summaryrefslogtreecommitdiff
path: root/python/dfvfs/README
blob: dc49626dcd9cb00c5c8b6951d568c6ac0b3138f9 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
dfvfs (Digital Forensics Virtual File System - python module)

This package provides read-only access to file-system objects from various 
storage media types and file formats. The goal of dfVFS is to provide a generic
interface for accessing file-system objects, for which it uses several 
back-ends that provide the actual implementation of the various storage media 
types, volume systems and file systems.

A note about REQUIREMENTS:  dfvfs requires the following packages [secondary
dependancies are listed in brackets].  They should be installed IN THE ORDER
LISTED. This is important because while libewf support is optional for the
sleuthkit (a requirement for pytsk), it is a REQUIRED option for the sleuthkit
when building dfvfs.  Do NOT rely on automated tools to properly order your
dependancies.

REQUIRES="[six] construct [pysetuptools] [python-gflags] [python-dateutil]
[pytz] protobuf libbde libewf libqcow libsigscan libsmdev libsmraw libvhdi
libvmdk libvshadow [sleuthkit] pytsk"

Supported:

    EWF (EWF-E01, EWF-Ex01, EWF-S01) 
    QCOW version 1, 2 
    Storage Media device 
    (split) Storage Media RAW 
    VHD 
    VMDK 

Note that at the moment differential images are not supported.
Volume systems

Supported:

    APM 
    BitLocker (BDE) 
    GPT 
    MBR 
    VSS 

Planned:

    FileVault2 (CoreStorage) 
    LDM
    LUKS 
    Linux LVM version 1, 2 
    Software Raid 

File systems

Supported file systems:

    ext version 2, 3, 4 
    FAT 
    HFS, HFS+, HFSX 
    NTFS version 3 
    UFS version 1, 2 

Archive file types

Supported:

    tar
    zip