blob: ff996037fb67a47b9ef777ebf8bf38f3e562ee3b (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
|
dfvfs (Digital Forensics Virtual File System - python module)
This package provides read-only access to file-system objects from various
storage media types and file formats. The goal of dfVFS is to provide a generic
interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media
types, volume systems and file systems.
Supported:
EWF (EWF-E01, EWF-Ex01, EWF-S01)
QCOW version 1, 2
Storage Media device
(split) Storage Media RAW
VHD
VMDK
Note that at the moment differential images are not supported.
Volume systems
Supported:
APM
BitLocker (BDE)
GPT
MBR
VSS
Planned:
FileVault2 (CoreStorage)
LDM
LUKS
Linux LVM version 1, 2
Software Raid
File systems
Supported file systems:
ext version 2, 3, 4
FAT
HFS, HFS+, HFSX
NTFS version 3
UFS version 1, 2
TODO add more detail here regarding FAT and other supported FS
Compressed stream file types
Supported:
bzip2
gzip
zlib (both zlib-DEFLATE and raw-DEFLATE)
Archive file types
Supported:
tar
zip
|
