The Sleuth Kit Framework  4.1
Sample Pipeline Config File
<?xml version="1.0" encoding="utf-8"?>
<!-- Contains only the modules that ship with TSK -->
<PIPELINE_CONFIG>
<PIPELINE type="FileAnalysis">
<MODULE order="1" type="plugin" location="tskHashCalcModule"/>
<!--<MODULE order="2" type="plugin" location="tskHashLookupModule" arguments="TODO: See README for how to create NSRL index file"/>-->
<MODULE order="3" type="plugin" location="tskFileTypeSigModule"/>
<MODULE order="4" type="plugin" location="tskEntropyModule"/>
<MODULE order="5" type="plugin" location="tskZipExtractionModule"/>
<MODULE order="6" type="plugin" location="tskLibExifModule"/>
</PIPELINE>
<PIPELINE type="PostProcessing">
<!--This pipeline configuration assumes that the RegRipper executable is named rip.exe and is present in the program directory-->
<!--<MODULE order="1" type="plugin" location="tskRegRipperModule" arguments="-e #PROG_DIR#/RegRipper/rip.exe; -o #MODULE_OUT_DIR#/RegRipper/"/>-->
<MODULE order="2" type="plugin" location="tskInterestingFilesModule" arguments="#MODULE_CONFIG_DIR#/InterestingFilesModule/interesting_files.xml"/>
<MODULE order="3" type="plugin" location="tskSaveInterestingFilesModule"/>
<MODULE order="4" type="plugin" location="tskSummaryReportModule"/>
</PIPELINE>
</PIPELINE_CONFIG>

Copyright © 2011-2013 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.