search

pjrinaldi / wombatforensics

linux c++, fox-toolkit, multi-threaded forensic gui tool
GNU General Public License v2.0
47 stars 12 forks source link

HFS+/X Parsing #368

Open pjrinaldi opened 3 years ago

pjrinaldi commented 3 years ago

Implement HFS,HFS+/X parsing

pjrinaldi commented 2 years ago

hfs+/X volume name has been obtained as well as the properties from the volume header. next i'll do the HFS header and go from there.

then i can start working on parsing the directory/files

pjrinaldi commented 2 years ago

Starting initial parsing of the catalog file to populate the tree.

pjrinaldi commented 2 years ago

parser is working with debug statements, need to fully parse folder/file records and populate to nodes and properties files and then see how it works.

also will need to test on a larger catalog file and see how the current loops handle the split catalog file extents. (will probably break this out into another ticket once i get hfs+ working.

pjrinaldi commented 2 years ago

special files have been added. will need to start populating the regular files.

pjrinaldi commented 2 years ago

regular files are parsed and working. need to implement alternate data streams, i.e. the resource forks.

pjrinaldi commented 2 years ago

resource fork helper code is in place, and i capture the relevant info from the resource fork 80 bytes, so i just need to implement it now, then basic hfsplus parsing is working and i can move on to something else.

pjrinaldi commented 2 years ago

resource fork has basic parsing. hfs is working for the test images i have, will need to test others and then fix/improve the parsing as I go