fslib
fslib copied to clipboard
📚 A collection of tools and libraries to parse filesystems, archives and other data types
fslib
file system processing for forensics
The fslib project contains a collection of packages to parse file systems, archives and similar data. The included packages can be used to access disk images of with different partitioning and file systems. Additionally, file systems for live access to the currently mounted file system and registry (on Windows) are implemented.
All filesystems implement io/fs.
Included File systems
- Native OS file system (directory listing for Windows root provides list of drives)
- Windows Registry (live not from files)
- NTFS
- FAT16
- MBR
- GPT
Meta file systems
- Buffer FS: Buffer accessed files of an underlying file system
- System FS: Similar to the native OS file system, but falls back to NTFS on failing access on Windows
See also
- zipfs: A zip file system
- ⭐ Recursive FS: Access container files on file systems recursively, e.g.
"ntfs.dd/forensic.zip/Computer forensics - Wikipedia.pdf"
Installation
go get -u github.com/forensicanalysis/fslib
Example
func main() {
// Read the root directory on an NTFS disk image.
// open the disk image
image, _ := os.Open("filesystem/ntfs.dd")
// parse the file system
fsys, _ := ntfs.New(image)
// get filenames
entries, _ := fs.ReadDir(fsys, ".")
var filenames []string
for _, entry := range entries {
filenames = append(filenames, entry.Name())
}
// print filenames
fmt.Println(filenames)
}
Contact
For feedback, questions and discussions you can use the Open Source DFIR Slack.