Simson L. Garfinkel

Okay. This may be the issue. Where is the DFXML coming from? If it is not coming from fiwalk, it's coming from somewhere else, and that other program may not...

Yes, it is fiwalk, which does the DFXML output, but other tools may generate DFXML as well. > On May 11, 2017, at 5:13 PM, Alex Nelson wrote: > >...

Looks like in line 66 of walk_to_dfxml.py the filepath is assigned to fobj.filename. Elsewhere, it looks like the filename attribute may be emitted without being quoted. I think that Alex...

Hi Tim, How is the XML being generated — from fiwalk executable, or from a Python program? We probably need to revise the way that the XML is being generated....

Okay, I didn’t write Objects.py, and it is quite complex. It’s not really clear to me how it is generating the XML. It looks like it is using ETree.However, it...

Ah. Thanks for pointing me at the message history. Yes, I think that the mechanism described of having the original name with BASE64 and then having a human-usable name makes...

Correct. There is no block to find. Should be an easy fix---just check to see if variable is none and fail early. Please submit a pull request when it is...

Correct, that API only exposes the first stream, and AFF4 allows multiple streams and fragmented files. I want to iterate *all* streams, and then for each stream, I want to...

Not really, I think, as the AES test vectors do not include the internal memory structures used by the algorithms.

I want test vectors for the memory structures. You are suggesting that I create my own. I can do that, but I would rather have test vectors that others have...