wombatlogical about wombattools

[pjrinaldi]

write the properties to datastream as their respective types, then compress the contents for each file as a single lz4frame so the file goes logical image header info, file/folder properties, file/folder compressed contents, next file/folder properties, file/folder compressed contents, etc... until the end where i stick the blake3 hash for the image, which would be calculated as i go or after i'm done by reading in the image file or just the contents?

[pjrinaldi]

wombatlogical and wombatexport work initially.

[pjrinaldi]

need to add itemtype and deleted to the logical image format.

[pjrinaldi]

itemtype and deleted are added and it's working. the very basic logical image is working and can also be imported into wombatforensics in a basic way. will need to figure out how to best display the import vs what i currently am doing, which gets the job done but might not be the ideal display methodology.

then i will also need to then upgrade the image format to account for properties from the various file systems. i don't need to worry about hexviewer, since whether it is the file hex viewer or the main image hexviewer, it will still just be the decompressed contents written to a tmp file and then displayed since there is no partition/volume structure and there is no gain to display it's location within the logical image.

[pjrinaldi]

need to decide when to hash and what constitutes the "whole logical image" for the logical image hashing purposes. Right now I am leaning towards all the information included up to but not including the global logical image hash, which is at the end.

[pjrinaldi]

added logical image hash and also added logical image hash verification to the wombatverify tool

working and closed for now. i'll open a new ticket if testing finds any issues.