harelsegev / indxripper Goto Github PK
View Code? Open in Web Editor NEWCarve file metadata from NTFS index ($I30) attributes
License: MIT License
Carve file metadata from NTFS index ($I30) attributes
License: MIT License
See this section from the libfsntfs documentation.
If MFT records in range 12 - 15 or 16 - 23 are used to expand the MFT, use all the extra $DATA attributes to find all of the MFT data.
Happens if the MFT entry size is bigger than the cluster size
When running INDXParser.py against both a single E01 and a series of split E01 files, I am presented with the following error:
INDXRipper: error: invalid volume boot record
All of the following command produce the same error
Single E01:
python3.9 ../tools/INDXRipper/INDXRipper.py /mnt/hgfs/testing/Disk1.E01 outfile
Split E01, with offset (2048)
python3.9 ../tools/INDXRipper/INDXRipper.py -o 2048 /mnt/hgfs/testing/Disk2-Collection/Disk2.E01 outfile
Split E01, with calculated offset (2048x512)
python3.9 ../tools/INDXRipper/INDXRipper.py -o 1048576 /mnt/hgfs/testing/Disk2-Collection/Disk2.E01 outfile
I have followed the updated instructions for setting up a venv and have ran into the following error:
$ sudo venv/bin/python tools/INDXRipper/INDXRipper.py -w csv -o 576716800 /mnt/i30_disk1.E01/ewf1 outfile
Traceback (most recent call last):
File "/opt/elrond/elrond/tools/INDXRipper/INDXRipper.py", line 309, in <module>
main()
File "/opt/elrond/elrond/tools/INDXRipper/INDXRipper.py", line 300, in main
vbr = get_boot_sector(raw_image, args.o * args.b)
File "/opt/elrond/elrond/tools/INDXRipper/ntfs.py", line 160, in get_boot_sector
return BOOT_SECTOR.parse_stream(raw_image)
File "/opt/elrond/elrond/venv/lib/python3.9/site-packages/construct/core.py", line 300, in parse_stream
return self._parsereport(stream, context, "(parsing)")
File "/opt/elrond/elrond/venv/lib/python3.9/site-packages/construct/core.py", line 312, in _parsereport
obj = self._parse(stream, context, path)
File "/opt/elrond/elrond/venv/lib/python3.9/site-packages/construct/core.py", line 2120, in _parse
subobj = sc._parsereport(stream, context, path)
File "/opt/elrond/elrond/venv/lib/python3.9/site-packages/construct/core.py", line 312, in _parsereport
obj = self._parse(stream, context, path)
File "/opt/elrond/elrond/venv/lib/python3.9/site-packages/construct/core.py", line 4101, in _parse
stream_read(stream, pad, path)
File "/opt/elrond/elrond/venv/lib/python3.9/site-packages/construct/core.py", line 91, in stream_read
raise StreamError("stream read less than specified amount, expected %d, found %d" % (length, len(data)), path=path)
construct.core.StreamError: Error in path (parsing)
stream read less than specified amount, expected 3, found 0
I have two offsets for the disk:
And I can't not run it as sudo, as the mount point permissions for /mnt/i30_disk1/ewf1 cannot be altered:
chmod: changing permissions of '/mnt/i30_disk1.E01': Function not implemented
chmod: changing permissions of '/mnt/i30_disk1.E01/ewf1': Function not implemented
Other than RAW images, what kind of images (E01/VMDK) are supported? Thanks!
This can happen if the $FILE_NAME attribute is in an extension record, the file gets deleted and the extension record is overwritten
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.