EC-DIGIT-CSIRC/sysdiagnose

Issues

• extract timezone from image

  #78 opened a month ago by cvandeplas
  4

• convert all output to time/event based jsonl / ndjson

  #79 opened 22 days ago by cvandeplas
  0

• [Enhancement] Make unittests for everything

  #40 opened a year ago by aaronkaplan
  1

• optparse is deprecated and needs to be migrated to argparse

  #63 opened 25 days ago by cvandeplas
  2

• Review and improve parsing of spindump-nosymbols.txt

  #52 opened 25 days ago by ddurvaux
  2

• (UC) geoloc + timestamp on known wifis

  #37 opened 25 days ago by aaronkaplan
  1

• needed: analysers

  #21 opened 25 days ago by aaronkaplan
  3

• [Bug] Fix decoding of bytes in the plist cleaning functions

  #38 opened 25 days ago by kwouffe
  2

• move (some) file-specific analyser functionality in file-specific parser class?

  #75 opened 2 months ago by cvandeplas
  2

• crashlogs parser

  #70 opened a month ago by cvandeplas
  1

• smart case management - modular

  #77 opened 2 months ago by cvandeplas
  0

• ()

  #76 opened 2 months ago by XSZED777
  0

• [Bug] Can't run the scripts from another folder because of relative paths used

  #49 opened 2 months ago by Te-k
  5

• parser ps - autodetect line format based on header

  #71 opened 3 months ago by cvandeplas
  4

• add system metadata to case info to allow delta from previous case

  #72 opened 2 months ago by cvandeplas
  1

• case_file in cases.json must be relative path

  #73 opened 2 months ago by cvandeplas
  0

• [logarchive] __execute_cmd_and_yield_result does not support spaces in the path

  #74 opened 2 months ago by cvandeplas
  0

• Fix the main() reading of input files. Here we should have a glob(**.plist)-like in mobileactivation.py's main()

  #35 opened 3 months ago by aaronkaplan
  1

• sysdiagnose-timeliner.py: add more sources to export to timesketch and fix existing ones

  #23 opened 3 months ago by aaronkaplan
  1

• reading plist files should be a generic function and move to misc.py

  #26 opened 3 months ago by aaronkaplan
  1

• [Enhancement] remove the "sysdiagnose-" prefix from the parser and analyser names, s/-/_/g

  #41 opened 4 months ago by aaronkaplan
  0

• Improve process parsing from taskinfo.txt

  #51 opened 4 months ago by ddurvaux
  2

• migrate away from biplist to plistlib

  #66 opened 4 months ago by cvandeplas
  0

• parsers to contain list of files to match

  #65 opened 4 months ago by cvandeplas
  5

• parser for phone info - remotectl_dumpstate

  #69 opened 4 months ago by cvandeplas
  1

• AZ

  #68 opened 4 months ago by XSZED777
  0

• group syslog style parser to one function

  #67 opened 5 months ago by cvandeplas
  3

• [Bug] We are not consistent: analyZer vs. analySer.

  #42 opened 5 months ago by aaronkaplan
  1

• (nice to have) UnifiedLogReader.py on Linux - parsing this is broken in Linux. Fix eventually

  #19 opened 5 months ago by aaronkaplan
  5

• Settle on US or british /irish spelling

  #48 opened 8 months ago by aaronkaplan
  1

• make demo instance with timesketch

  #20 opened 8 months ago by aaronkaplan
  1

• changes for hack.lu

  #53 opened 8 months ago by aaronkaplan
  0

• (UC) UC2: wifi APs

  #28 opened a year ago by aaronkaplan
  1

• simulate rogue app

  #29 opened a year ago by aaronkaplan
  1

• Problem with timestamp format in analyser

  #45 opened a year ago by aaronkaplan
  3

• (re-) create AWS timesketch demo instance

  #46 opened a year ago by aaronkaplan
  1

• check and fix the powerlog json format

  #36 opened a year ago by ddurvaux
  1

• scenarios: screen record them

  #22 opened a year ago by aaronkaplan
  1

• Add monitoring for timesketch-AWS instance

  #47 opened a year ago by aaronkaplan
  0

• Review sysdiagnose-ps.py

  #44 opened a year ago by ddurvaux
  0

• Create a parser for `WiFi/com.apple.wifi.known-networks.plist`

  #34 opened a year ago by aaronkaplan
  0

• Wifi parsers

  #32 opened a year ago by kwouffe
  0

• [Bug] Fix Itunesstore output

  #43 opened a year ago by kwouffe
  1

• [Enhancement] Move the plist parsing function to misc.py

  #39 opened a year ago by kwouffe
  1

• Adding possibility to re-initialize a sysdiagnose file

  #33 opened a year ago by kwouffe
  1

• (UC) UC3: Google authenticator leak story (low prio)

  #31 opened a year ago by aaronkaplan
  0

• (research) can we find the network activity per app?

  #30 opened a year ago by aaronkaplan
  0

• (UC) UC1: installation of a rogue app

  #27 opened a year ago by aaronkaplan
  0

• simplify all of the python version checks. Since we use python3 syntax, the file won't run anyway in python2.x . So get rid of the version check all together!

  #25 opened a year ago by aaronkaplan
  0

• (important) scenarios

  #24 opened a year ago by aaronkaplan
  0