Description
Extracts files from .raw/.dd images by using sleuthkit
Installation
apt install sleuthkit
pip install fileextract
Usage
Create a config file with the following schema:
{
"logPath": "fileextract.log", // Path to log file
"raws": [ // List of .raw images
{
"path": "path/to/raws/**", // Path to the .raw image
"offset": 0, // Offset where the file system starts
"files": [ // The files which shall be extracted
"/data/app/user.db"
]
}
]
}Example
python -m fileextract -c config.json
################################################################################
fileextract by 5f0
Extracts files from .raw images by using sleuthkit
Current working directory: /path/to/fileextract
Datetime: 01/01/1970 10:11:12
################################################################################
--> Target: path/to/raws/action_one.raw
---
Create: path/to/raws/action_one.raw_files
Extract: /data/app/user.db
---
--> Target: path/to/raws/action_two.raw
---
Create: path/to/raws/action_two.raw_files
Extract: /data/app/user.db
---
################################################################################
Execution Time: 0.139446 sec
License
MIT
