Read Ex01, SMART, AFF and AFD acquisitions with -t raw, and refuse L01 - #324
Merged
Merged
Conversation
Re-vendors qnxprobe 1.38 and ewfprobe 0.2.0. qnxprobe now hands every disk image ewfprobe reads to it (E01, SMART .s01, Ex01, AFF, and an AFD folder from the folder or any .aff in it) and refuses EnCase L01 logical evidence, which holds files rather than a disk. Before, an Ex01, AFF, AFD or L01 was read as raw bytes and came back as one volume the reader did not recognise, so no artifact found anything. scripts/raw_image.py, byte-identical across the five cores, names the container in the run log through qnxprobe.describe_acquisition. The GUI lists .s01, .Ex01 and .aff with the raw image types. The seeker tests build an AFF and an AFD of the NTFS fixture and require the same files as the raw image, and require an L01 to be refused. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reads more acquisition formats with
-t raw, and refuses logical evidence..s01, Ex01, AFF, and an AFD folder (from the folder or any.affin it) are read in place. Before, an Ex01, AFF, AFD or L01 came back as one unrecognised volume and nothing was searched.scripts/raw_image.pynames the container in the run log. It stays byte-identical in the five cores, and the same change goes to the other four..s01,.Ex01and.affwith the raw image types.🤖 Generated with Claude Code