`katana.units.forensics.foremost` — Foremost¶

Binwalk file carving

This unit will run foremost to extract other files out of one given file. The syntax runs as:

foremost <target_path> -o <foremost_directory>

class katana.units.forensics.foremost.Unit(*args, **kwargs)

BLOCKED_GROUPS = ['carver']: Groups which this unit cannot recurse into.

DEPENDENCIES = ['foremost']: Required depenencies for this unit “foremost”. This must be in your PATH to be executed.

GROUPS = ['forensics', 'foremost', 'carver']: These are “tags” for a unit. Considering it is a Forensics unit, “forensics” is included, as well as the unit name “foremost”.

PRIORITY = 30: Priority works with 0 being the highest priority, and 100 being the lowest priority. 50 is the default priorty. This unit has a moderately high priority due to speed and broadness of applicability

RECURSE_SELF = False: Don’t recurse into any of the extract objects. Binwalk should have carved them out already.

evaluate(case: str)

Evaluate the target. Run foremost on the target and recurse on any new found files.

Parameters:	case – A case returned by `enumerate`. For this unit, the `enumerate` function is not used.
Returns:	None. This function should not return any data.

katana.units.forensics.foremost.md5sum(path): Quick convenience function to get the MD5 hash of a file

katana.units.forensics.foremost — Foremost¶