Metadata-Version: 2.1
Name: DiskAnalyzer
Version: 1.0.0
Summary: This package implements multiples libraries and tools to parse, analyze and extract informations from disk file.
Home-page: https://github.com/mauricelambert/DiskAnalyzer
Author: Maurice Lambert
Author-email: mauricelambert434@gmail.com
Maintainer: Maurice Lambert
Maintainer-email: mauricelambert434@gmail.com
License: GPL-3.0 License
Download-URL: https://mauricelambert.github.io/info/python/security/DiskAnalyzer.pyz
Project-URL: Github, https://github.com/mauricelambert/DiskAnalyzer
Project-URL: Documentation, https://mauricelambert.github.io/info/python/security/DiskAnalyzer.html
Project-URL: Python Executable, https://mauricelambert.github.io/info/python/security/DiskAnalyzer.pyz
Project-URL: Windows Executable, https://mauricelambert.github.io/info/python/security/DiskAnalyzer.exe
Keywords: MFT,DiskAnalysis,ExFAT,ExFatBootSector,Forensic,NTFS,VBR,MBR,GPT,Windows,DFIR,IncidentResponse
Platform: Windows
Platform: Linux
Platform: MacOS
Classifier: Topic :: System
Classifier: Topic :: Security
Classifier: Environment :: Console
Classifier: Topic :: System :: Shells
Classifier: Operating System :: POSIX
Classifier: Natural Language :: English
Classifier: Programming Language :: Python
Classifier: Intended Audience :: Developers
Classifier: Topic :: System :: System Shells
Classifier: Operating System :: MacOS :: MacOS X
Classifier: Programming Language :: Python :: 3.8
Classifier: Operating System :: Microsoft :: Windows
Classifier: Topic :: System :: Systems Administration
Classifier: Intended Audience :: System Administrators
Classifier: Development Status :: 5 - Production/Stable
Classifier: License :: OSI Approved :: GNU General Public License v3 or later (GPLv3+)
Requires-Python: >=3.8
Description-Content-Type: text/markdown
License-File: LICENSE.txt

![DiskAnalyzer Logo](https://mauricelambert.github.io/info/python/security/DiskAnalyzer/DiskAnalyzer_small.png "DiskAnalyzer logo")

# DiskAnalyzer

## Description

This package implements multiples libraries and tools to parse, analyze
and extract informations from disk and main partition for the live system
or a full disk file.

 - Pure python package
 - Running on live Windows system
 - Analyze MBR (Master Boot Record) and GPT (GUID Partition Table)
 - List partitions
 - Analyze VBR (Volume Boot Record) for NTFS partition (New Technology File System)
 - Analyze MFT file and attribute (Master File Table)
 - Extract MFT file
 - Analyze MFT
 - Extract MFT Entries
 - Generate file full from path from MFT
 - Extract file content from NTFS partition
 - Analyze FAT32
 - Extract file content from FAT32 partition
 - Analyze ExFAT Boot Sector
 - Repair MBR for non bootable disk and MFT/ExFAT partitions (using disk carving)

## Requirements

This package require:

 - python3
 - python3 Standard Library

## Installation

### Pip

```bash
python3 -m pip install DiskAnalyzer
```

### Git

```bash
git clone "https://github.com/mauricelambert/DiskAnalyzer.git"
cd "DiskAnalyzer"
python3 -m pip install .
```

### Wget

```bash
wget https://github.com/mauricelambert/DiskAnalyzer/archive/refs/heads/main.zip
unzip main.zip
cd DiskAnalyzer-main
python3 -m pip install .
```

### cURL

```bash
curl -O https://github.com/mauricelambert/DiskAnalyzer/archive/refs/heads/main.zip
unzip main.zip
cd DiskAnalyzer-main
python3 -m pip install .
```

## Usages

### Command line

```bash
DiskAnalyzer              # Using CLI package executable
python3 -m DiskAnalyzer   # Using python module
python3 DiskAnalyzer.pyz  # Using python executable
DiskAnalyzer.exe          # Using python Windows executable

NtfsAnalyzer              # Using CLI package executable
python3 -m NtfsAnalyzer   # Using python module
python3 NtfsAnalyzer.pyz  # Using python executable
NtfsAnalyzer.exe          # Using python Windows executable

MftAnalyzer               # Using CLI package executable
python3 -m MftAnalyzer    # Using python module
python3 MftAnalyzer.pyz   # Using python executable
MftAnalyzer.exe           # Using python Windows executable

Fat32Analyzer             # Using CLI package executable
python3 -m Fat32Analyzer  # Using python module
python3 Fat32Analyzer.pyz # Using python executable
Fat32Analyzer.exe         # Using python Windows executable

MbrRepair                 # Using CLI package executable
python3 -m MbrRepair      # Using python module
python3 MbrRepair.pyz     # Using python executable
MbrRepair.exe             # Using python Windows executable

ExFatAnalyzer             # Using CLI package executable
python3 -m ExFatAnalyzer  # Using python module
python3 ExFatAnalyzer.pyz # Using python executable
ExFatAnalyzer.exe         # Using python Windows executable

# Fat32Analyzer have it's own argument parser
Fat32Analyzer /path/to/fat32.img
Fat32Analyzer /path/to/fat32.img -v # verbose

# Other commands use the same argument parser:
# (only one optionale argument: filepath, defaulft: main disk file)

MbrRepair                           # main disk
MbrRepair /path/to/disk

DiskAnalyzer                        # main disk
DiskAnalyzer /path/to/disk

NtfsAnalyzer                        # main disk
NtfsAnalyzer /path/to/disk

MftAnalyzer                         # main disk
MftAnalyzer /path/to/disk

ExFatAnalyzer                       # main disk
ExFatAnalyzer /path/to/disk
```

