Skip to content

Latest commit

 

History

History
12 lines (9 loc) · 737 Bytes

README.md

File metadata and controls

12 lines (9 loc) · 737 Bytes

nuwalk

An alternative to fiwalk that utilizes The Sleuth Kit to generate a DFXML for file information

Usage

Nuwalk is a python script that operates off of a TSK sqlite database. The database can be generated using tsk_loaddb.exe from The Sleuth Kit https://www.sleuthkit.org/. It is recommended that tsk_loaddb.exe be ran with the -h option to include md5 hashes. Nuwalk will query file data from the database generated by tsk_loaddb.exe to build a DFXML similar to those produced by fiwalk. The resulting DFXML can be fed into Bulk Extractor's identify_filenames.py script to provide location information for the features produced by Bulk Extractor.

python nuwalk.py <path to tsk database file> <output xml file name>