search

pjrinaldi / wombatforensics

linux c++, fox-toolkit, multi-threaded forensic gui tool
GNU General Public License v2.0
47 stars 12 forks source link

FAT12 File System Parsing #347

Closed pjrinaldi closed 8 months ago

pjrinaldi commented 3 years ago

manual implementation of FAT12 File System parser.

pjrinaldi commented 3 years ago

added dir size so there is slack as well based on the number of dir entries in the directory.

FAT12 seems to be working properly for parsing.

pjrinaldi commented 3 years ago

There is an error in my hexviewer highlight code, where the slack is starting too soon, so the filesize is off somewhere vs the offset + blocksize etc...

need to investigate and fix and then i think FAT12 is working for manually parsing, minus no other wombat backend tools are working such as opening an existing case, saving the tree, opening the tree, exporting, etc...

pjrinaldi commented 3 years ago

fixed slack is for non-continuous content blocks.

now to just implement all the other features using the new parsing stuff.

pjrinaldi commented 3 years ago

Implemented and working well with testing images I have.

pjrinaldi commented 8 months ago

wil implement fat12 orphans and then test it once i get an img with an orphaned fat file.

pjrinaldi commented 8 months ago

implemented fat12 orphans and will need to test once i have an img that supports it, so i'll close for now.