WombatForensics

Timeline
Login

Timeline

Many hyperlinks are disabled.
Use anonymous login to enable hyperlinks.

50 most recent check-ins

2024-07-30
13:49
simple test change Leaf check-in: c826d2a994 user: pasquale tags: main, origin/v0.1, trunk
2024-07-19
10:49
upgrade to blake3 v1.5.3 check-in: 55fe0bffa0 user: pasquale tags: main, origin/v0.1, trunk
2024-06-01
19:21
navigating the phone extraction zip is working. i just need to properly show plainview content, load the file contents when double clicked, possibly fix the path button contents to not include the / at the end of the folder also need to get summary information on device load, and get app list. check-in: 18e85410aa user: pasquale tags: main, origin/v0.1, trunk
18:58
working on fixing extraction zip child directories. check-in: 3d6f8cb047 user: pasquale tags: main, origin/v0.1, trunk
2024-05-31
18:04
attempting to fix the root/child dir function changes. also trying to fix crashes when i switch from root dir path button to forensic extraction path button, which crashes attempting to call partition functions rather than ziproot functions. check-in: 48e110d10e user: pasquale tags: main, origin/v0.1, trunk
2024-05-30
21:05
working on making the loadzipdirectory to be root/child agnostic... a few issues, but i should get it working soon. check-in: 9f8dabfc74 user: pasquale tags: main, origin/v0.1, trunk
15:42
working on implementing child directory loading for a phone extraction and handling all the issues adapting the forensic image code for the phone extraction check-in: b13ac943ed user: pasquale tags: main, origin/v0.1, trunk
2024-05-29
11:04
got root directory loaded, root directory files created for phone extractions. need to work on child directories and how to build the path and then get the id for the files based on path. check-in: d2441c252c user: pasquale tags: main, origin/v0.1, trunk
10:03
working on updating generatecategorysignature to handle phone extraction zips, then i can finish implementing root directory population. check-in: 3ece15bb7b user: pasquale tags: main, origin/v0.1, trunk
2024-05-28
23:35
working on implementing zipdirectory root txt files and display check-in: 1b28ab2f1e user: pasquale tags: main, origin/v0.1, trunk
17:01
working on getting the fileitems added for the loadzipdirectory function so i can create the text files and table entries check-in: d0ef1934d1 user: pasquale tags: main, origin/v0.1, trunk
2024-05-27
19:06
working on how to parse hte zip file correctly for each directory. check-in: 3aef1630bf user: pasquale tags: main, origin/v0.1, trunk
18:25
working on figuring out how to navigate the depths. maybe find max depth and then loop from depth 2 through max and then make the txt files for each depth layer check-in: a5126e6f09 user: pasquale tags: main, origin/v0.1, trunk
16:31
working on figuring out to loop over the zip file, get the correct directory depth order and then make the respective text files to repopulate the layout as a multi layered directory list. check-in: 7e5a7599e4 user: pasquale tags: main, origin/v0.1, trunk
2024-05-25
20:55
minor cleanup check-in: e7ab1a38b4 user: pasquale tags: main, origin/v0.1, trunk
16:19
working on parsing zip file contents and whether i want to do it all at once or come up with a way to parse it one directory level at a time. check-in: 21d0f2b80e user: pasquale tags: main, origin/v0.1, trunk
16:07
working on getting the zip file so i can start figuring out how to parse it for the table list of files. check-in: b83e71bc34 user: pasquale tags: main, origin/v0.1, trunk
15:44
working on parsing the zip directory structure to populate the table list. check-in: 1f652442c3 user: pasquale tags: main, origin/v0.1, trunk
02:08
working on implementing forensic extraction icons and code to handle parsing the forensic extraction zip file directory traversal. check-in: 6fa7772098 user: pasquale tags: main, origin/v0.1, trunk
2024-05-22
17:35
slowly working on handling forensic extractions check-in: fefeb943a2 user: pasquale tags: main, origin/v0.1, trunk
2024-05-17
16:26
got imgsize working if you select the zip, it reports the zip size. if you select a ufd/ufdx, it will find the zip file and get the size for the zip file. check-in: 6f875ff964 user: pasquale tags: main, origin/v0.1, trunk
16:10
working on detecting phone extractions and getting the archive size or uncompressed size prior to digging into the archive for the contents check-in: 444251a312 user: pasquale tags: main, origin/v0.1, trunk
2024-04-06
21:40
updated blake3 to v1.5.1 check-in: 69b0e86a3f user: pasquale tags: main, origin/v0.1, trunk
2024-03-16
14:57
sqfs library parsing currently works. will have to test further and fix any issues that arise based on my logic for navigating the pos/size context. check-in: a0ab69c07b user: pjrinaldi@protonmail.com tags: main, origin/v0.1, trunk
00:40
the libsquashfs library code works. i can read the file from the sfsimage sfs and get its file size. next up is writing the content reader code and then i will be able to support sfsimage files. check-in: e108ae410c user: pjrinaldi@protonmail.com tags: main, origin/v0.1, trunk
00:01
