An open-source recursive forensic file scanning tool developed as a learner project. This project is actively being worked on and will improve along with my skills in Python. I plan to add more advanced features, polish the code and add more comments for fellow learners.
usage: pyscope.py [-h] [--version] [-v] [-l PATH] [-c PATH] [-r] [-C] path
PyScope forensic filesystem scanner.
positional arguments:
path path to file or directory to analyze
options:
-h, --help show this help message and exit
--version show program's version number and exit
-v, --verbose enable verbose output mode
-l, --log PATH save scan and change logs to specific path
-c, --compare PATH compare current scan against specific scan log
-r, --recursive prform a recursive scan
Standard file scan:
> python pyscope.py [-r -v ] /path/to/file.bin
Standard directory scan:
> python pyscope.py /path/to/dir
Pattern scanning:
> python pyscope.py "/home/user/pictures/*.jpg"
- Individual file examination
- Recursive directory scanning
- Pattern scanning
- Checking file format signatures
- MD5 & SHA256 hash calculation & validation
- Simple signature confidence
- Error handling
- Save scans to json file
- Detect changes in files and save reports to json file
- Detect hard link groups
- Display UID & GID in scan summary
- Display file permissions
- Display file flags
- OS detection
- Some fancy ASCII art
All notable changes to this project will be documented in this file.
- Pattern scanning
- Argument powered CLI architecture
- Cycling ASCII text when scanning
- KeyboardInterrupt handling
- Enhanced error handling
- Enhanced workflow
- JSON serialization bug prevent scans writing to file
- Enhanced distinction between RIFF & WAVE file signatures
- Removed obsolete code
- Reduced redundant code
- Refined functions
- Added a new dark mode toggle to the settings menu.
- Implemented user profile customization options.
- Save scans to json file
- Detect changes in files and save reports to json file
- Detect hard link groups
- Display UID & GID in scan summary
- Display invalid MD5/SHA256 hashes from previous scans.
- Display file permissions
- Display file flags
- OS detection
- Some fancy ASCII art
- Fixed a bug causing the application to crash when handling certain errors.
- Initial release of the project.
- [FIXED]
Crash when handling: PermissionError: [Errno 13] Permission denied: '/usr/sbin/weakpass_edit' - [FIXED]
JSON unable to serialize signature value due to it being a bytes object. - Operation will timeout reading some files.
- AttributeErrors on both Windows and Linux. (this is currently being worked on before adding more features)
- Comment, comment, comment. Comments make the code easier to read and maintain. I wish had started adding them sooner, it's made finding specific functions easier.
- Organize the code. When I first started, it was easy to find functions and specific lines, but as it grew, it became harder. I started organizing functions by moving them closer to similar functions, so it's like sorting functions by category.
- Google, StackOverflow, and just forums in general are your friend. There is always a useful piece of information out there that can help fill in the blanks and help breakdown any roadblock.
- AI is a helpful tool when trying to learn how somethings work, but relying on it will leave you tangled in a messy web of redundant code.
- Take breaks. After looking at a screen for so long managing code, your brain kind of becomes a potato and it becomes harder to spot things.
- Take notes. If you see a piece of code that you want or need to improve then either take note of it or tackle it right then and there, because if you just try taking a mental note of it and continue with other things, there is a good chance that you will forget about it and it will sit there until something breaks and you have figure out what's going on.