search

pjrinaldi / wombatforensics

linux c++, fox-toolkit, multi-threaded forensic gui tool
GNU General Public License v2.0
47 stars 12 forks source link

EXFAT File System Parsing #352

Closed pjrinaldi closed 8 months ago

pjrinaldi commented 3 years ago

Working on FS and file integration into the current FAT functions.

pjrinaldi commented 3 years ago

Almost have alloc_bitmap working, then move onto other direntry types.

also need to modify getnextcluster() so it isn't writing the end of cluster chain value (0xFFFFFFF) to the clusterlist, then i don't need to change for loop to count() - 1 and it should work better.

pjrinaldi commented 3 years ago

may want to look at code for deleted directories and attempt to traverse them, if the necessary values are correct..

pjrinaldi commented 3 years ago

get next cluster is fine as is due to needing the count to be 1 when there is only starting cluster... but i might look inot this anyway.

also need to test my utc offset code on different exfat images....

pjrinaldi commented 3 years ago

exfat parsing to include recovered deleted is working with my initial testing.

need to implement orphan parsing now...

pjrinaldi commented 3 years ago

I think if i get the alloc_bitmap and start at the non-alloc clusters and then search on sector at every 32 for the 0x05, i should get only the orphan'd entries.

will test after some research.

pjrinaldi commented 3 years ago

implemented orphans for exfat and iniitial testing of exfat are working correctly.

pjrinaldi commented 8 months ago

making progress on exfat. once i get exfat working, i will approach orphans and see how to implement that.

pjrinaldi commented 8 months ago

exfat is working except for orphans and the getfileslack for the hexviewer is erroring out for upcase table. need to figure out where my code is wrong and fix the slack info. i'm guessing it is an error for any large file, but need to test and fix.

also need to implement exfat orphans.

pjrinaldi commented 8 months ago

deleted files working. need to implement exfat orphans. need to implement properties for exfat system files. fixed getfileslack() for hexviewer.

pjrinaldi commented 8 months ago

got orphans implemented, but it hangs when looping, need to debug and fix.