swithcing squashfs library, this one is working to open a squashfs file. next step is opening a virtual file within the squash filesystem check-in: 626f1875c6 user: pjrinaldi@protonmail.com tags: main, origin/v0.1, trunk
2024-03-11
17:01
attempting to implement libsquash, but trouble opening the file check-in: fa0f9df8a8 user: pjrinaldi@gmail.com tags: main, origin/v0.1, trunk
2024-03-10
16:29
implemented handling the new wombat forensic image (wfi) format. also implemented a lazy method to handle sfs forensic images using squashfuse command line tool. removed zstd seekable code and went back to the shared lzstd library. check-in: cb1d3f923e user: pjrinaldi@protonmail.com tags: main, origin/v0.1, trunk
2024-03-09
14:36
wltg as a forensic image parsing works and is fast. need to migrate all wltg code to the wombat forensic image format. check-in: cbce0eecb7 user: pjrinaldi@protonmail.com tags: main, origin/v0.1, trunk
2024-03-06
21:56
attempting to play with walafus check-in: 058bc410f0 user: pjrinaldi@protonmail.com tags: main, origin/v0.1, trunk
17:44
adding walafus into the mix to possibly parse the "sfs" image as a walafus image from the enterprise imager as squash is too complex for me. check-in: 1bfd5bc3fe user: pjrinaldi@gmail.com tags: main, origin/v0.1, trunk
13:37
can get the image size using lazy squashfuse and smrawmount commands. using the libraries for them isn't working at the moment. need to implement the seek/read functionality next using the lazy method. going to look into walafus as a replacement for the enterprise imager format check-in: 3c0ffbe470 user: pjrinaldi@gmail.com tags: main, origin/v0.1, trunk
01:48
trying to get sfs image ingestion working. libsmraw is failing, probably on the fuse segments, so i should lazy smraw, and ingest the single raw image check-in: 3290c9ff05 user: pjrinaldi@protonmail.com tags: main, origin/v0.1, trunk
01:03
attempting lazy way of working with enterprise images using squashfuse check-in: 01594c58f1 user: pjrinaldi@protonmail.com tags: main, origin/v0.1, trunk
2024-03-04
23:54
zstd_seekable code seems to be working. there are errors reading the files in the raw and zstd test images, it only reads the MBR nad FAT1/2, not the 2 directories and file in the root directory, but that isn't the seekable code that is the problem. check-in: d456bb84cc user: pjrinaldi@protonmail.com tags: main, origin/v0.1, trunk
23:37
fixed a bunch of errors with loadpartitions when there is an mbr table. also zstd seekable code is working. check-in: cf093cede4 user: pjrinaldi@protonmail.com tags: main, origin/v0.1, trunk
01:55
working on decompress code within image parsing check-in: 311983ca75 user: pjrinaldi@protonmail.com tags: main, origin/v0.1, trunk
00:08
working on implementing the new seekable zstd wfi check-in: 297ba318f0 user: pjrinaldi@protonmail.com tags: main, origin/v0.1, trunk
2024-03-03
23:28
added zstd folder and modified makefile to account for the seekable zstd code check-in: a7b082a8a9 user: pjrinaldi@protonmail.com tags: main, origin/v0.1, trunk
22:12
added code to implement the wfi with seekable zstd for better performance check-in: a48cff061d user: pjrinaldi@protonmail.com tags: main, origin/v0.1, trunk
2024-02-18
16:59
still need to get the securityid objectid guid properties working. ads nodes still need work as well. but getting there. check-in: b50a77bcc7 user: pjrinaldi@protonmail.com tags: main, origin/v0.1, trunk
16:42
making progress on ntfs. still need to populate directory information since there is no data attribute, also need to fill change date/time field. check-in: 61c662ad3a user: pjrinaldi@protonmail.com tags: main, origin/v0.1, trunk
2024-02-17
19:33
working on ntfs population and will come back to security id problem later check-in: bbb9e8120a user: pjrinaldi@protonmail.com tags: main, origin/v0.1, trunk
2024-01-20
16:51
added reparse attribute, still in test phase, but i need an ntfs forensic image which has reparse attributes. cleaned up objectid code and need to get around to the bookkeeping tasks of collecting ntfs attributes/node info and populating the files, properties, and tablelist. check-in: beecf41683 user: pjrinaldi@protonmail.com tags: main, origin/v0.1, trunk
16:45
need a reparse attribute to test out my test code and work on it from there. check-in: 5967ef4ea5 user: pjrinaldi@protonmail.com tags: main, origin/v0.1, trunk
01:29
got objectid parsing correctly. need to implement the last remaining attributes then get all their info and figure out how to order them and implement them. check-in: 7badad0557 user: pjrinaldi@protonmail.com tags: main, origin/v0.1, trunk
2024-01-16
21:57
working on ntfs attributes check-in: d11e4242c2 user: pjrinaldi@protonmail.com tags: main, origin/v0.1, trunk
21:51
working on ntfs attribute check-in: 33aa02a89c user: pjrinaldi@protonmail.com tags: main, origin/v0.1, trunk
15:35
working on implementing all ntfs mft entry attribute types, then i can work on the best way to collect all the values and put them into the item nodes, ads nodes, and properties. check-in: 5c6790b51b user: pjrinaldi@protonmail.com tags: main, origin/v0.1, trunk
14:56
got IndexRoot/Allocation Attribute parsed check-in: 1ec9e82645 user: pjrinaldi@protonmail.com tags: main, origin/v0.1, trunk