search

pjrinaldi / wombattools

set of command line tools for use with a custom forensic imager and custom logical imager using walafus, zstd, and blake3 which is integrated with wombat forensics and can also be used on their own.
BSD 2-Clause "Simplified" License
1 stars 1 forks source link

WombatLogical Custom FileSystem Properties #7

Open pjrinaldi opened 3 years ago

pjrinaldi commented 3 years ago

Need to implement the properties portion for the filesystems I currently have implemented in wombatforensics, i.e. fat12/16/32, exfat, ntfs, and ext2/3/4.

This will be what gets imported into the properties in wombatforensics, so i will need to figure out where to import that data, such as into the f#.prop file.

pjrinaldi commented 2 years ago

if you are adding local files from a mounted drive, the only way to get the file system specific information would be to know the device for the mount point. this seems like it might be an option flag and the only thing I need to store without the flag would be filesystem date/time for the file in the tar and the hash in a file for the file with the filename.hash, again the hash should be an option as well. this way, the logical image would be a standard tar.zstd otherwise.. need to write the code to test this as a straight tar.gz maker and then determine what the forensic bit about it is at this point, maybe the hash of the newly created tar or the hash of the contents within the tar?