{"id":13510885,"url":"https://github.com/mnrkbys/vss_carver","last_synced_at":"2025-03-30T17:31:37.456Z","repository":{"id":122913355,"uuid":"118730311","full_name":"mnrkbys/vss_carver","owner":"mnrkbys","description":"Carves and recreates VSS catalog and store from Windows disk image.","archived":false,"fork":false,"pushed_at":"2023-01-24T07:40:22.000Z","size":2736,"stargazers_count":96,"open_issues_count":3,"forks_count":21,"subscribers_count":13,"default_branch":"master","last_synced_at":"2024-11-01T11:35:41.524Z","etag":null,"topics":["forensics","python","vss-carver","windows"],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mnrkbys.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2018-01-24T07:38:58.000Z","updated_at":"2024-08-12T19:35:44.000Z","dependencies_parsed_at":"2024-01-13T19:38:43.705Z","dependency_job_id":"940e8f6f-3acd-4a90-9381-117ff95c1f2f","html_url":"https://github.com/mnrkbys/vss_carver","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mnrkbys%2Fvss_carver","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mnrkbys%2Fvss_carver/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mnrkbys%2Fvss_carver/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mnrkbys%2Fvss_carver/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mnrkbys","download_url":"https://codeload.github.com/mnrkbys/vss_carver/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246355419,"owners_count":20763994,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["forensics","python","vss-carver","windows"],"created_at":"2024-08-01T02:01:58.032Z","updated_at":"2025-03-30T17:31:37.445Z","avatar_url":"https://github.com/mnrkbys.png","language":"Python","funding_links":[],"categories":["Python","windows"],"sub_categories":[],"readme":"# vss_carver\n\nCarves and recreates VSS catalog and store from Windows disk image.\n\n## Requirement\n\n- Python 3.7+ (I tested on Python 3.7.6)\n- libvshadow (It has to be patched to support vss_carver)\n- pyewf\n- pyvmdk\n- High speed CPU and high speed I/O storage\n\n## Usage\n\n1. Carves and recreates VSS catalog and store\n\n```bash\nvss_carver.py -t \u003cdisk_image_type\u003e -o \u003cvolume_offset_in_bytes\u003e -i \u003cdisk_image\u003e -c \u003ccatalog_file\u003e -s \u003cstore_file\u003e\n```\n\n2. Sort the catalog entries based on the $SI modification timestamp of the specified file. To sort the catalog entries correctly, it must be updated frequently (default: /Windows/System32/winevt/Logs/System.evtx).\n\n```bash\nvss_catalog_sorter.py -t \u003cdisk_image_type\u003e -o \u003cvolume_offset_in_bytes\u003e -i \u003cdisk_image\u003e -c \u003ccatalog_file\u003e -s \u003cstore_file\u003e -m \u003cexported_$MFT\u003e\n```\n\n3. Mounts VSS snapshots with the use of extended vshadowmount (You can get pre-compiled vshadowmount from [here](https://github.com/mnrkbys/precompiled_libyal_libs))\n\n```bash\nvshadowmount -o \u003cvolume_offset_in_bytes\u003e -c \u003ccatalog_file\u003e -s \u003cstore_file\u003e \u003cdisk_image\u003e \u003cmount_point\u003e\n```\n\n## Manipulates VSS catalog entries (if you need)\n\n```bash\nvss_catalog_manipulator.py {list,move,remove,enable,disable} (see more details with \"-h\")\n```\n\n## Installation of vss_carver\n\n```bash\ngit clone https://github.com/mnrkbys/vss_carver.git\n```\n\n## Installation of dependencies\n\n### Windows\n\nI am offering pre-compiled libyal libraries on [precompiled_libyal_libs repository](https://github.com/mnrkbys/precompiled_libyal_libs). I recommend using them.\n\n[Yogesh](https://github.com/ydkhatri) also is offering pre-compiled pyewf and pyvmdk in his [mac_apt](https://github.com/ydkhatri/mac_apt) repository.\nFollow [the instructions to install dependencies](https://github.com/ydkhatri/mac_apt/wiki/Installation-for-Python3.7#Windows).\n\nOf course, you can build them by yourself as same as Linux or macOS.\n\n### Linux and macOS\n\nYou have to compile libvshadow, libewf, and libvmdk. I'm offering patched source code on my repositories, [libvshadow](https://github.com/mnrkbys/libvshadow-vss_carver) and [libvmdk](https://github.com/mnrkbys/libvmdk-Shift_JIS).\n\nDo git clone them above, then follow the instructions to build [libvshadow](https://github.com/libyal/libvshadow/wiki/Building), [libewf](https://github.com/libyal/libewf/wiki/Building) and [libvmdk](https://github.com/libyal/libvmdk/wiki/Building).\n\n## Hey! I found a bug!!\n\nWhen you find a bug, don't just report error messages. In many cases, this is because the error message may not contain the root cause.\n\nSo I need real disk images to fix the bug. Of course, this is not the case if the disk image contains private data.\n\n## Author\n\n[Minoru Kobayashi](https://twitter.com/unkn0wnbit)\n\n## License\n\n[MIT](http://opensource.org/licenses/mit-license.php)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmnrkbys%2Fvss_carver","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmnrkbys%2Fvss_carver","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmnrkbys%2Fvss_carver/lists"}