Helpful scripts

The following are scripts we have found to be useful.

Download/Install Chrome

$Path = $env:TEMP; $Installer = "chrome_installer.exe"; Invoke-WebRequest "http://dl.google.com/chrome/install/375.126/chrome_installer.exe" -OutFile $Path\$Installer; Start-Process -FilePath $Path\$Installer -Args "/silent /install" -Verb RunAs -Wait; Remove-Item $Path\$Installer

Tail/Follow a Log

Get-Content "LOGFILEPATH" -Tail 10 -wait

E01 of E01s

It is not unheard of to receive an image of a hard drive that is an image of a hard drive that contained images of hard drives. This usually happens when sending data between organizations. When you load the E01, the following will export the images found within.

import sys
sys.path.append('C:/Program Files/Truxton/SDK')
import truxton

def main():

 t = truxton.create()
 exporter = t.newexporter()
 exporter.addcriteria( exporter.fqtype, truxton.Type_Expert_Witness_Data )
 exporter.addcriteria( exporter.fqorigin, truxton.ORIGIN_NORMAL)
 exporter.addoption( exporter.eoname, "{name}" )
 exporter.addoption( exporter.eofolder, "C:\ClusterStorage\Scratch\Exports" )
 exporter.addoption( exporter.eounique, "1" )
 exporter.execute()

if __name__ == "__main__":
    main()