Helpful scripts

The following are scripts we have found to be useful.

Download/Install Chrome

$Path = $env:TEMP; $Installer = "chrome_installer.exe"; Invoke-WebRequest "http://dl.google.com/chrome/install/375.126/chrome_installer.exe" -OutFile $Path\$Installer; Start-Process -FilePath $Path\$Installer -Args "/silent /install" -Verb RunAs -Wait; Remove-Item $Path\$Installer

Tail/Follow a Log

Get-Content "LOGFILEPATH" -Tail 10 -wait

E01 of E01s

It is not unheard of to receive an image of a hard drive that is an image of a hard drive that contained images of hard drives. This usually happens when sending data between organizations. When you load the E01, the following will export the images found within.

import sys
sys.path.append('C:/Program Files/Truxton/SDK')
import truxton

def main():

 t = truxton.create()
 exporter = t.newexporter()
 exporter.addcriteria( exporter.fqtype, truxton.Type_Expert_Witness_Data )
 exporter.addcriteria( exporter.fqorigin, truxton.ORIGIN_NORMAL)
 exporter.addoption( exporter.eoname, "{name}" )
 exporter.addoption( exporter.eofolder, "C:\ClusterStorage\Scratch\Exports" )
 exporter.addoption( exporter.eounique, "1" )
 exporter.execute()

if __name__ == "__main__":
    main()

Ping All Equipment in the Rack

function ping-it($name, $machine_name)
{
   if ( $(Test-Connection -ComputerName $name -Count 1 -Quiet) -EQ $false )
   {
      Write-Host -ForegroundColor Red -BackgroundColor Yellow $($machine_name + " - FAIL!")
   }
   else
   {
      Write-Host $($machine_name + " - OK")
   }
}

ping-it -name "1.1.1.1"     -machine_name "VPN Server"
ping-it -name "8.8.8.8"     -machine_name "Google DNS Server"
ping-it -name "tfrs-dev-dc" -machine_name "TFRS Domain Controller"
ping-it -name "10.1.100.5"  -machine_name "Rack Switch - S5224F-ON"

ping-it -name "10.1.3.11"   -machine_name "TFRS-DEV-01 1Gb NIC"
ping-it -name "10.1.1.11"   -machine_name "TFRS-DEV-01 Storage 1"
ping-it -name "10.1.2.11"   -machine_name "TFRS-DEV-01 Storage 2"
ping-it -name "10.1.3.12"   -machine_name "TFRS-DEV-01 iDRAC"
ping-it -name "10.1.2.11"   -machine_name "TFRS-DEV-01 Outside 10Gb"

ping-it -name "10.1.3.13"   -machine_name "TFRS-DEV-02 1Gb NIC"
ping-it -name "10.1.1.12"   -machine_name "TFRS-DEV-02 Storage 1"
ping-it -name "10.1.2.12"   -machine_name "TFRS-DEV-02 Storage 2"
ping-it -name "10.1.3.14"   -machine_name "TFRS-DEV-02 iDRAC"
ping-it -name "10.1.2.13"   -machine_name "TFRS-DEV-02 Outside 10Gb"

ping-it -name "10.1.3.15"   -machine_name "TFRS-DEV-03 1Gb NIC"
ping-it -name "10.1.1.13"   -machine_name "TFRS-DEV-03 Storage 1"
ping-it -name "10.1.2.13"   -machine_name "TFRS-DEV-03 Storage 2"
ping-it -name "10.1.3.16"   -machine_name "TFRS-DEV-03 iDRAC"
ping-it -name "10.1.2.15"   -machine_name "TFRS-DEV-03 Outside 10Gb"

Calculating Hashes

You can use a Windows command to calculate hashes for files.

certutil -hashfile file.dat md5
certutil -hashfile file.dat sha1
certutil -hashfile file.dat sha512