Support EWF reading for dead disk analysis

Velocidex / velociraptor

Digging Deeper....

https://docs.velociraptor.app/

Other

2.89k stars 480 forks source link

Support EWF reading for dead disk analysis #1840

Closed scudette closed 9 months ago

scudette commented 2 years ago

Currently we only support dd images so we need to use ewffuse or similar to access the ewf data. This is an extra unnecessary step and we should be able to just read the e01 files directly.

mgreen27 commented 2 years ago

Just a note to also add partition images or an offset in case our mmls equivalent does not work.

scudette commented 9 months ago

Fixed by #3181