # instances: static variable to save the current instance for each drive
    __instances = None

    @staticmethod
    def _get_instance(params, drive=os.environ['SYSTEMDRIVE']):
        if not _VSS.__instances:
            _VSS.__instances = {}
        if drive not in _VSS.__instances:
            _VSS.__instances[drive] = _VSS(params, drive + "\\")
        return _VSS.__instances[drive]

    @staticmethod
    def _close_instances():
        if _VSS.__instances:
            for instance in _VSS.__instances:
                _VSS.__instances[instance].delete()
            _VSS.__instances = None

    def __init__(self, params, volume):
        self.uid = self.create_shadow_copy(volume)
        self.sh = self.select_shadow_copy()
        self.logger = params['logger']
        self.logger.info('Create Shadow Copy for %s %s' % (volume, str(self.uid)))

    def _return_root(self):
        return unicode(self.sh.DeviceObject)

    def _search_a_file(self, path):
        drive, p = os.path.splitdrive(path)
        path_return = unicode(self.sh.DeviceObject) + p
        # print self.sh.DeviceObject
        return path_return

    @staticmethod
    def create_shadow_copy(volume):
        wmi_instance = win32com.client.GetObject("winmgmts:\\\\.\\root\\cimv2:Win32_ShadowCopy")
        createmethod = wmi_instance.Methods_("Create")
        createparams = createmethod.InParameters
        createparams.Properties_[1].value = volume
        createparams.Properties_[0].value = "ClientAccessible"
        results = wmi_instance.ExecMethod_("Create", createparams)
        uid = results.Properties_[1].value
        return uid

    def delete(self):
        self.logger.info('Delete Shadow Copy ' + str(self.uid))
        objWMIService = win32com.client.GetObject("winmgmts:\\\\.\\root\\cimv2")
        colItems = objWMIService.ExecQuery("Select * From Win32_ShadowCopy")
        for objItem in colItems:
            if objItem.ID == self.uid:
                objItem.Delete_()

    def select_shadow_copy(self):
        wmi_instance = wmi.WMI()
        list_shadowCopy = wmi_instance.Win32_ShadowCopy()
        for sh in list_shadowCopy:
            if sh.ID == self.uid:
                return sh

    @staticmethod
    def list_shadow_copy():
        wmi_instance = wmi.WMI()
        list_shadowCopy = wmi_instance.Win32_ShadowCopy()
        for sh in list_shadowCopy:
            print sh

    @staticmethod
    def process_hash_value(path):
        with open(path, 'rb') as f:
            try:
                mem_map = mmap.mmap(f.fileno(), length=0, access=mmap.ACCESS_READ)
                sha256 = hashlib.sha256(mem_map)
                md5 = hashlib.md5(mem_map)
                sha1 = hashlib.sha1(mem_map)
                mem_map.close()
                return md5.hexdigest(), sha1.hexdigest(), sha256.hexdigest()
            except ValueError:
                return ""
 class UnicodeJsonDumper:
class UnicodeWriter:
class OSVERSIONINFOEXW(ctypes.Structure):
    def __init__(self, output):
    def list_to_json(self, list_json):
    def dump_json(self, entry):
    def close_current(self):
    def __init__(self, f, dialect=csv.excel, encoding="utf-8", **kwds):
    def writerow(self, row):
    def writerows(self, rows):
def find_encoding(value):
def encode_json_dict(jdict):
def decode_output_cmd(output):
def mount_share(share_path, param_username, param_password):
def unmount_share(letter):
def change_to_MKTime(seconds):
def convert_windate(timestamp):
def dosdate(_dosdate, _dostime):
def convert_string_to_hex(string):
def get_local_drives():
def get_removable_drives():
def sid2username(sid):
def str_sid2username(str_sid):
def check_outlook_d(path):
def look_for_outlook_dirs(paths_to_search):
def look_for_files(dir_to_look):
def zip_from_object(files_to_zip, zip_object, logger):
def zip_archive(files_to_zip, zip_path, filename, logger, file_mode="w"):
def clean(path, computer_name):
def is_locked(filename):
def is_open(filename):
def is_allowed(filename):
def is_running(name):
def copy_file(root, path, dest):
def check_permissions(path, logger):
def write_to_output(str_to_write, output, logger):
def get_terminal_decoded_string(string):
def get_json_writer(json_file):
def get_csv_writer(csvfile):
def write_to_csv(arr_data, csv_writer):
def write_list_to_csv(arr_data, csv_writer):
def write_list_to_json(arr_data, json_writer):
def write_to_json(header, arr_data, json_writer):
def write_dict_json(arr_data, json_writer):
def close_json_writer(json_writer):
def get_architecture():
def get_winpmem_name():
def create_driver_service(logger):
def start_service(h_svc, logger):
def stop_and_delete_driver_service(h_svc):
def process_size(size_str):
def record_sha256_logs(fr, fw):
def process_hashes(path):
def process_md5(path):
def process_sha1(path):
def process_sha256(path):
def rot13(s):
def get_os_version():
def change_char_set_os_environ(environ):

