Question

我的代码似乎出现属性错误，我似乎无法理解此错误的来源。我只是不明白为什么我似乎会收到此错误。

# 1. Add pytsk3
import pytsk3
# 2. Add Python Registry
from Registry import Registry
# 3. Add pyewf
import pyewf
# Define the helper class based on pytsk3 Img_Info class
class e01_file_helper(pytsk3.Img_Info):
    # Define a constructor to setup the object
    # It expects a pyewf.handle object
    def __init__(self, ewf_handle):
        self._ewf_handle = ewf_handle
        super(e01_file_helper, self).__init__(url="", type=pytsk3.TSK_IMG_TYPE_EXTERNAL)

    # This method overrides Img_info close to close the handle object
    def close(self):
        self._ewf_handle.close()

    # This method overrides the Img_Info read method to read data
    # from the handle object rather than image file directly
    def read(self, offset, size):
        self._ewf_handle.seek(offset)
        return self._ewf_handle.read(size)

    # This method overrides the Img_Info get_size method to
    # get the size of the image from the handle object
    def get_size(self):
        return self._ewf_handle.get_media_size()

# 4. Create a glob object to read ExampleImageForPyewf.E01 which is an image of DiskImage.RAW
e01_glob = raw_input("please enter the registry you want to process: ")
e01_glob = pyewf.glob(e01_glob)

# 5. Create a handle object which will be used link the E01 file(s) to
the program
e01_handle = pyewf.handle()
# 6. Open (link) the E01 file with the handle
e01_handle.open(e01_glob)
# 7. Create the helper object to readE01 file
e01helper = e01_file_helper(e01_handle)

# 8. Open file system.  Note this example is hardwired
# to open the file system at sector 63.  Won't work on
# other evidence files
file_system = pytsk3.FS_Info_Con(e01helper, 63 * 512)
# 9. Open the SOFTWARE registry file directly
# This should be okay for other Windows as Registry files are
# in the same location for Windows XP, Vista, 7, 8 and 10
software_file = file_system.open('/WINDOWS/system32/config/software')
# 10. Read the contents of the SOFTWARE file into memory from evidence
file
# a bit dangerous as SOFTWARE file can be quite large.  Works for the
example
# you will get.  Better approach is to read and write blocks of data from
# Registry file like the way hash values were calculated in previous
example
software_file_contents = software_file.read_random(0,
software_file.info.meta.size)
# 11. Open a file in the local PC called SOFTWARE to store bytes read
above
# write as binary
f = open('software','wb')
# 12. Write the SOFTWARE file to local file
f.write(software_file_contents)
# 13. Close the file before opening with Python Registry
f.close()
# 15. Now open the file written previously with Python Registry
software_reg = Registry.Registry('SOFTWARE')
# 16. Get the CurrentVersion key
key = software_reg.open('Microsoft\\Windows NT\\CurrentVersion')
# 17. Get the value for Productname
v = key['ProductName']
# 18. Display the value stored
print "Product name is %s" % (v.value())

发生的异常：

  exceptions.AttributeError 'module' object has no attribute 'FS_Info_Con'
File "/home/apdf/Myfiles/PytskRegistryEx1].py", line 44, in

这似乎是我得到的错误。

Answer 1

模块pytsk3没有名称为FS_Info_Con的成员，您可能正在寻找pytsk3.FS_Info。您应该真正阅读错误消息。 exceptions.AttributeError 'module' object has no attribute 'FS_Info_Con' File "/home/apdf/Myfiles/PytskRegistryEx1].py", line 44表示模块对象没有属性FS_Info_Con，并且此行中的此文件中有错误。

此外，尽管评论很好，但所有这些都有些过分。弊大于利。调低一点，只评论一些难以理解的内容，而不是每一行。

不了解此AttributeError的原因

1 个答案: