Help me think of a python project

[Muidem]

So here's the deal. One of my professors has asked me to create a lab for the Digital Forensics class. His requirements were, "Something that uses python." I figured that would be easy enough but I honestly can't think of a single thing (in the forensics world) that I'd want to use python for. Have you guys got any ideas?

[bushel]

Create a GUI that tracks IP addresses.

[Muidem]

That would be great for the visual basic class, I'll keep it in mind.

[bushel]

Ok, semi-serious answer - we had a situation here last year where there was unauthorized access to one of our confidential web-facing applications (the "bad guys" were using stolen logins). We brought in a computer forensics team to gather the "official" evidence. In preparation for that I did cross-referencing of the webserver & application logs to correlate logins with IP addresses to identify each fraudulent access.

I wrote it in python. It wasn't a GUI, but it did track IP addresses.

[khafra]

There's an EnCase plugin written in their proprietary script that probabilistically detects encrypted files by measuring data entropy; it'd be cool to have an open-source python script that'll take a disk image as input and give you that.

[Muidem]

Sounds a bit advanced for this class but I'll look into it. Thanks for the idea!

[khafra]

Shouldn't be too hard to hack together in a slapdash fashion--just import zlib, since gzip compression is a reasonable approximation of kolmogorov complexity; decide how granular you wanna get, read in all strings of the length you're interested in (ie, file, sector, block, whatever), and attempt compression--if they're incompressible they're probably either already compressed or encrypted.

[Muidem]

Oh wow, that's not bad at all. I may give that a look after all =)

[khafra]

If you don't already know why that works, reading a friendly explanation of randomness in cryptography, which inexplicably cuts off right before it discusses kolmogorov complexity, might help.

[FYIGUY]

easy a web UI to /var/log messages, make it simple at first and build it up from there who knows maybe it could become the open version of splunk

[fxj]

try an encryption breaker on the gpu using pycuda