### Python script

```python
from DiskAnalyzer import *

print(disk_parsing(file_path="/path/to/disk").to_partition())

file, vbr, ntfs_offset = ntfs_parse(file_path="/path/to/disk")

(
	file,
	mft_entry,
	mft_entry_raw_data,
	mft_entry_offset,
	mft_entry_size,
	ntfs_offset,
	cluster_size,
) = parse_mft(file_path=filename)

file_extract(file, mft_entry, "$MFT", mft_entry_raw_data, ntfs_offset)

with open(
		"MftEntries.csv", newline='', encoding="utf-8"              # NOTE: MftEntries.csv was generated by running DiskAnalyzer from the command line
	) as entries, open(
		"FullPath.csv", newline='', encoding="utf-8"                # NOTE: FullPath.csv was generated by running DiskAnalyzer from the command line
	) as full_path, open("SAM", 'wb') as sam, open("SYSTEM", 'wb') as system:
	file_extract_from_csv(
		r'\\.\C:\.\Windows\System32\config\SAM', sam, entries, full_path, file
	)
	file_extract_from_csv(
		r'\\.\C:\.\Windows\System32\config\SYSTEM', system, entries, full_path, file
	)


file.close()
```

## Links

 - [Pypi](https://pypi.org/project/DiskAnalyzer)
 - [Github](https://github.com/mauricelambert/DiskAnalyzer)
 - [DiskAnalyzer - Documentation](https://mauricelambert.github.io/info/python/security/DiskAnalyzer/DiskAnalyzer.html)
 - [DiskAnalyzer - Python executable](https://mauricelambert.github.io/info/python/security/DiskAnalyzer/DiskAnalyzer.pyz)
 - [DiskAnalyzer - Python Windows executable](https://mauricelambert.github.io/info/python/security/DiskAnalyzer/DiskAnalyzer.exe)
 - [NtfsAnalyzer - Documentation](https://mauricelambert.github.io/info/python/security/DiskAnalyzer/NtfsAnalyzer.html)
 - [NtfsAnalyzer - Python executable](https://mauricelambert.github.io/info/python/security/DiskAnalyzer/NtfsAnalyzer.pyz)
 - [NtfsAnalyzer - Python Windows executable](https://mauricelambert.github.io/info/python/security/DiskAnalyzer/NtfsAnalyzer.exe)
 - [MftAnalyzer - Documentation](https://mauricelambert.github.io/info/python/security/DiskAnalyzer/MftAnalyzer.html)
 - [MftAnalyzer - Python executable](https://mauricelambert.github.io/info/python/security/DiskAnalyzer/MftAnalyzer.pyz)
 - [MftAnalyzer - Python Windows executable](https://mauricelambert.github.io/info/python/security/DiskAnalyzer/MftAnalyzer.exe)
 - [Fat32Analyzer - Documentation](https://mauricelambert.github.io/info/python/security/DiskAnalyzer/Fat32Analyzer.html)
 - [Fat32Analyzer - Python executable](https://mauricelambert.github.io/info/python/security/DiskAnalyzer/Fat32Analyzer.pyz)
 - [Fat32Analyzer - Python Windows executable](https://mauricelambert.github.io/info/python/security/DiskAnalyzer/Fat32Analyzer.exe)
 - [ExFatAnalyzer - Documentation](https://mauricelambert.github.io/info/python/security/DiskAnalyzer/ExFatAnalyzer.html)
 - [ExFatAnalyzer - Python executable](https://mauricelambert.github.io/info/python/security/DiskAnalyzer/ExFatAnalyzer.pyz)
 - [ExFatAnalyzer - Python Windows executable](https://mauricelambert.github.io/info/python/security/DiskAnalyzer/ExFatAnalyzer.exe)
 - [MbrRepair - Documentation](https://mauricelambert.github.io/info/python/security/DiskAnalyzer/MbrRepair.html)
 - [MbrRepair - Python executable](https://mauricelambert.github.io/info/python/security/DiskAnalyzer/MbrRepair.pyz)
 - [MbrRepair - Python Windows executable](https://mauricelambert.github.io/info/python/security/DiskAnalyzer/MbrRepair.exe)

## License

Licensed under the [GPL, version 3](https://www.gnu.org/licenses/).


