RecuperaBit
RecuperaBit copied to clipboard
Lazza
A tool for forensic file system reconstruction.
Is there a way to manually set sector size? I've got an image of a harddrive where the sector size is 4096 (because on modern harddrives that is what it...
The tree command is really great, especially when you only want to restore select parts of your partition. However the way it's displayed is a little subpar in my opinion....
First time I ran the tool I forgot to specify a savefile... which was quite the setback considering scanning my disk took 11 hours. It'd be great to add a...
I have been testing some "random" NTFS images and I see that sometimes most timestamps are off by years... I looked in the code, but am still not sure how...
Use $STANDARD_INFORMATION for modification time because only it is preserved on file copy. Reference: https://www.forensixchange.com/posts/19_04_22_win10_ntfs_time_rules/ My fix may not be the best, because I haven't read full code base, but...
Hello. Please consider the addition of this check to prevent exception. Probably not the best way to do this, but it worked in my case
I was recovering my disk that had first 1.4MB overwritten. I assume my VMs on that disks made recovering much harder, since list of recoverable partitions was this: [recoverable.txt](https://github.com/Lazza/RecuperaBit/files/6913626/recoverable.txt) In...
In the definition of attr_nonresident_fmt, I notice that the runlist is specified to depend on the runlist_offset and the allocated_size. Is there any reason, at least in theory, why it...
When I recovered my drive with RecuperaBit, I noticed that some files were producing an error like this one: `ERROR:root:Cannot restore $DATA attribute(s) for File(#4360743, ^^5^^, PMSFX_SAMPLER_MARCH_2021_Part1.zip, offset = 8754294...