Rapidly triaging systems – pysysinfo.py

We are now ready to dive into the focus of this chapter, the pysysinfo.py script after having already covered the importance of collecting volatile information and the libraries we will use. This script is composed of a number of functions, most of which have to do with the psutil library, but at its heart identifies early on what type of system it is running on and, if that system is using the Windows operating system, runs an additional function using the WMI API, discussed previously. You can see in the following diagram how the various functions interact with each other and make up the code discussed throughout the remainder of this chapter:

This script was developed and tested on Python 2.7.15 ...

Get Learning Python for Forensics - Second Edition now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.