LESSON 8 DIGITAL FORENSICS part V

8.2.3.2 grep
grep is an immensely powerful tool. It is used to find certain lines within a file. This allows you to
quickly find files that contain certain things within a directory or file system. It also allows for

searching on regular expressions. There are search patterns that allow you to specify criteria
that the search must match. For example: finding all strings in the dictionary that start with “s”
and finish with “t” to help with doing a crossword.
grep ^s.*t$ /usr/share/dict/words
Exercises:
1. Read the manual page for grep.
2. Look up regular expressions for grep on the Internet. Try to construct a regular expression
that looks for all words that are four letters long and contain an “a”.

 

8.2.3.3 strings
strings is another useful utility. This will search through a file of any type for human readable
strings. This can return a great deal of information about a specific file, often providing
information about the application that created it, authors, original creation time and so on.
Exercise:
1. Read the manual page for strings.

 

8.2.3.2 grep

grep 是一個很強大的工具。用來查找文件中的某個字符串。通過grep可以在某個文件夾或者文件系統中查找包含某個特殊字符串的文件。grep也可用來查找正則表達式。查找時有幾種查找模式,通過這些模式來指定搜索內容要匹配的條件。例如:查找目錄中以s開頭,t結尾的字符串來幫助解密。

grep ^s.*t$ /usr/share/dict/words

練習:

1、閱讀grep的人工指南。

2、在網上查找grep的常規表達式。試着創建一個正則表達式來查找所有包含一個a的四個字符長度的字符串。

 

8.3.3.3 strings

strings是另一個很有用的工具。查找任何類型的可以被人讀取的文件。返回某個特殊文件大量信息。提供產生該文件的應用程序信息,以及作者,原創時間等等。

練習:

1、閱讀strings的人工指南。

 

8.2.3.4 awk
awk is a programming language designed for working with strings. It is used to extract
information from one command to feed into another. For example, to take just the running
programs from the ps command, you would use the following:
ps | awk '{print $4}'
Exercise:
1. Read the manual page for awk.


8.2.3.5 The Pipe “|”
All of the above tools are easily combined using the UNIX “pipe” command. This is shown with
the “|” symbol. This allows you to take the output of one command and feed it down a pipe
to another command. To find all files in the current directory that are mpg files, use the
following:
ls | grep mpg
Exercises:
1. Using the pipe, the ls command and grep, find all files in the current directory that were
created this month.
2. Using the ps command and awk, print a list of all the running process names.

 

8.2.3.4 awk

awk 是和strings一起使用的編程語言。awk用來從一個指令中汲取信息反饋另一個指令中去。例如,從ps指令中調出運行的程序,你需要用下面語句:

ps | awk '{print $4}'

練習:

1、閱讀awk的人工指南。

 

8.2.3.5 Pipe 命令“I”

以上所有的工具都可以通過pipe指令結合使用。用“|”表示。用一個pipe將兩個指令連接起來。查找目錄中所有的mpg文件,用下列指令:

ls | grep mpg

練習:使用pipe,Is指令和grep,查找當前目錄中所有在這個月創建的文件。

2、用ps指令,awk,打印一個所有運行進程名的單子。

 

 

 

發表評論
所有評論
還沒有人評論,想成為第一個評論的人麼? 請在上方評論欄輸入並且點擊發布.
相關文章