[plaso] Added Linux system product preprocessor plugin #1337

[plaso] Added Linux system product preprocessor plugin #1337

[aaronp, 2017-08-10 17:31:25]

https://codereview.appspot.com/322490043/diff/1/plaso/preprocessors/linux.py
File plaso/preprocessors/linux.py (right):

https://codereview.appspot.com/322490043/diff/1/plaso/preprocessors/linux.py#...
plaso/preprocessors/linux.py:80: system_product = text_file_object.readline()
This seems like it will work well with the example that is in the test file,
which is just a single line of text, but on ubuntu the /etc/lsb-release file is
a multi-line file (mine is 8 lines).  Do we want all of that data in the
knowledge base?  Or do we want to parse out the versions?

https://codereview.appspot.com/322490043/diff/1/plaso/preprocessors/windows.py
File plaso/preprocessors/windows.py (right):

https://codereview.appspot.com/322490043/diff/1/plaso/preprocessors/windows.p...
plaso/preprocessors/windows.py:4: from __future__ import unicode_literals
Are there any automated tools that can do this?   If so, maybe we could do all
of these types of changes at once?

[Joachim Metz, 2017-08-11 06:09:19]

https://codereview.appspot.com/322490043/diff/1/plaso/preprocessors/linux.py
File plaso/preprocessors/linux.py (right):

https://codereview.appspot.com/322490043/diff/1/plaso/preprocessors/linux.py#...
plaso/preprocessors/linux.py:80: system_product = text_file_object.readline()
Thx for flagging. Now I think of it /etc/lsb-release should be likely a
different artifact.

https://codereview.appspot.com/322490043/diff/1/plaso/preprocessors/windows.py
File plaso/preprocessors/windows.py (right):

https://codereview.appspot.com/322490043/diff/1/plaso/preprocessors/windows.p...
plaso/preprocessors/windows.py:4: from __future__ import unicode_literals
Not sure, a quick search indicated:
https://github.com/python-rope/rope
http://bicyclerepair.sourceforge.net/
pycharm

I'll have a look at them. Thx for the suggestion.

For now I'll make these changes gradually on files that are touched.

[Joachim Metz, 2017-08-18 06:28:44]

Splitting LSB and non-LSB release information across multiple artifacts:
https://github.com/ForensicArtifacts/artifacts/pull/234

[aaronp, 2017-09-09 00:13:08]

Let me know if you're waiting on me for anything on this one.

[Joachim Metz, 2017-09-09 07:15:56]

Code updated.

[Joachim Metz, 2017-10-07 11:07:25]

Code updated.

[Joachim Metz, 2017-10-07 11:08:31]

PTAL

[aaronp, 2017-10-10 05:35:58]

LGTM

[Joachim Metz, 2017-10-10 06:24:11]

Changes have been merged with master branch. To close the review and clean up
the feature branch you can run: python ./utils/review.py close linux1337