Prefetch Automator Services for OS X

hansen_m · July 15, 2015, 8:55pm

I’ve created a few Finder automator services for Mac OS X to help with generating prefetch statements. These allow you to right click on a file in the Finder and copy the sha1, size or sha256 to your clipboard.

To install them just open the zip and double click the .workflow files and you will be prompted to install them (or open them with automator to see what they actually do).

https://psu.box.com/s/dp5pqur9url8chwtd0qoorz8st2hq931

jgstew · August 12, 2015, 3:22pm

Could a single automator service just make a full prefetch?

hansen_m · August 12, 2015, 4:21pm

Yes, that wouldn’t be too difficult. Thoughts on the url? Blank? Configurable? Placeholder?

I wanted to do something with extended attribute data to grab the url the file was originally downloaded from, but that would only work if the file was downloaded using a web browser on the Mac. Similar to this - https://github.com/jakepetroules/wherefrom/blob/master/wherefrom

TimRice · August 12, 2015, 5:05pm

I’d prefer a placeholder for the URL, but Blank works as well.

hansen_m · August 12, 2015, 8:33pm

I added this to GitHub to make things a little easier. https://github.com/hansen-m/bigfix-automator-services/

And I added two new services, ‘Make-Prefetch from File’ and ‘Make-Prefetch from URL’. These are based on the make-prefetch.py utility (https://github.com/bigfix/make-prefetch). With a small modification for grabbing the url metadata from a file, or if it doesn’t exist it will use the default value of ‘http://REPLACEME’

github.com

hansen-m/bigfix-automator-services/blob/master/prefetch/Make-Prefetch from File.workflow/Contents/document.wflow#L172


        "end prefetch block")


def value_output(algorithm):
if algorithm == 'sha1':
  return "{sha1}"
if algorithm == 'sha256':
  return "{sha256}"
print("You must specify a hash algorithm to use")
sys.exit(2)


def getkMDItemWhereFroms(file_path, default_return):
  import json
  import xattr
  
  from subprocess import Popen, PIPE


  if u'com.apple.metadata:kMDItemWhereFroms' in xattr.listxattr(file_path):
      bplist_data = xattr.getxattr(file_path, 'com.apple.metadata:kMDItemWhereFroms')
      
      args = ["/usr/bin/plutil", "-convert", "json", "-o", "-", "--", "-"]
      p = Popen(args, stdin=PIPE, stdout=PIPE)

jgstew · August 13, 2015, 3:50am

Very cool!

Also, I agree with having a placeholder, particularly because if it happens to already be cached, you don’t actually have to change it for it to work.

gearoid · August 13, 2015, 11:20am

Does it make sense to add this kind of thing to the bigfix make-prefetch project on github ?
You could submit a PR to the project.

hansen_m · August 13, 2015, 6:56pm

Might make sense, although the Services are entirely dependent on OS X.

jgstew · August 13, 2015, 11:01pm

I think it could be a user of that project or a similar one, but I think it is its own separate thing, unless that project becomes the location to put many different items that create prefetches even if they are otherwise independent.