import codecs
import registry_obj
import struct
import construct
import StringIO
import string
import os
import re
import datetime
from utils.utils import convert_windate, dosdate, get_csv_writer, get_json_writer, write_list_to_json, write_dict_json,\
    write_list_to_csv, process_hashes, close_json_writer, record_sha256_logs
from win32com.shell import shell
from csv import reader
from utils.vss import _VSS
from utils.utils import regex_patern_path
from filecatcher.archives import _Archives
                    to_csv_list.append((self.computer_name,
                                        "opensaveMRU",
                                        item[VALUE_LAST_WRITE_TIME],
                                        "HKEY_USERS",
                                        item[VALUE_PATH],
                                        item[VALUE_NAME],
                                        item[KEY_VALUE_STR],
                                        registry_obj.get_str_type(item[VALUE_TYPE]), path))
        return to_csv_list

    def _csv_open_save_mru(self, str_opensave_mru):
        with open(self.output_dir + self.computer_name + "_opensaveMRU" + self.rand_ext, "wb") as output:
            csv_writer = get_csv_writer(output)
            write_list_to_csv(self.__get_open_save_mru(str_opensave_mru), csv_writer)
            record_sha256_logs(self.output_dir + self.computer_name + '_opensaveMRU' + self.rand_ext,
                               self.output_dir + self.computer_name + '_sha256.log')

    def _json_open_save_mru(self, str_opensave_mru):
        if self.destination == 'local':
            with open(self.output_dir + self.computer_name + "_opensaveMRU" + self.rand_ext, "wb") as output:
                json_writer = get_json_writer(output)
                write_list_to_json(self.__get_open_save_mru(str_opensave_mru), json_writer)
            record_sha256_logs(self.output_dir + self.computer_name + '_opensaveMRU' + self.rand_ext,
                               self.output_dir + self.computer_name + '_sha256.log')

    def __get_powerpoint_mru(self, str_powerpoint_mru):
        """Extracts PowerPoint user mru"""
        # TODO : Win XP
        self.logger.info("Extracting PowerPoint MRU")
        hive_list = self._get_list_from_registry_key(registry_obj.HKEY_USERS, str_powerpoint_mru)
        to_csv_list = [("COMPUTER_NAME", "TYPE", "LAST_WRITE_TIME", "HIVE", "KEY_PATH", "ATTR_NAME", "REG_TYPE",
                        "ATTR_TYPE", "ATTR_DATA")]
        for item in hive_list:
            if item[KEY_VALUE_STR] == 'VALUE':
                if item[VALUE_NAME] != "MRUListEx":
                    pidl = shell.StringAsPIDL(item[VALUE_DATA])
                    path = shell.SHGetPathFromIDList(pidl)
                    to_csv_list.append((self.computer_name,
                                        "PowerPointMRU",
                                        item[VALUE_LAST_WRITE_TIME],
                                        "HKEY_USERS",
                                        item[VALUE_PATH],
                                        item[VALUE_NAME],
                                        item[KEY_VALUE_STR],
                                        registry_obj.get_str_type(item[VALUE_TYPE]), path))
        return to_csv_list

