Perl Scripting for Windows Security

Part II Perl Scripting and Computer Forensic Analysis

Solutions for this Part:

• Log Files
• Parsing Binary Files
• Registry
• Event Logs
• Parsing RAM Dumps
• ProScripts
• Parsing Other Data

Log Files

Log files, even on Windows systems, will often be flat ASCII text files that contain each log entry on one line. This makes the easy to view, but often times these log files can be hundreds of kilobytes (KB) in size, even going over the megabyte (MB) range, depending upon the application generating the logs and the amount of traffic. For example, by default, Microsoft’s web server, Internet Information Server (IIS) will write web and FTP logs to flat ASCII text files. Perl was originally designed to quickly and efficiently parse log files, and on Unix ...