casework / case-implementation-plaso Goto Github PK

(This is a re-post of Issue 2 from the prior repository.)

I tried ingesting all of the example files in all of their formats into the CASE Python API, and received some rdflib parsing issues before anything involving the CASE API.

This minimal Bash/Python script loops through the examples/ directory's XML and reports problems there. Here is a truncated shell transcript including the Bash line and the relevant part of the last error encountered:

$ ls *json *ttl *xml | while read x; do python3.5 -c "import rdflib ; rdflib.Graph().parse('$x')" ; done
INFO:rdflib:RDFLib Version: 4.2.2
# [snip]
rdflib.exceptions.ParserError: file:///.../examples/tsk_volume_system.xml:10:4: rdf:nodeID value is not a valid NCName: 51ee2f70-af0f-4ac7-9765-7bf7aa565ddf
$ echo $?
1

All XML files but bz2.xml had a problem. However, bz2.json and bz2.ttl also failed to parse.

This Issue is good to close when that little loop runs without a hitch.

Execution environment: macos Sierra, MacPorts-installed Python and rdflib via py35-rdflib.

I believe we should follow log2timeline/plaso and adopt the Apache2.0 license for this repo.

The README still points to casework.

I ran verify.py against all the examples in this directory, and got verification issues (terms not in case.ttl) with these files:

• bz2.{json,ttl,xml}
• lvm.{json,ttl}
• tsk_volume_system.{json,ttl}