search

teamdfir / sift

SIFT
MIT License
489 stars 67 forks source link

Add support for Win10 WofCompressedData #240

Open mpilking opened 6 years ago

mpilking commented 6 years ago

I noticed an issue in the SIFT with accessing certain files in Windows 10 images. Screenshot below is from Vanko as an example. Notice all the "unsupported reparse point" messages. This is due to a new compression method in Windows 10, explained here: https://www.swiftforensics.com/2016/10/wofcompressed-streams-in-windows-10.html. In that link, Yogesh has details on a plugin to the ntfs-3g FUSE driver that will allow it to read these files. I'd suggest we add it to the SIFT.

wofcompresseddata

stale[bot] commented 6 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

mpilking commented 6 years ago

Bumping this so it doesn't close automatically. This is an issue that should be addressed.

digitalsleuth commented 3 years ago

@mpilking Is this still of interest to you? If so, any chance you have a sample image I could use for testing?