Usage

The simplest way to invoke the pre-made application is to call the run() method of the App class within the app module. The following example demonstrates how this canbe implemented as a simple launcher script:

#!python
from LaZy_NT import app
...
# Obtain command line arguments, e.g. via argparse, to pass to App() as
# keyword arguments. Otherwise defaults from `config` will be used.
...
application = app.App()
application.run()

Alternatively, the API exposed by LaZy_NT can be used to build a more customized file recovery application, without using the app module at all.

Installation

LaZy_NT is available on PyPI and installable via pip:

python -m pip install LaZy_NT

The following optional dependencies enhance LaZy_NT by adding metadata extraction for files after they’ve been carved:

hachoir-core, hachoir-parser, hacoir-metadata
openxmllib
pyPdf
Pillow (or PIL)

All optional dependencies will be installed automatically if LaZy_NT is installed through pip.

Documentation

Documentation for LaZy_NT was generated using pdoc.

Acknowledgements

I would like to recognize Richard Russon and Yuval Fledel, authors of the ‘NTFS Documentation’ manual associated with the Linux NTFS filesystem driver. Without their detailed explanation of the LZNT1 algorithm, this project would not have been possible.

I would also like to recognize Simson L. Garfinkel, designer of the well known ‘Bulk Extractor’ utility. While I have not viewed or used any of his source code or documentation in this project, the use of his utility was what inspired me to add ASCII extraction capabilities to this project.