41b8a6ebcf
mftparser: fix due to renamed function
2015-01-01 14:33:35 -05:00
628de64e37
mftparser: checking for DEBUGOUT in the config
...
Not everyone will want to use this, especially from volshell
2015-01-01 14:23:27 -05:00
bfc29de2b1
rewrite of mftparser to make it more usable in volshell and elsewhere
2015-01-01 01:38:55 -05:00
4fb3afc79c
small fix due to speedup in 6dde8592e7
2015-01-01 01:34:12 -05:00
57f706dd84
small change to mftparser, ref issue #153
2014-12-29 15:49:04 -05:00
39feac06b4
small fix to mftparser
2014-12-17 16:58:35 -05:00
de891a889c
mftparser: fix for issue #142
2014-12-05 11:18:19 -05:00
abae4c9672
Merge branch 'unified-output'
...
NOTE: fast/immediate output of plugins is affected by this merge!
Very little should change for existing plugins, any plugins using the
table_header/table_row routines should continue to run as normal,
however plugins converted to the unified output will not give output
until they complete. There is currently a quicktext output renderer to
get immediate (but ugly) results.
This commit should ensure greater visibility and testing of the unified
output solution, and identify issues before our next release. Please
report any issues to github as soon as possible.
Conflicts:
volatility/plugins/mftparser.py
volatility/plugins/registry/shimcache.py
2014-11-25 20:04:03 +00:00
f9437cce08
fix
2014-11-10 12:59:01 -05:00
064591b01e
small fix in mftparser
2014-11-10 12:51:53 -05:00
6dde8592e7
Windows - Speed up mftparser
2014-10-30 08:48:00 -05:00
89e2c79465
Add in example of a special-cased text renderer, but basic information for all other renderers.
2014-10-27 00:58:17 +00:00
0ff9e4f448
fix in mftparser
2014-10-16 17:58:02 -04:00
e949f52f1c
mftparser bug fix reported by David N
2014-08-14 10:45:09 -04:00
65999c3b20
few more cleanups
2014-07-14 18:48:21 -04:00
94b0af892d
mftparser: few cleanups and making sure to only include directories in path of files
2014-07-14 18:25:03 -04:00
a6112c0e91
partial revert on 8639034ced see #47
2014-07-14 08:37:28 -04:00
8639034ced
mftparser: added some better checks to avoid loops fixes issue #47
2014-07-11 15:33:20 -04:00
5dcea67216
changing email
2014-07-08 18:36:25 -04:00
e91ab21744
checking if adsname is None
2014-06-24 16:06:11 -04:00
a15842fb7b
removed extra spacing in mftparser
2014-05-22 21:55:25 -04:00
489b0048bc
adding physical offset option to mftparser
2014-05-22 13:10:58 -04:00
9869200e3d
added a better check for duplicate mftrecords, we were missing too many valid entries
2014-04-18 16:34:25 -04:00
90f6d1ca40
modified to check for valid entries by default
2014-04-17 10:46:24 -04:00
903b39319b
hex offset
2014-03-28 15:12:59 -04:00
65b19763a6
small fix
2014-03-28 15:11:39 -04:00
068ddf5a22
added fix for wyatt, plus debug statements
2014-03-28 15:03:38 -04:00
ea96ccb7ff
removed uneeded variable
2014-03-02 19:40:37 -05:00
54781f9298
adding --machine flag to allow one to differentiate between combined timelines; also a few minor bugfixes
2014-02-28 14:26:25 -05:00
b8756cd215
added ability to dump resident files when using body output
2014-02-26 09:48:53 -05:00
d73aed9b38
adding code to dump out resident files like file.[mft entry offset].data[counter].dmp
2014-02-19 12:39:11 -05:00
89c1a905bf
stripped out whitespace in ADS name and made advancement from null $DATA attribute to utilize obj_vm.profile.get_obj_size instead of hardcoded size
2014-02-19 09:48:47 -05:00
41943ff1e4
ADS streams should be the second (or more) $DATA stream. adding logic to avoid a FP for original $DATA stream
2014-02-19 09:36:19 -05:00
6b4a4f8a11
fixed some ADS logic, put full paths back in and added more error checking in FILE_NAME
2014-02-19 09:17:11 -05:00
6aec4b3c11
removed unneeded comment
2014-02-18 16:58:22 -05:00
d1722764ad
added code to get ADS names
2014-02-18 16:56:49 -05:00
1f3187b24c
update mftparser with the correct poolscanner class name
2014-01-17 22:51:30 -06:00
f7af4542fa
a merge of mftparser (see the description for details)
...
merges gleeda's changes in r3519 of trunk (mftparser fix to pull out
all $Data attributes) with several that i had made in voldb
(https://github.com/iMHLv2/voldb/commits/projex/volatility/volatility/pl
ugins/mftparser.py)
2014-01-17 22:07:32 -06:00
e6ed7078f9
sync with r3581 of trunk
2014-01-17 14:21:55 -06:00
58c9574e22
sync with 2.3.1 from trunk
2013-10-31 11:06:08 -04:00
f699e93a4f
sync with r3514
2013-10-08 01:04:26 -04:00
d242168adb
initial commit of r3513 branch
2013-10-07 11:55:04 -04:00
3f03106150
mftparser fix to pull out all $Data attributes
2013-10-15 15:20:34 +00:00
4c7cc26502
Standardization of file headers. License clarification. Dumpfiles committed to trunk.
2013-10-08 04:16:13 +00:00
f8a8e6d311
some minor fixups to is_valid() functions for mftparser
2013-05-24 23:59:53 +00:00
2469bebb39
small sanity check. fixes issue 423
2013-05-24 21:21:12 +00:00
205cc2fe6f
mftparser: switching the offset and filename as requested by Bart Inglot to make it easier to sort when using excel and the like
2013-03-10 01:21:46 +00:00
964c3b32c9
making sure that timestamps that are in UTC are declared as so. now we can use the --tz option to change timezones. this is a partial fix, still need a fix for evtlogs and PE files and *nix timestamps. see details at issue 319
2013-02-06 00:02:16 +00:00
f6fe6eae44
Small fix in body output. Thanks to Bart I. for reporting!
2013-01-15 13:53:19 +00:00
33a8932176
small fix to output to conform to other bodyfile format outputs
2012-12-17 00:31:10 +00:00
gleeda