    def _csv_powerpoint_mru(self, str_powerpoint_mru):
        with open(self.output_dir + self.computer_name + "_powerpointMRU" + self.rand_ext, "wb") as output:
            csv_writer = get_csv_writer(output)
            write_list_to_csv(self.__get_powerpoint_mru(str_powerpoint_mru), csv_writer)
            record_sha256_logs(self.output_dir + self.computer_name + '_powerpointMRU' + self.rand_ext,
                               self.output_dir + self.computer_name + '_sha256.log')

    def _json_powerpoint_mru(self, str_powerpoint_mru):
        if self.destination == 'local':
            with open(self.output_dir + self.computer_name + "_powerpointMRU" + self.rand_ext, "wb") as output:
                json_writer = get_json_writer(output)
                write_list_to_json(self.__get_powerpoint_mru(str_powerpoint_mru), json_writer)
            record_sha256_logs(self.output_dir + self.computer_name + '_powerpointMRU' + self.rand_ext,
                               self.output_dir + self.computer_name + '_sha256.log')

    def __get_registry_services(self):
        self.logger.info("Extracting services")
        path = r"System\CurrentControlSet\Services"
        to_csv_list = [("COMPUTER_NAME", "TYPE", "LAST_WRITE_TIME", "HIVE", "KEY_PATH", "ATTR_NAME", "REG_TYPE",
                        "ATTR_TYPE", "ATTR_DATA")]
        self._generate_hklm_csv_list(to_csv_list, "registry_services", path)
        return to_csv_list

    def csv_registry_services(self):
        """Extracts services"""
        with open(self.output_dir + self.computer_name + "_registry_services" + self.rand_ext, "wb") as output:
            csv_writer = get_csv_writer(output)
            write_list_to_csv(self.__get_registry_services(), csv_writer)
            record_sha256_logs(self.output_dir + self.computer_name + '_registry_services' + self.rand_ext,
                               self.output_dir + self.computer_name + '_sha256.log')

    def json_registry_services(self):
        if self.destination == 'local':
            with open(self.output_dir + self.computer_name + "_registry_services" + self.rand_ext,
                      "wb") as output:
                json_writer = get_json_writer(output)
                write_list_to_json(self.__get_registry_services(), json_writer)
            record_sha256_logs(self.output_dir + self.computer_name + '_registry_services' + self.rand_ext,
                               self.output_dir + self.computer_name + '_sha256.log')

    def __get_recents_docs(self):
        """Extracts information about recently opened files saved location and opened date"""
        self.logger.info("Extracting recent docs")
        path = r"Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs"
        hive_list = self._get_list_from_registry_key(registry_obj.HKEY_USERS, path)
        to_csv_list = [("COMPUTER_NAME", "TYPE", "LAST_WRITE_TIME", "HIVE", "KEY_PATH", "ATTR_NAME", "REG_TYPE",
                        "ATTR_TYPE", "ATTR_DATA")]
        for item in hive_list:
            if item[KEY_VALUE_STR] == "VALUE":
                if item[VALUE_NAME] != "MRUListEx":
                    values_decoded = decode_recent_docs_mru(item[VALUE_DATA])
                    for value_decoded in values_decoded:
                        to_csv_list.append((self.computer_name,
                                            "recent_docs",
                                            item[VALUE_LAST_WRITE_TIME],
                                            "HKEY_USERS",
                                            item[VALUE_PATH],
                                            item[VALUE_NAME],
                                            item[KEY_VALUE_STR],
                                            registry_obj.get_str_type(item[VALUE_TYPE]),
                                            value_decoded))
        return to_csv_list

    def csv_recent_docs(self):
        with open(self.output_dir + self.computer_name + "_recent_docs" + self.rand_ext, "wb") as output:
            csv_writer = get_csv_writer(output)
            write_list_to_csv(self.__get_recents_docs(), csv_writer)
            record_sha256_logs(self.output_dir + self.computer_name + '_recent_docs' + self.rand_ext,
                               self.output_dir + self.computer_name + '_sha256.log')

    def json_recent_docs(self):
        if self.destination == 'local':
            with open(self.output_dir + self.computer_name + "_recent_docs" + self.rand_ext, "wb") as output:

                json_writer = get_json_writer(output)