pjrinaldi / wombatforensics

linux c++, fox-toolkit, multi-threaded forensic gui tool
GNU General Public License v2.0
47 stars 12 forks source link

EXT2/3/4 File System Parsing #350

Closed pjrinaldi closed 8 months ago

pjrinaldi commented 3 years ago

Implement Manual File System Parsing.

pjrinaldi commented 3 years ago

Working on initial implementation of recursively parsing ext2/3/4

pjrinaldi commented 3 years ago

Fixing some errors in the implementation which made assumptions.

pjrinaldi commented 3 years ago

initial implementation almost done, need to implement sub directory parsing.

pjrinaldi commented 3 years ago

initial testing of recursive sub directories and indirect blocks, and other features are working.

need to code cleanup, add a few properties to the fileinfo variable, write them to the properties file, and then adjust the curinode increment variable for the orphan directory so it doesn't duplicate...

also need to test the same images for ext3 and ext4, i.e. create empty ext3, ext4 images and copy the files from the ext2 images to teh ext3,4 images and test once the above is fixed.

Also need to see whether the deleted file has any layout values even though teh size was set to zero. as well as check on the other values for the deleted dir entry value...

Then i need to look at finding any orphan files and implementing that method.

pjrinaldi commented 3 years ago

Orphan could be searching inode tables for unallocated entries, which means I need the inode bitmaps as well as inode tables.

also can look in the super lock for orphan list.

pjrinaldi commented 3 years ago

ext2 is good minus orphans. working on implementing the necessary features for parsing ext3, and ext4. currently working on extents for ext4, since ext3 uses direct/indirect blocks.

pjrinaldi commented 3 years ago

implemented initial ext4 extents. need an example of extents which has a depth of 2 to 5 to test my code and also still need to implement dir entry listing using hashed b-tree rather than the linear implementation. Need an example of that since i'm still not sure about it's implementation.

pjrinaldi commented 3 years ago

initial implementation of directory hashing and ext4 extents as well as fs and file info properties are implemented. will fix as i test with different test images...

I don't think orphans exist with ext because of teh way it zero's out the starting block and block info in inode table.

pjrinaldi commented 8 months ago

started working on parsing ext2/3/4. will populate the strings for the extfs and extfsfile property templates first, then get volume properties next, and then parse the ext filesystem files/directories.

pjrinaldi commented 8 months ago

extfs properties are working. Need to start parsing the extfs files and their properties next.

pjrinaldi commented 8 months ago

working on initial parsing of extfs files/dirs and their properties.

pjrinaldi commented 8 months ago

initial extfs parsing is working.