puffyCid / artemis

A cross platform forensic parser written in Rust!

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Support lzx compression on Windows Overlay Filter (WOF) data

puffyCid opened this issue · comments

What new feature do you think would be cool to add to artemis?
Currently artemis supports decompressing Windows Overlay Filter (WOF) compressed data smaler than 2GBs.
WOF actually supports four (4) compression types.
Artemis supports all of them except the lzx compression type.

Describe the solution you'd like
Support the lzx compression on WOF data. Might be dependent/solved by #6

Additional context
Quick review of WOF: https://github.com/wbenny/woftool
NTFS with WOF: https://en.wikipedia.org/wiki/NTFS (System compression)
Microsoft blog: https://devblogs.microsoft.com/oldnewthing/20190618-00/?p=102597