API tools faq
paste
Advertisement
xe1phix

Xe1phix-Forensic-Analysis-[EWF]-Filesystem-Cheatsheet-[v9.2.48].sh

xe1phix
Oct 7th, 2022
1,415
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 4.14 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/sh
  2.  
  3. ##-=================================================-##
  4. ##   [+] Imaging a device on a Unix-based system:
  5. ##-=================================================-##
  6. ewfacquire /dev/sda
  7.  
  8.  
  9. ##-=================================================-##
  10. ##   [+] Converting a RAW into an EWF image
  11. ##-=================================================-##
  12. ewfacquire $Disk.raw
  13.  
  14.  
  15. ##-===============================================================-##
  16. ##   [+] Forensic aquisition of /dev/sdd into a EWF filesystem
  17. ##-===============================================================-##
  18. ewfacquire -v -c bzip2:best -m removable -f encase7-v2 -d sha256 -l /$Dir/ewf-log.txt /dev/sdd
  19.  
  20.  
  21. ##-=============================================-##
  22. ##   [+] Pipe /dev/sdd into ewfacquirestream
  23. ##-=============================================-##
  24. ewfacquirestream -t encase7 -d sha256 -c bzip2:best -e Xe1phix -m removable -t $Ewf < /dev/sdd
  25.  
  26.  
  27. ##-=================================================-##
  28. ##   [+] Concatinate a series of split raw files
  29. ##   [+] Pipe them into ewfacquirestream
  30. ##-=================================================-##
  31. cat $File.raw.??? | ewfacquirestream
  32. cat $File.??? | ewfacquirestream  -c best -m fixed -t $File -S $Size
  33.  
  34.  
  35. ##-==============================================================-##
  36. ##   [+] Convert an optical disc (split) RAW into an EWF image
  37. ##-==============================================================-##
  38. ewfacquire -T $Image.cue $Image.iso
  39.  
  40.  
  41. ##-==========================================================================-##
  42. ##   [+] Converting an EWF into another EWF format or a (split) RAW image
  43. ##-==========================================================================-##
  44. ewfexport $Image.E01
  45. ewfexport -d sha256 -f raw -l /$Dir/EWF-to-Raw.txt -t /$Dir/EWF-Raw $Image.E01
  46.  
  47.  
  48. ##-=================================================-##
  49. ##   [+] Exporting files from a logical image (L01)
  50. ##-=================================================-##
  51. ewfexport $Image.L01
  52.  
  53.  
  54. ##-=================================================-##
  55. ##   [+] FUSE mounting an EWF image
  56. ##-=================================================-##
  57. ewfmount -v $Image.E01 $Dir/
  58. ewfmount -v $Image.E01 /dev/$Disk
  59.  
  60.  
  61. ##-=============================================-##
  62. ##   [+] FUSE mounting a logical image (L01)
  63. ##-=============================================-##
  64. ewfmount -f files $Image.L01 /mnt/$Dir
  65.  
  66.  
  67. ##-=========================================================-##
  68. ##   [+] Mount EWF image as Loop filesystem using kpartx:
  69. ##-=========================================================-##
  70. kpartx -r -a -v $Dir/ewf1
  71.  
  72.  
  73. ##-=========================================================-##
  74. ##   [+] Mount EWF image as Loop filesystem using Mount:
  75. ##-=========================================================-##
  76. mkdir $Dir
  77. mount --read-only /dev/mapper/loop0p1 $Dir
  78.  
  79.  
  80. ##-==========================================================-##
  81. ##   [+] Unmount EWF image as Loop filesystem using umount:
  82. ##-==========================================================-##
  83. umount $Dir
  84. kpartx -d $Dir/ewf1
  85.  
  86. ##-======================================================-##
  87. ##   [+] Unmount EWF Loop filesystem using fusermount:
  88. ##-======================================================-##
  89. fusermount -u $Image
  90. fusermount -u /mnt/$Dir
  91.  
  92.  
  93. ##-=================================================================-##
  94. ##   [?] Display the size,type,inode,permissions of an EWF image:
  95. ##-=================================================================-##
  96. file /$Dir/ewf.E01
  97. stat --format=[%n]:[Size:%s.bytes]:[IO-Block:%o]:[File-type:%F]:[Inode:%i] /$Dir/ewf.E01
  98. stat --format=[%n]:[User:%U]:[Group:%G]:[Uid:%u]:[GID:%g]:[%A/%a] /$Dir/ewf.E01
  99.  
  100.  
  101. ##-====================================================-##
  102. ##   [+] Print verbose EWF filesystem information:
  103. ##-====================================================-##
  104. ewfinfo $Image.E01
  105. img_stat -i ewf /$Dir/ewf.E01
  106. cat /$Dir/ewf-log.txt
  107.  
  108.  
  109. ##-==================================================-##
  110. ##   [+] Verify the integrity of an EWF filesystem
  111. ##-==================================================-##
  112. ewfverify $Image.E01
  113.  
  114.  
Tags: debian xe1phix ParrotSec forensics DFIR filesystem EWF
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!