 gleeda
|
65999c3b20
|
few more cleanups
|
2014-07-14 18:48:21 -04:00 |
|
|
gleeda
|
94b0af892d
|
mftparser: few cleanups and making sure to only include directories in path of files
|
2014-07-14 18:25:03 -04:00 |
|
|
gleeda
|
a6112c0e91
|
partial revert on 8639034ced see #47
|
2014-07-14 08:37:28 -04:00 |
|
|
gleeda
|
8639034ced
|
mftparser: added some better checks to avoid loops fixes issue #47
|
2014-07-11 15:33:20 -04:00 |
|
|
gleeda
|
5dcea67216
|
changing email
|
2014-07-08 18:36:25 -04:00 |
|
|
gleeda
|
e91ab21744
|
checking if adsname is None
|
2014-06-24 16:06:11 -04:00 |
|
|
gleeda
|
a15842fb7b
|
removed extra spacing in mftparser
|
2014-05-22 21:55:25 -04:00 |
|
|
gleeda
|
489b0048bc
|
adding physical offset option to mftparser
|
2014-05-22 13:10:58 -04:00 |
|
|
gleeda
|
9869200e3d
|
added a better check for duplicate mftrecords, we were missing too many valid entries
|
2014-04-18 16:34:25 -04:00 |
|
|
gleeda
|
90f6d1ca40
|
modified to check for valid entries by default
|
2014-04-17 10:46:24 -04:00 |
|
|
gleeda
|
903b39319b
|
hex offset
|
2014-03-28 15:12:59 -04:00 |
|
|
gleeda
|
65b19763a6
|
small fix
|
2014-03-28 15:11:39 -04:00 |
|
|
gleeda
|
068ddf5a22
|
added fix for wyatt, plus debug statements
|
2014-03-28 15:03:38 -04:00 |
|
|
gleeda
|
ea96ccb7ff
|
removed uneeded variable
|
2014-03-02 19:40:37 -05:00 |
|
|
gleeda
|
54781f9298
|
adding --machine flag to allow one to differentiate between combined timelines; also a few minor bugfixes
|
2014-02-28 14:26:25 -05:00 |
|
|
gleeda
|
b8756cd215
|
added ability to dump resident files when using body output
|
2014-02-26 09:48:53 -05:00 |
|
|
gleeda
|
d73aed9b38
|
adding code to dump out resident files like file.[mft entry offset].data[counter].dmp
|
2014-02-19 12:39:11 -05:00 |
|
|
gleeda
|
89c1a905bf
|
stripped out whitespace in ADS name and made advancement from null $DATA attribute to utilize obj_vm.profile.get_obj_size instead of hardcoded size
|
2014-02-19 09:48:47 -05:00 |
|
|
gleeda
|
41943ff1e4
|
ADS streams should be the second (or more) $DATA stream. adding logic to avoid a FP for original $DATA stream
|
2014-02-19 09:36:19 -05:00 |
|
|
gleeda
|
6b4a4f8a11
|
fixed some ADS logic, put full paths back in and added more error checking in FILE_NAME
|
2014-02-19 09:17:11 -05:00 |
|
|
gleeda
|
6aec4b3c11
|
removed unneeded comment
|
2014-02-18 16:58:22 -05:00 |
|
|
gleeda
|
d1722764ad
|
added code to get ADS names
|
2014-02-18 16:56:49 -05:00 |
|
|
iMHLv2
|
1f3187b24c
|
update mftparser with the correct poolscanner class name
|
2014-01-17 22:51:30 -06:00 |
|
|
iMHLv2
|
f7af4542fa
|
a merge of mftparser (see the description for details)
merges gleeda's changes in r3519 of trunk (mftparser fix to pull out
all $Data attributes) with several that i had made in voldb
(https://github.com/iMHLv2/voldb/commits/projex/volatility/volatility/pl
ugins/mftparser.py)
|
2014-01-17 22:07:32 -06:00 |
|
|
iMHLv2
|
e6ed7078f9
|
sync with r3581 of trunk
|
2014-01-17 14:21:55 -06:00 |
|
|
iMHLv2
|
58c9574e22
|
sync with 2.3.1 from trunk
|
2013-10-31 11:06:08 -04:00 |
|
|
iMHLv2
|
f699e93a4f
|
sync with r3514
|
2013-10-08 01:04:26 -04:00 |
|
|
iMHLv2
|
d242168adb
|
initial commit of r3513 branch
|
2013-10-07 11:55:04 -04:00 |
|
|
gleeda
|
3f03106150
|
mftparser fix to pull out all $Data attributes
|
2013-10-15 15:20:34 +00:00 |
|
|
awalters
|
4c7cc26502
|
Standardization of file headers. License clarification. Dumpfiles committed to trunk.
|
2013-10-08 04:16:13 +00:00 |
|
|
gleeda
|
f8a8e6d311
|
some minor fixups to is_valid() functions for mftparser
|
2013-05-24 23:59:53 +00:00 |
|
|
gleeda
|
2469bebb39
|
small sanity check. fixes issue 423
|
2013-05-24 21:21:12 +00:00 |
|
|
gleeda
|
205cc2fe6f
|
mftparser: switching the offset and filename as requested by Bart Inglot to make it easier to sort when using excel and the like
|
2013-03-10 01:21:46 +00:00 |
|
|
gleeda
|
964c3b32c9
|
making sure that timestamps that are in UTC are declared as so. now we can use the --tz option to change timezones. this is a partial fix, still need a fix for evtlogs and PE files and *nix timestamps. see details at issue 319
|
2013-02-06 00:02:16 +00:00 |
|
|
gleeda
|
f6fe6eae44
|
Small fix in body output. Thanks to Bart I. for reporting!
|
2013-01-15 13:53:19 +00:00 |
|
|
gleeda
|
33a8932176
|
small fix to output to conform to other bodyfile format outputs
|
2012-12-17 00:31:10 +00:00 |
|
|
gleeda
|
343f9c253c
|
fixed up body output, added EA/EA_INFO vtypes and two small fixes
|
2012-12-13 16:03:22 +00:00 |
|
|
gleeda
|
911f1b8243
|
comment fix
|
2012-11-14 00:43:27 +00:00 |
|
|
gleeda
|
e90948e217
|
small formatting fix
|
2012-11-13 21:50:45 +00:00 |
|
|
gleeda
|
c1efda5625
|
finished a comment
|
2012-11-13 20:54:15 +00:00 |
|
|
gleeda
|
019c032c8d
|
put back full name for $SI attributes in body output. cleaned up some code, added comments and fixed a couple of logic errors that made is_valid too strict and process_attr_list() not strict enough when needed
|
2012-11-13 20:48:05 +00:00 |
|
|
gleeda
|
847b06f95e
|
removed unneeded window_size
|
2012-11-02 17:16:03 +00:00 |
|
|
gleeda
|
5d700ee36a
|
adding descriptions and removing an uneeded comment
|
2012-10-24 14:10:34 +00:00 |
|
|
gleeda
|
7550204126
|
initial commit of mftparser closes issue 309
|
2012-10-22 21:18:56 +00:00 |
|