Script Stash - Hunting SEGB Streams

Posted by

 
SEGB Biome streams are the hot replacement for iOS KnowledgeC entries. Mattia Epifani has a great blog on the history including shout outs to John Hyla, Geraldine Blay and Chris Vance for their work on them.

In talking with Alexis Brignoni I had found some other stream categories that iLEAPP doesn't parse quite yet (as of this blog). I was dumping out full file listings using my Arc2Lite tool and filtering the columns for "streams" to manually look for other locations until the lightbulb went on. Why don't I just make a tailored script for this.

So lo and behold,  another one-off research script I'm calling SEGB Hunter. In essence it takes a zip or tar as input (or folder if you want) and traverses already identified paths pulling out information about these SEGB streams:

  • File name
  • Relative path
  • Stream category
  • Record count
  • Modified timestamps
  • If it's a tombstone or not
As more paths become known I will update the targets. I wanted to avoid the "scan all files" type of search for speed purposes.

Output formats include CSV or SQLiteDB. Give it a try and let me know if this is beneficial to your research!

Figure 1: Sample SQLite output
UPDATE: Brigs jogged my memory to add an export files feature so it's there now up on the repo with a new -e switch.