IPED
IPED copied to clipboard
Add support for VDI and QCOW2 using native 7zip
As said before on https://github.com/sepinf-inc/IPED/issues/1825#issuecomment-1685164192 expanding containers using an external tool is not the ideal solution because of invalid or long path issues. Subitems may be processed before the full container expansion finishes maybe using this: https://docs.oracle.com/javase/8/docs/api/java/nio/file/WatchService.html
I found here 2 VDIs with different structures after opened by 7zip. First has directly shown files and folders like an ordinary zip file would looks like. For the second one 7zip has shown NTFS partitions, which we can extract and redirect to TSK to recover deleted files, this would need us to register some signatures for common file systems to identify them to redirect to TSK.
I don't have QCOW2 samples here, does someone have and could share to test a future support?
PS: 7zip also supports SquashFS and CramFS, but not sure if expanding them is worth to do.
I can try to generate some QCOW2 samples, This is a QEMU image file, and QEMU is used in proxmox, so I thinki it will be easy to create samples.
I can try to generate some QCOW2 samples, This is a QEMU image file, and QEMU is used in proxmox, so I thinki it will be easy to create samples.
That would be great, thank you @hauck-jvsh for trying to help with this!