Session 03 - Python for Forensics

The code here is to support the Session 03 lecture.

database.py

import sys, sqlite3

def getCSV(conn, tgtTbl):
    csv = ""
    csv_cursor = conn.cursor()
    data = csv_cursor.execute("SELECT * FROM " + tgtTbl + ";")
    for row in data:
        csv += ', '.join(map(str, row)) + "\n"
    return csv

def usage():
    print("[-] Incorrect arguments...")
    print("Usage:", sys.argv[0], "<database>")
    sys.exit()

if len(sys.argv) != 2:
    usage()

tgtBase = sys.argv[1]

conn = sqlite3.connect(tgtBase)
c = conn.cursor()
results = c.execute("SELECT tbl_name FROM sqlite_master WHERE type = 'table';")

for table in results:
    tableName = table[0]
    print("[+] Processing Table:", tableName)
    fileName = tableName + ".csv"
    f = open(fileName, 'w')
    f.write(getCSV(conn, tableName))
    f.close()

conn.close()