{"id":1478,"date":"2017-03-31T09:47:26","date_gmt":"2017-03-31T09:47:26","guid":{"rendered":"http:\/\/dfire.ucd.ie\/?p=1478"},"modified":"2018-01-19T12:49:30","modified_gmt":"2018-01-19T12:49:30","slug":"forensic-prolog","status":"publish","type":"post","link":"https:\/\/dfire.ucd.ie\/?p=1478","title":{"rendered":"DFIRE Forensic Prolog"},"content":{"rendered":"<h1 class=\"p1\">Introduction<\/h1>\n<p class=\"p1\">Digital forensic examiners rely on software tools to analyze digital evidence and answer investigative questions. Although the ability to create custom software is not required in every investigation, it is important to be able to automate repetitive processing tasks. A variety of general-purpose programming\u00a0languages is used for that purpose\u00a0ranging from C and Bash scripting, to Perl, Python, and Go. \u00a0Several attempts were made to create special-purpose\u00a0programming languages for digital forensics, such as the adoption of X-Query language in XIRAF (Alink et al, 2006), DERRIC language (van Der Bos and van Der Storm, 2011) for describing recursive data structures, and NUGGET (Roussev, 2015) based on the data flow abstraction. \u00a0All of them try to minimize the amount of code that needs to be written in order to perform particular forensic tasks.<\/p>\n<p class=\"p1\">DFIRE Forensic Prolog (DFP) is a forensic extension of Prolog language.\u00a0<span class=\"s1\">Unlike traditional data-centric programming languages, Prolog focuses on the logical inference: the data is viewed as evidence for proving statements posed by the user. Prolog is well suited for-creating forensic expert systems that query file systems, Registry hives, and other tree-like data structures. Standard Prolog has a built-in data parsing mechanism, which makes it suitable for natural language processing. DFIRE Forensic Prolog introduces additional language features and extensions to Prolog\u00a0that make it suitable for use in digital forensics. Given below is the list of key featrues<\/span><\/p>\n<h2 class=\"p1\">DFIRE Forensic Prolog Features<\/h2>\n<ul>\n<li class=\"p1\"><span class=\"s1\">ability to ingest and process forensic disk images as well as stand-alone files<\/span><\/li>\n<li class=\"p1\"><span class=\"s1\">ability to parse binary data<\/span><\/li>\n<li class=\"p1\"><span class=\"s1\">ability to use Java-style regular expressions\u00a0<\/span><\/li>\n<li class=\"p1\"><span class=\"s1\">support for\u00a0probabilistic\u00a0reasoning using <a href=\"https:\/\/dtai.cs.kuleuven.be\/problog\/\">ProbLog<\/a>.<\/span><\/li>\n<li class=\"p1\"><span class=\"s1\">native support for 64-bit integers and date\/time stamps (as first class data object).<\/span><\/li>\n<li class=\"p1\"><span class=\"s1\">close integration with Python. DFP can contain snippets of Python code and use Python packages. <\/span><\/li>\n<li class=\"p1\"><span class=\"s1\">ability to access and manipulate case files created by Autopsy forensic browser v3.3 <\/span>\n<ul>\n<li class=\"p1\"><span class=\"s1\">run queries over the case data, <\/span><\/li>\n<li class=\"p1\"><span class=\"s1\">add\u00a0derived files to the case,<\/span><\/li>\n<li class=\"p1\"><span class=\"s1\">create reports<\/span><\/li>\n<\/ul>\n<\/li>\n<li class=\"p1\">performance-critical predicates\u00a0can be coded using in-line Scala code<\/li>\n<\/ul>\n<p><span class=\"s1\">Additional features are under development.<\/span><\/p>\n<h2>Supported Platforms<\/h2>\n<p>DFIRE Forensic Prolog supports <strong>64-bit<\/strong> versions of<\/p>\n<ul>\n<li>Windows 7\/8\/10,<\/li>\n<li>Ubuntu Linux (since 14.02 LTS), and<\/li>\n<li>Mac OS X (since 10.10).<\/li>\n<\/ul>\n<h1>Installing and Using DFP<\/h1>\n<p><span style=\"color: #800000;\">DISCLAIMER: DFIRE Forensic Prolog is currently in Alpha stage. Some bugs and functionality changes are to be expected.<\/span><\/p>\n<p>The source code of the project is hosted on bitbucket.org:\u00a0<a href=\"http:\/\/bitbucket.org\/dfirelabs\/forensic-prolog\/overview\">http:\/\/bitbucket.org\/dfirelabs\/forensic-prolog\/overview<\/a><\/p>\n<p>A number of free software packages must\u00a0be installed prior to DFP. These are the\u00a0following:<\/p>\n<ul>\n<li><a href=\"http:\/\/www.oracle.com\/technetwork\/java\/javase\/downloads\/java-archive-javase8-2177648.html\">Oracle Java SE Development Kit 8<\/a> (make sure it is the <strong>64 bit<\/strong> version!).<\/li>\n<li><a href=\"http:\/\/www.scala-lang.org\/download\/2.12.3.html\">Scala programming language <strong>2.12.3<\/strong><\/a>\u00a0(this specific version!)<\/li>\n<li>Python 2.7 (make sure it is the <strong>64-bit<\/strong> version!)