# PDForensic
## Description
This package analyses PDF files for Forensic Investigations.
## Requirements
This package require :
- python3
- python3 Standard Library
## Installation
```bash
pip install PDForensic
```
## Usages
### Command line
```bash
python3 -m PDForensic sample.pdf
python3 PDForensic.pyz sample.pdf
PDForensic sample.pdf
PDForensic objstm.pdf --data --hexa 000102
PDForensic objstm.pdf --data --types objstm --no-csv --no-json
PDForensic objstm.pdf --data --logs 20 --regex '[0-9a-f]{32}' --no-csv --no-json
cat blank.pdf | PDForensic - *.pdf ../*.pdf https://www.pdfscripting.com/public/FreeStuff/PDFSamples/TheFlyv3_EN4Rdr.pdf
PDForensic https://www.pdfscripting.com/public/FreeStuff/PDFSamples/TheFlyv3_EN4Rdr.pdf --data --ids 79 83 --ids 84 --strings URI --no-csv --no-json
```
### Python script
```python
from PDForensic import PDForensic
class MyPDFparser(PDForensic):
def __init__(self):
super().__init__("objstm.pdf")
def handle(self, type_: str, data: bytes, typename: str = "") -> None:
print(type_, data, typename)
parser = MyPDFparser()
parser.parse()
print(parser.report())
class MyPDFparser(PDForensic):
def __init__(self):
super().__init__("objstm.pdf", process_data = True, process_tags = False, filter_ = True, strings = ["/Pages"], hexa = ["000102"], regexs = ['[0-9a-f]{32}'], types = ["xref"], ids = [2])
def handle(self, type_: str, data: bytes, typename: str = "") -> None:
print(type_, data, typename)
parser = MyPDFparser()
parser.parse()
print(parser.report())
```
## Links
- [Github Page](https://github.com/mauricelambert/PDForensic/)
- [Documentation](https://mauricelambert.github.io/info/python/security/PDForensic.html)
- [Pypi package](https://pypi.org/project/PDForensic/)
- [Executable](https://mauricelambert.github.io/info/python/security/PDForensic.pyz)
## Licence
Licensed under the [GPL, version 3](https://www.gnu.org/licenses/).
Raw data
{
"_id": null,
"home_page": "https://github.com/mauricelambert/PDForensic",
"name": "PDForensic",
"maintainer": "Maurice Lambert",
"docs_url": null,
"requires_python": ">=3.8",
"maintainer_email": "mauricelambert434@gmail.com",
"keywords": "Forensic, PDF, Portable Document Format, ISO 32000, Investigations, Parser, Analysis, Security",
"author": "Maurice Lambert",
"author_email": "mauricelambert434@gmail.com",
"download_url": "https://files.pythonhosted.org/packages/44/ab/49a05e5876176a689f9e88bad536412cae385c444645fd9a008a9ebb626c/pdforensic-0.3.0.tar.gz",
"platform": "Windows",
"description": "![PDForensic logo](https://mauricelambert.github.io/info/python/security/PDForensic_small.png \"PDForensic logo\")\n\n# PDForensic\n\n## Description\n\nThis package analyses PDF files for Forensic Investigations.\n\n## Requirements\n\nThis package require :\n - python3\n - python3 Standard Library\n\n## Installation\n```bash\npip install PDForensic\n```\n\n## Usages\n\n### Command line\n\n```bash\npython3 -m PDForensic sample.pdf\npython3 PDForensic.pyz sample.pdf\nPDForensic sample.pdf\n\nPDForensic objstm.pdf --data --hexa 000102\nPDForensic objstm.pdf --data --types objstm --no-csv --no-json\nPDForensic objstm.pdf --data --logs 20 --regex '[0-9a-f]{32}' --no-csv --no-json\ncat blank.pdf | PDForensic - *.pdf ../*.pdf https://www.pdfscripting.com/public/FreeStuff/PDFSamples/TheFlyv3_EN4Rdr.pdf\nPDForensic https://www.pdfscripting.com/public/FreeStuff/PDFSamples/TheFlyv3_EN4Rdr.pdf --data --ids 79 83 --ids 84 --strings URI --no-csv --no-json\n```\n\n### Python script\n\n```python\nfrom PDForensic import PDForensic\n\nclass MyPDFparser(PDForensic):\n def __init__(self):\n super().__init__(\"objstm.pdf\")\n def handle(self, type_: str, data: bytes, typename: str = \"\") -> None:\n print(type_, data, typename)\nparser = MyPDFparser()\nparser.parse()\nprint(parser.report())\n\n\nclass MyPDFparser(PDForensic):\n def __init__(self):\n super().__init__(\"objstm.pdf\", process_data = True, process_tags = False, filter_ = True, strings = [\"/Pages\"], hexa = [\"000102\"], regexs = ['[0-9a-f]{32}'], types = [\"xref\"], ids = [2])\n def handle(self, type_: str, data: bytes, typename: str = \"\") -> None:\n print(type_, data, typename)\nparser = MyPDFparser()\nparser.parse()\nprint(parser.report())\n```\n\n## Links\n\n - [Github Page](https://github.com/mauricelambert/PDForensic/)\n - [Documentation](https://mauricelambert.github.io/info/python/security/PDForensic.html)\n - [Pypi package](https://pypi.org/project/PDForensic/)\n - [Executable](https://mauricelambert.github.io/info/python/security/PDForensic.pyz)\n\n## Licence\n\nLicensed under the [GPL, version 3](https://www.gnu.org/licenses/).\n",
"bugtrack_url": null,
"license": "GPL-3.0 License",
"summary": "This tool analyses PDF files for Forensic Investigations",
"version": "0.3.0",
"project_urls": {
"Documentation": "https://mauricelambert.github.io/info/python/security/PDForensic.html",
"Executable": "https://mauricelambert.github.io/info/python/security/PDForensic.pyz",
"Homepage": "https://github.com/mauricelambert/PDForensic"
},
"split_keywords": [
"forensic",
" pdf",
" portable document format",
" iso 32000",
" investigations",
" parser",
" analysis",
" security"
],
"urls": [
{
"comment_text": "",
"digests": {
"blake2b_256": "44ab49a05e5876176a689f9e88bad536412cae385c444645fd9a008a9ebb626c",
"md5": "8857169cfd42eed63f6ad56cbf447d65",
"sha256": "8aa159227984a68b23421d0e9eb72e78a1cdca899aa8a966355407058d519edc"
},
"downloads": -1,
"filename": "pdforensic-0.3.0.tar.gz",
"has_sig": false,
"md5_digest": "8857169cfd42eed63f6ad56cbf447d65",
"packagetype": "sdist",
"python_version": "source",
"requires_python": ">=3.8",
"size": 27383,
"upload_time": "2024-09-08T14:01:53",
"upload_time_iso_8601": "2024-09-08T14:01:53.387217Z",
"url": "https://files.pythonhosted.org/packages/44/ab/49a05e5876176a689f9e88bad536412cae385c444645fd9a008a9ebb626c/pdforensic-0.3.0.tar.gz",
"yanked": false,
"yanked_reason": null
}
],
"upload_time": "2024-09-08 14:01:53",
"github": true,
"gitlab": false,
"bitbucket": false,
"codeberg": false,
"github_user": "mauricelambert",
"github_project": "PDForensic",
"travis_ci": false,
"coveralls": false,
"github_actions": false,
"lcname": "pdforensic"
}
JSON
