Creating new items from scripts

[DHoelz]

@lfcnassif,

Could you make a example script (in python or js) showing how to create new itens from scripts?

As I'm not a programmer, I'm having difficulties to implement this functionality. I've managed to add a new file to the case, howewer I don't think I'm doing it the right way and I couldn't set the view file for the newly created item.

[lfcnassif]

Hi @DHoelz. Sure. This and next week I'm a bit busy, but I'll try to write an example script for that as soon as possible. What kind of script are you trying to write, a parser or a task?

[DHoelz]

1. I'll try to take a look this afternoon and see what I'm doing wrong.

2. My "workaround" was actually just modify the java class for regripper, no external scripts involved. I'll try to make the PR but I've never done that before.

3. Thanks! I'll take a look these issues.

[DHoelz]

Hi @lfcnassif, after a long time I tried again the python scripts that were giving me the thread exception but I couldn't get them to work correctly 100% of the time. At first they seemed to work with my test base however I realized that they only worked because there were just a few itens, and If I got it right, in these cases you do use the ProcessTime.Later argument.

Using it on a larger set gave me the thread exception error. Tried a lot of things to try to solve it however my knowledge is limited in programming languages.

Regarding the suggestion of placing the ProcessTime.Later attribute on the worker, apparently I cannot use it because it is an enum variable. At least that's what I understood after some research.

[lfcnassif]

Sorry for the delay here.

there were just a few itens, and If I got it right, in these cases you do use the ProcessTime.Later argument.

EDITED: Yes, the idea is: if there are a few items in the queue, enqueue new items so they can be distributed to workers that should become idle soon; if there are many items in the queue, other workers will be busy for some time, so pause processing current (parent) item and process the new subitems in the current worker to take advantage of memory/IO caches (this needs your task to be stateless to avoid overring parent item processing state with its subitems processing state).

Regarding the suggestion of placing the ProcessTime.Later attribute on the worker, apparently I cannot use it because it is an enum variable. At least that's what I understood after some research.

I'll take a look to check if it is possible to use that java enum from python side.

[lfcnassif]

Try this, it worked here now:

from iped.engine.core import Worker
worker.processNewItem(newItem, Worker.ProcessTime.LATER);

[DHoelz]

It worked!
To be honest, I think I tried something similar. Well, it's working now with no errors.
Thanks!

[DHoelz]

@lfcnassif, about issue #1 I made a few tests and that thread error was a result of 3 corrupted files. All other scripts runs fine with no issues at all.

About the regripper custom reports, I commited the changes I made to my repository, however I just realised you import regripper from its repository, and the implementation I made changes the plugins folder directory. I created one subfolder for each hive, and in each subfolder you can put a text file with the plugins you wish the report to have.

Regirpper plugin folder structure:

Software folder with custom report files:

Should I change the folder location or try to change how the custom reports are made?

[lfcnassif]

Hi @DHoelz,

1. I still think this is strange. Corrupted files shouldn't break iped code, unless if they are breaking your script logic or thread handling...
2. Actually we download a custom regripper zip. Maybe we could fork regripper repo, apply your changes in the new fork and use it. Would that work for you?

[DHoelz]

@lfcnassif

1. It seems to be something specific with the external tool I'm using. The script logic is the same for other external tools I'm using and they seem to work fine (atleat till now).

If you have the time I can send you the script and, privately, the jumplist files I'm using.

2. Yes, that would work. I can make the PR and send you my plugins folder for you to test and see if it's worth the hassle. Would that be ok?

[lfcnassif]

If you have the time I can send you the script and, privately, the jumplist files I'm using.

Sure.

2. Yes, that would work. I can make the PR and send you my plugins folder for you to test and see if it's worth the hassle. Would that be ok?

Yes.

[DHoelz]

1. Please send me an e-mail or another form of contact I can send you the files.

2. Sent the PR.

[lfcnassif]

1. Please send me an e-mail or another form of contact I can send you the files.

It's on my profile.

2. Sent the PR.

Thank you!