With a functioning prototype, we now have some cleanup work to do. The first iteration was a proof of concept to illustrate how a setupapi.dev.log
file can be parsed for forensic artifacts. With our second revision, we will clean up the code and make it so that it will be easier to use in the future by rearranging the code. In addition, we will integrate a more robust command-line interface, validate any user-supplied inputs, improve processing efficiency, and better display results.
On lines 1 through 3, we import libraries that we will need for these improvements. Argparse
is a library we discussed at length in Chapter 2, Python Fundamentals, and is used to implement and structure arguments from the user. Next, we import os
, a library we will use in this script to check the existence of input files before continuing. This will prevent us from trying to process a file that does not exist. The os
module is used to access common operating system...