CCM_RecentlyUsedApps
After reading James Habben’s post about recently used apps on his blog 4n6ir. I thought I would look into this and see how this could become a plugin for Autopsy. Heck if Encase can have an EnScript for it why not create a Python plugin for Autopsy.
From reading James post there was already a project that was put together to get the information for this. All I needed to do was to extend the python script so that it would output the data to a SQLite database and then make it an executable program. I added the code for SQLite and then used pyinstaller to create an executable file. You can find the code for the program here.
Once this was created I then created the Autopsy plugin for it. What the plugin does is that it exports the files needed from the \Windows\System32\wbem\repository directory then runs the show_CCM_RecentlyUsedApps.exe program against it and creates a SQLlite database that is then imported into a custom artifact. Most of the attributes for the artifact are custom, only a few are the attributes provided by Autopsy.
If you look at the code you may notice that when I execute the SQL to get the data out of the database I use a column alias for each column in my select.
The reason I do this is so that I can get the metadata from the resultset and get the column names associated with each column. I then put those columns in a list and for each row of the result set I get each column and then get the associated Attribute type and value type of that column. This allows me to easily add the correct attribute to blackboard. The code is below:
This seems to work pretty well and the code can be reused easily, all that needs to be done to reuse the code is to change the select statement to something else and make sure I have created the attributes prior to running the select statement.
You can find the plugin here. Enjoy!
One last thing if you can spare a few minutes could you take the short survey I put out to get some feedback on existing modules and what you would like to see as the next plugins to create in Autopsy. The survey can be found here. Thanks for those that have taken the survey.
