Added in SRUDB processing

.gitignore

@@ -1 +1,2 @@
+/PythonAnalysisList
 /volatility3

Actions/SRUProcessing/Format-SRUDB.psm1

@@ -0,0 +1,51 @@
+function Format-SRUDB {
+ <#
+ .SYNOPSIS
+ Gets the SRUDB.dat file and runs the excellent srum-dump executeable by Mark Baggett
+
+ .DESCRIPTION
+ Uses the excellent work done by Mark Baggett here: https://github.com/MarkBaggett/srum-dump
+ Transforms the information from SRUDB into an excel file
+ 
+ #>
+ param (
+
+ )
+
+ # Create the output dictionary
+ $output = @{
+ "Object" = "Format-SRUDB"
+ }
+
+ # Get the endpoint from the target list
+ $endpoints = Get-TargetList
+
+ foreach($endpoint in $endpoints){
+ # Create dictionary for output
+ $endpointdict = @{}
+
+ # Create input location
+ $inputloc = "C:\ExtractionDirectory\" + $endpoint + "_ForensicArtifacts\EventLoggingandSRU\sru\SRUDB.dat"
+
+ # Add to the output object
+ $endpointdict.Add("InputLocation", $inputloc)
+
+ # Create the output location
+ $outputloc = "C:\ExtractionDirectory\" + $endpoint + "_ForensicArtifacts\EventLoggingandSRU\ProcessedOutcomes\sru_database.xlsx"
+
+ # Add to the output object
+ $endpointdict.Add("OutputLocation", $outputloc)
+
+ # Now run the executeable
+ $srumdb = .\Executeables\srum_dump2.exe --SRUM_INFILE $inputloc --XLSX_OUTFILE $outputloc --XLSX_TEMPLATE ".\Executeables\SRUM_TEMPLATE2.xlsx"
+
+ # Add the results to the output object
+ $endpointdict.Add("SRUDB_Processing", $srumdb)
+
+ # Add all results to the output dictionary
+ $output.Add($endpoint, $endpointdict)
+ }
+
+ # Return outcomes to the user
+ Write-Output $output
+}

CoreEndpointInteraction/Get-TargetList.psm1

@@ -18,5 +18,7 @@ function Get-TargetList{
 
  Write-ColoredInformation -MessageData "Targets:" -ForegroundColor "Blue"
  Write-ColoredInformation -MessageData $message -ForegroundColor "Red"
+
+ Write-Output $message
 
 }

Executeables/executeablemanifest.json

@@ -3,5 +3,15 @@
  "ExecutableName": "WinPmem.exe",
  "DownloadURL": "https://github.com/google/rekall/releases/download/v1.3.1/winpmem_1.6.2.exe",
  "OutputPath": "Executeables"
+ },
+ {
+ "ExecutableName": "srum_dump2.exe",
+ "DownloadURL": "https://github.com/MarkBaggett/srum-dump/blob/master/SRUM_TEMPLATE2.xlsx",
+ "OutputPath": "Executeables"
+ },
+ {
+ "ExecutableName": "SRUM_TEMPLATE2.xlsx",
+ "DownloadURL": "https://github.com/MarkBaggett/srum-dump/blob/master/SRUM_TEMPLATE2.xlsx",
+ "OutputPath: Executeables"
  }
 ]

modulemanifest.txt

@@ -15,3 +15,4 @@
 .\Actions\DumpandRetrieveMemory\Get-MemoryDump.psm1
 .\Actions\RetrieveLogsandSRUDB\Copy-RemoteEventLogging.psm1
 .\Actions\RetrieveLogsandSRUDB\Get-RemoteEventLogging.psm1
+.\Actions\SRUProcessing\Format-SRUDB.psm1