Learning Python for Forensics

Executing wal_crawler.py

Now that we've written the script, it is time to actually run it. The simplest way of doing so is to supply the input WAL file and output directory.

Optionally, we can use the -m or -r switches to engage the regular expression module. The following screenshot shows an example of what the regular expression output looks like.

Note

Note that when supplying a custom regular expression to run with the -r switch, surround the expression with double quotes. If you fail to do so, you might encounter an error due to havoc wreaked by ...