forensicmatt / PancakeViewer

A DFVFS Backed Forensic Viewer

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Pancake Viewer

A DFVFS backed viewer project with a WxPython GUI.

Feedback, suggestions, help... its all welcome. With the right teamwork, we could make this a neat tool.

Dependencies

Future Functionality

First priority is to allow extraction of files. Other short term priorities include:

  • Plugin viewer system to allow for better viewing of specific file types (mainly utilizing libyal):
    • Plists
    • Events (Evt,Evtx)
    • USN
    • etc

Foreseen Shortcomings

Currently not sure how to implement a method for viewing objects (files, volumes, disk) in hex. I will soon remove the hex pane. I could always use help with this project and this is one of many areas that is beyond me. Because volumes, disk, and files can be very large in size, I dont think it would work to read the file to the hex pane. I believe what needs to be done is attach to the scroll and read sections of the I/O object that corresponds to viewer position. Not sure how to implement such a system.

Example view

Viewing VSS Extraction Options Extraction Results

More Talk

Forensic Lunch - 20160715

Pancake Talk on the Forensic Lunch

About

A DFVFS Backed Forensic Viewer

License:Apache License 2.0


Languages

Language:Python 100.0%