https://github.com/mnrkbys/vss_carver
Carves and recreates VSS catalog and store from Windows disk image.
https://github.com/mnrkbys/vss_carver
forensics python vss-carver windows
Last synced: over 1 year ago
JSON representation
Carves and recreates VSS catalog and store from Windows disk image.
- Host: GitHub
- URL: https://github.com/mnrkbys/vss_carver
- Owner: mnrkbys
- License: mit
- Created: 2018-01-24T07:38:58.000Z (over 8 years ago)
- Default Branch: master
- Last Pushed: 2023-01-24T07:40:22.000Z (over 3 years ago)
- Last Synced: 2024-11-01T11:35:41.524Z (over 1 year ago)
- Topics: forensics, python, vss-carver, windows
- Language: Python
- Size: 2.61 MB
- Stars: 96
- Watchers: 13
- Forks: 21
- Open Issues: 3
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# vss_carver
Carves and recreates VSS catalog and store from Windows disk image.
## Requirement
- Python 3.7+ (I tested on Python 3.7.6)
- libvshadow (It has to be patched to support vss_carver)
- pyewf
- pyvmdk
- High speed CPU and high speed I/O storage
## Usage
1. Carves and recreates VSS catalog and store
```bash
vss_carver.py -t -o -i -c -s
```
2. Sort the catalog entries based on the $SI modification timestamp of the specified file. To sort the catalog entries correctly, it must be updated frequently (default: /Windows/System32/winevt/Logs/System.evtx).
```bash
vss_catalog_sorter.py -t -o -i -c -s -m
```
3. Mounts VSS snapshots with the use of extended vshadowmount (You can get pre-compiled vshadowmount from [here](https://github.com/mnrkbys/precompiled_libyal_libs))
```bash
vshadowmount -o -c -s
```
## Manipulates VSS catalog entries (if you need)
```bash
vss_catalog_manipulator.py {list,move,remove,enable,disable} (see more details with "-h")
```
## Installation of vss_carver
```bash
git clone https://github.com/mnrkbys/vss_carver.git
```
## Installation of dependencies
### Windows
I am offering pre-compiled libyal libraries on [precompiled_libyal_libs repository](https://github.com/mnrkbys/precompiled_libyal_libs). I recommend using them.
[Yogesh](https://github.com/ydkhatri) also is offering pre-compiled pyewf and pyvmdk in his [mac_apt](https://github.com/ydkhatri/mac_apt) repository.
Follow [the instructions to install dependencies](https://github.com/ydkhatri/mac_apt/wiki/Installation-for-Python3.7#Windows).
Of course, you can build them by yourself as same as Linux or macOS.
### Linux and macOS
You have to compile libvshadow, libewf, and libvmdk. I'm offering patched source code on my repositories, [libvshadow](https://github.com/mnrkbys/libvshadow-vss_carver) and [libvmdk](https://github.com/mnrkbys/libvmdk-Shift_JIS).
Do git clone them above, then follow the instructions to build [libvshadow](https://github.com/libyal/libvshadow/wiki/Building), [libewf](https://github.com/libyal/libewf/wiki/Building) and [libvmdk](https://github.com/libyal/libvmdk/wiki/Building).
## Hey! I found a bug!!
When you find a bug, don't just report error messages. In many cases, this is because the error message may not contain the root cause.
So I need real disk images to fix the bug. Of course, this is not the case if the disk image contains private data.
## Author
[Minoru Kobayashi](https://twitter.com/unkn0wnbit)
## License
[MIT](http://opensource.org/licenses/mit-license.php)