google/turbinia

Windows RecentFileCache parser job

Open

#1,169 opened on Oct 11, 2022

View on GitHub
 (1 comment) (0 reactions) (0 assignees)Python (170 forks)github user discovery
enhancementgood first issuenew-task

Repository metrics

Stars
 (789 stars)
PR merge metrics
 (PR metrics pending)

Description

Given that Plaso does not parse RecentFileCache ref, create a job to parse RecentFileCache on Windows machines. https://github.com/EricZimmerman/RecentFileCacheParser

Also need to find a Linux compatible version since link shows it to be compiled as executable/C#: https://github.com/EricZimmerman/RecentFileCacheParser

Contributor guide

Research direction
Look into the referenced RecentFileCache parser and implement a job that calls it or a port of it for Linux. Ensure compatibility with Turbinia's job framework.
Tech stack
python
Domain
securitybackend
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Mostly clear
Prerequisites
GitPython
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
30