Digital Forensics HW6.sh

#!/bin/bash
#Dustin Dodson & Simon Smith
#HW 6

#Array variables for storing file names and magic numbers:
declare -a filenames
declare -a magnums

#This line will find all files in directory tree and temporarily store them to a file
find . -type f > filenames.tmp

#This will loop through results and find magic numbers, temporarily storing them to a file
while read filename; do
    filenames+=($filename) #Read through file line by line and store each file name to 'filenames' variable
    head -c 6 "$filename" >> magicnums.tmp #Finds the magic number of each file and write them to file
done < filenames.tmp #Tells bash to read from filenames.tmp file

#Python script for reading in file names and magic numbers for comparisons
cat <<END >pyscpt.tmp.py
#!/usr/bin/env python
#Dustin Dodson & Simon Smith
#HW 6

#List variables for storing file names and magic numbers
filenames = list()
magnums = list()

#Opens filenames.tmp and reads each line into an item in the list
with open("filenames.tmp") as f:
    filenames = f.readlines()

#Opens magicnums.tmp and reads magic numbers 6 bytes at a time
f = open("magicnums.tmp", "rb")
while True:
    mgk = f.read(6)
    if len(mgk) < 6:
        break
    magnums.append(mgk)

#Removes the line terminators from magic numbers
for item in magnums:
    item = item.rstrip('\n')

#List variables for files that (do/do not) have gif extension, files that have gif magic number
hasexten = list()
noexten = list()
hasnum = list()

#Goes through each element and puts the indexes into respective list
for i in range(len(filenames)):
    if filenames[i].lower().find(".gif") > -1: #If it has .gif extension
        hasexten.append(i) #Add index to hasexten variable
    else: #If no .gif extension
        noexten.append(i) #Add index to noexten variable

    #If file has magic number, add it to hasnum variable
    if magnums[i].lower().find("GIF87a".lower()) > -1:
        hasnum.append(i)
    elif magnums[i].lower().find("GIF89a".lower()) > -1:
        hasnum.append(i)

#Once more, go through each filename, this time looking at categories
for i in range(len(filenames)):
    if i in hasexten: #If filename has .gif extension
        if i in hasnum: #...and if it has the magic number, then tell user
            print "%s Has proper file extension and magic number\n" % (filenames[i])
        else: #If it does not have the magic number, still tell user
            print "%s Has proper file extension, but incorrect magic number\n" % (filenames[i])
    elif i in noexten: #If file does not have .gif extension
        if i in hasnum: #...but still has magic number, tell user
            print "%s Has proper magic number, but incorrect file extension\n" % (filenames[i])
        else: #If not, tell user that it is in no way a GIF file
            print "%s Has no .gif file extension or magic number\n" % (filenames[i])
END

#Run my new Python script
python pyscpt.tmp.py

#Clean up mess
rm filenames.tmp magicnums.tmp pyscpt.tmp.py