disk-detective 0.4.0

Provides tools to analyze disks on byte level

Description

Provides tools to analyze disks on byte level

Available Tools

• Master Boot Record Examiner

  • Provides information and analysis of MBR

• FAT Examiner

  • Provides information and analysis of:
    • FAT VBR
    • FAT FSInfo
    • FAT Directory Entry
    • FAT Long Filename

Under Construction

• Disk Usage Information
  • Overview of disk space usage based on MBR information

Future Tools

• Extended Partition Analyser

  • Examines extended parititions

• File System Analyser

  • ext
  • NTFS

Installation

pip install disk_detective

Usage

From command line:

python -m disk_detective --path PATH --mode {mbr,structure,fat-vbr,fat-fsinfo,fat-lfn,fat-dir-entry} [--offset OFFSET]

Option	Short	Type	Default	Description
--path	-p	String	-	Path to file (dd, raw) or path to disk (\.\PhysicalDrive0, /dev/sda, /dev/disk1)
--mode	-p	String	-	mbr = Examines the MBR usage = Overview of disk space usage fat-vbr = Examines FAT VBR fat-fsinfo = Examines FAT FSInfo fat-lfn = Examines Long Filename Entries fat-dir-entry = Examines Directory Entries
--offset	-o	Int	-	The offset in bytes to start reading

Example

Output for mode == mbr

python -m disk_detective -p path/to/example.dd -m mbr

Please find the result here

---

Output for mode == fat-vbr

python -m disk_detective -p path/to/example.dd -m fat-vbr -o 1048576

Please find the result here

---

Output for mode == fat-fsinfo

python -m disk_detective -p path/to/example.dd -m fat-fsinfo -o 1049088

Please find the result here

---

Output for mode == fat-lfn

python -m disk_detective -p path/to/example.dd -m fat-lfn

Please find the result here

---

Output for mode == fat-dir-entry

python -m disk_detective -p path/to/example.dd -m fat-dir-entry

Please find the result here

License

MIT