cca-public / diskimageprocessor Goto Github PK

Alert user if diff is found

fiwalk and tsk_recover work on some disks that will not mount in BitCurator. Potential solution: Give users option of which tool combo to use?

See: https://github.com/cul-it/hfs2dfxml/tree/python3

• E01 disk image
• HFS disk
• UDF disk

Will require change to brunnhilde command to skip virus scan

Only report on most tasks when there is a failure.

To retain file system dates

• Currently being pulled by walking down objects/files/ directory
• Might be more accurate to pull from DFXML (different type of MAC date based on filesystem?)

https://github.com/simsong/dfxml/blob/master/python/walk_to_dfxml.py

Currently uses phrase "logical files". Is another phrase more accessible/understandable to end users? Maybe "digital files"?

• Run DFXML in process: md5deep -rd DIR > DFXML.xml
• Parse DFXML for dates, extent (always use last modified dates? give user option?)

tsk_recover won't carve files from UDF disks

Potential solution: http://manpages.ubuntu.com/manpages/trusty/man1/dares.1.html

Disks with multiple volumes/partitions (see test images) may only have files exported from one volume, depending on what tsk_recover is able to do.

Hello,

I'm trying to process an E01 But getting the following error;

Source of disk images: /home/user/Desktop/sample/

NEW FILE: 2011-10-19-Sample.E01
ewfexport 20170703

Export started at: Sep 19, 2017 16:39:21
This could take a while.

Export completed at: Sep 19, 2017 16:39:22

Written: 149 MiB (157285888 bytes) in 1 second(s) with 149 MiB/s (157285888 bytes/second)
MD5 hash calculated over data: cc2421556f455150c47081438036dd46
ewfexport: SUCCESS
/bin/sh: 1: disktype: not found
File system:
NOTICE: Skipping processing of unknown disk type.
Processing complete. Skipped disks: 2011-10-19-Sample.E01
ERROR: DFXML file for /home/user/Desktop/test20/SIPs/2011-10-19-Sample.E01 not well-formed.
All SIPs described in spreadsheet. Process complete.

Am I missing something?

Thanks!

Would it be possible to provide diskimageprocessor the option to take in a value for the tsk_recover sector offset argument? Similar to the way brunnhilde can work as documented here: tw4l/brunnhilde#20

For disks described in that brunnhilde issue, diskimageprocessor.py (and the GUI) currently is not able to carve out files and, consequently, produce any of the brunnhilde reports.

The install file hardcodes in the user bcadmin. I got around this by changing it to my username.

This line:

https://github.com/timothyryanwalsh/cca-diskimageprocessor/blob/master/diskimageanalyzer.py#L26

assumes dfxml tools are installed I think- how do I install them?

The error I'm seeing when trying to analyse is:

Traceback (most recent call last):
File "/usr/share/ccatools/diskimageprocessor/diskimageanalyzer.py", line 26, in
import Objects
ImportError: No module named 'Objects'

• Types of files (raw disk image, forensic disk image, other)
• File system

Siegfried identifies .raw disk images as raw bitmap image files, which causes issues with normalization to access. Consider appropriate extension and implement.

Hello,
when I try to use Disk image processor to process a batch of .img files made from floppy disks, the image processor only processes one at a time and makes one SIP, instead of making multiple individual SIPs. What I have tried so far is to isolate all of the .img files in its own folder (meaning no log files, no other folders, just the .img files in the folder) and selecting this folder as the directory to be processed. Before I process, I do not select any of the options offered at the bottom of the window (bag SIPs, run bulk_extractor, ect.). When I do click Start scan, only the first img. file is processed (first being the first .img file in the list when sorted by file name). Can anyone help me out with this please? Thank you!