<\/li>\n<li>If you are running Ubuntu Linux, then you will also need to install <strong>libtsk-dev<\/strong> pacjage using apt.<\/li>\n<li>If you are running Windows OS, then you will also need to download and install\u00a0Microsoft Visual C++ Compiler for Python 2.7<\/li>\n<\/ul>\n<p>Once the above packages are installed, you will need to<\/p>\n<ul>\n<li>set JAVA_HOME environment variable = the path to the install folder of the Java SE Development Kit 8.<\/li>\n<li>on Windows you will also need to add C:\\Python27 to the system Path variable<\/li>\n<\/ul>\n<p>Next you will need to install\u00a0the required Python packages. Use pip or easy_install to install<\/p>\n<ul>\n<li>jep (version 3.6.3 !)<\/li>\n<li>numpy<\/li>\n<li>problog<\/li>\n<\/ul>\n<p>On Windows, this could be achieved using, for example<\/p>\n<pre>C:\/&gt; <strong>python -m pip install jep==3.6.3 numpy problog<\/strong><\/pre>\n<p>Finally, download DFP code. On windows, this can be achieved using<\/p>\n<pre>C:\\Users\\DFIRe\\Desktop&gt;\u00a0<strong>git clone\u00a0http:\/\/bitbucket.org\/dfirelabs\/forensic-prolog\r\n<\/strong><\/pre>\n<h2 id=\"markdown-header-recompiling-forensic-prolog\">Compiling DFP:<\/h2>\n<p>Before using DFP\u00a0you need to\u00a0compile\u00a0it. Open command line window, cd into the cloned forensic-prolog folder and type<\/p>\n<p>in Windows CMD.EXE:<\/p>\n<pre>C:\\Users\\DFIRe\\Desktop\\forensic-prolog&gt;<strong>compile<\/strong><\/pre>\n<p>in Linux, Mac OS X, and in Windows PowerShell:<\/p>\n<pre>PS C:\\Users\\DFIRe\\Desktop\\forensic-prolog&gt;<strong>.\/compile<\/strong><\/pre>\n<h2 id=\"markdown-header-running-forensic-prolog\">Running forensic Prolog:<\/h2>\n<p>To run Forensic Prolog, open command line window, cd into the cloned forensic-prolog folder and type<\/p>\n<p>in Windows CMD.EXE:<\/p>\n<pre>C:\\Users\\DFIRe\\Desktop\\forensic-prolog&gt;<strong>run<\/strong><\/pre>\n<p>in Linux, Mac OS X, and in Windows PowerShell:<\/p>\n<pre>PS C:\\Users\\DFIRe\\Desktop\\forensic-prolog&gt;<strong>.\/run<\/strong><\/pre>\n<p>To start using Forensic Prolog, read FORENSIC-PROLOG.txt and explore examples in forensic\/ folder.\u00a0Unless you are an active Prolog developer, you will also need to readup on Prolog. There are many good books and free online tutorials:<\/p>\n<ul>\n<li><a href=\"http:\/\/www.learnprolognow.org\/\" rel=\"nofollow\">http:\/\/www.learnprolognow.org\/<\/a><\/li>\n<li>I. Bratko &#8220;Prolog Programming for Artificial Intelligence&#8221; book.<\/li>\n<\/ul>\n<h1>Talks &amp; presentations<\/h1>\n<p><a href=\"http:\/\/ucd2.adobeconnect.com\/p4oga6n18lg\/\">Seminar talk<\/a> at UCD School of Computer Science outlining the reasons for choosing Prolog as a basis for domain-specific programming language.<\/p>\n<p>We will also write some tutorials when we get more time \ud83d\ude09<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Introduction Digital forensic examiners rely on software tools to analyze digital evidence and answer investigative questions. Although the ability to create custom software is not required in every investigation, it is important to be able to automate repetitive processing tasks. A variety of general-purpose programming\u00a0languages is used for that purpose\u00a0ranging from C and Bash scripting, [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":1483,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[68],"tags":[],"class_list":["post-1478","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-software"],"_links":{"self":[{"href":"https:\/\/dfire.ucd.ie\/index.php?rest_route=\/wp\/v2\/posts\/1478"}],"collection":[{"href":"https:\/\/dfire.ucd.ie\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dfire.ucd.ie\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dfire.ucd.ie\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dfire.ucd.ie\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1478"}],"version-history":[{"count":14,"href":"https:\/\/dfire.ucd.ie\/index.php?rest_route=\/wp\/v2\/posts\/1478\/revisions"}],"predecessor-version":[{"id":1497,"href":"https:\/\/dfire.ucd.ie\/index.php?rest_route=\/wp\/v2\/posts\/1478\/revisions\/1497"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dfire.ucd.ie\/index.php?rest_route=\/wp\/v2\/media\/1483"}],"wp:attachment":[{"href":"https:\/\/dfire.ucd.ie\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1478"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dfire.ucd.ie\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1478"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dfire.ucd.ie\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1478"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}