[Worker] Add a new worker for VHD file (used by Qbot)

[FafnerKeyZee]

Hey,

Qbot is now spreading via vhd instead of iso files :(

BR c861030b12c23dfaea29a8b27cb2ec3f88cd0a1a831dc083a4fe5dcd09f0bcba.vhd.zip

[Rafiot]

This library should (might?) be able to help: https://github.com/libyal/libvhdi/

But it is hardly documented so using it will require quite a lot of poking around. An other issue at this stage is that the mimetype isn't recognized by magic at all, so we will need to have a special type of workers that is triggered by the extension.

But the good news is that as it is not a recognizable mime type, it is considered as malicious by default on Pandora.

[FafnerKeyZee]

Using this code with some modifications it looks like it's working like a charm :) https://github.com/dlcowen/dfirwizard/blob/master/dfvfsWizardv3.py

dfvfsWizardv3.py.zip