Skip to content

Forensic artifact extraction from squid proxy cache and secondary log sources

License

Notifications You must be signed in to change notification settings

htnhan/squid-cache-extractor

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

29 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Squid Cache Extractor

Forensic artifact extraction from squid3 proxy cache and secondary log sources.

  • Parse headers and metadata from cached files residing in a squid cache_dir
  • Parse metadata from binary cache index cache_dir/swap.state
  • Parse secondary log data from squid store.log file

Usage

Dependencies

Functions

cache-extractor

parse-swap-state

parse-store-log

Output

json and csv output is designed to be indexed by log aggregation storage & visualization utlities such as elasticseach/kibana. See squid-cache-extractor-logstash

About

Forensic artifact extraction from squid proxy cache and secondary log sources

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • Python 100.0%