OneNote Extraction Tool Adds JSON Output for Embedded Files

Didier Stevens has updated his onedump.py tool with a feature designed to simplify the extraction of embedded files from OneNote documents with the .one extension.

The new --jsonoutput option generates JSON data containing the embedded files found inside each OneNote file. The option can process multiple files in one command, such as `onedump.py --jsonoutput *.one`, avoiding the need to run the tool separately for every document.

The resulting JSON can be passed to Stevens' myjson-filter.py utility to write the embedded files to disk. In the example provided, the `-W hashvir` option saves each file using the SHA-256 hash of its contents as the filename, followed by the .vir extension.

Stevens said the JSON capability follows a feature already available in several of his other tools, which use JSON to present analysis results.

Sources: SANS Internet Storm Center.