Improvements to source scanner.

Improvements to source scanner.
* TSK analyzer is not signature based
* initial BDE support
* code clean up

[onager, 2015-06-29 13:43:14]

https://codereview.appspot.com/247350043/diff/1/dfvfs/analyzer/analyzer.py
File dfvfs/analyzer/analyzer.py (right):

https://codereview.appspot.com/247350043/diff/1/dfvfs/analyzer/analyzer.py#ne...
dfvfs/analyzer/analyzer.py:114: scanner_object.set_scan_buffer_size(33 * 1024)
Why this size? Extra to a class variable?

https://codereview.appspot.com/247350043/diff/1/dfvfs/helpers/source_scanner.py
File dfvfs/helpers/source_scanner.py (right):

https://codereview.appspot.com/247350043/diff/1/dfvfs/helpers/source_scanner....
dfvfs/helpers/source_scanner.py:144: """Determines if a file system were
detected during the scan."""
*was

https://codereview.appspot.com/247350043/diff/1/dfvfs/helpers/source_scanner....
dfvfs/helpers/source_scanner.py:381: # No need to scan a locked scan node e.g.
an encrypted volume.
This is the first time we've mentioned what a locked node actually means - I
recommend adding this comment to GetLockedNodes, etc.

https://codereview.appspot.com/247350043/diff/1/examples/source_analyzer.py
File examples/source_analyzer.py (right):

https://codereview.appspot.com/247350043/diff/1/examples/source_analyzer.py#n...
examples/source_analyzer.py:73: # The source scanner found an encrypted volume
and we need
Terminology - locked vs. encrypted

[Joachim Metz, 2015-06-29 17:35:21]

https://codereview.appspot.com/247350043/diff/1/dfvfs/analyzer/analyzer.py
File dfvfs/analyzer/analyzer.py (right):

https://codereview.appspot.com/247350043/diff/1/dfvfs/analyzer/analyzer.py#ne...
dfvfs/analyzer/analyzer.py:114: scanner_object.set_scan_buffer_size(33 * 1024)
On 2015/06/29 13:43:14, onager wrote:
> Why this size? Extra to a class variable?

Done.

https://codereview.appspot.com/247350043/diff/1/dfvfs/helpers/source_scanner.py
File dfvfs/helpers/source_scanner.py (right):

https://codereview.appspot.com/247350043/diff/1/dfvfs/helpers/source_scanner....
dfvfs/helpers/source_scanner.py:144: """Determines if a file system were
detected during the scan."""
On 2015/06/29 13:43:14, onager wrote:
> *was

Done.

https://codereview.appspot.com/247350043/diff/1/dfvfs/helpers/source_scanner....
dfvfs/helpers/source_scanner.py:381: # No need to scan a locked scan node e.g.
an encrypted volume.
On 2015/06/29 13:43:14, onager wrote:
> This is the first time we've mentioned what a locked node actually means - I
> recommend adding this comment to GetLockedNodes, etc.

Acknowledged.

https://codereview.appspot.com/247350043/diff/1/examples/source_analyzer.py
File examples/source_analyzer.py (right):

https://codereview.appspot.com/247350043/diff/1/examples/source_analyzer.py#n...
examples/source_analyzer.py:73: # The source scanner found an encrypted volume
and we need
On 2015/06/29 13:43:14, onager wrote:
> Terminology - locked vs. encrypted

Acknowledged.

[Joachim Metz, 2015-06-29 17:38:08]

Code updated.

[kiddi, 2015-06-30 03:32:50]

LGTM, one minor comment.

Can we then add support for this into plaso?

https://codereview.appspot.com/247350043/diff/20001/dfvfs/analyzer/tsk_analyz...
File dfvfs/analyzer/tsk_analyzer_helper.py (right):

https://codereview.appspot.com/247350043/diff/20001/dfvfs/analyzer/tsk_analyz...
dfvfs/analyzer/tsk_analyzer_helper.py:2: """The SleuthKit (TSK) format analyzer
helper implementation."""
is this really Sleuthkit TSK format analyzer at this point?

[Joachim Metz, 2015-06-30 04:54:19]

https://codereview.appspot.com/247350043/diff/20001/dfvfs/analyzer/tsk_analyz...
File dfvfs/analyzer/tsk_analyzer_helper.py (right):

https://codereview.appspot.com/247350043/diff/20001/dfvfs/analyzer/tsk_analyz...
dfvfs/analyzer/tsk_analyzer_helper.py:2: """The SleuthKit (TSK) format analyzer
helper implementation."""
On 2015/06/30 03:32:50, kiddi wrote:
> is this really Sleuthkit TSK format analyzer at this point?

In the sense that it matches the TSK back-end, yes. In the sense that it uses
TSK, no.