Hello Reader,

After some testing James Alwood in our office was able to get dfVFS installed using just MSI packages from the log2timeline project. This is a big step for us as it severly lowers the bar of who can take advantage of all the advanced capabilities that dfVFS provides versus modules like pytsk on their own. In this first post in the dfVFS series James has written a walk through on how to do install it and make sure it works. 

Digital Forensics Virtual File System (dfVFS) is a flexible file system that allows its users to access many different kinds of image formats using Python.  Getting it up and running can be difficult and confusing.  This guide will help you install everything you need to get started using dfVFS on Windows.  I am assuming you already have 32 bit Python 2.7.9 or .10 installed.

dfVFS has a lot of dependencies, fortunately most of them packaged together and made available for log2timeline.

1) Go to https://github.com/log2timeline/l2tbinaries

2) Click on the “Download ZIP” button on the right side of the screen

3) Unzip the file

4) Go to the win32 folder

5) Install the msi’s for the following packages into your Python installation (name is before version number):

                six

                construct

protobuf

                pytsk3

                pybde

                pyewf
                pycrypto

                libqcow

                libsigscan

libsmdev

libsmraw

libvhdi

libvmdk

libvshadow
libfsntfs
libvslvm

6) Open a Python session in IDLE or from a command prompt

7) Enter

      >>>import sqlite3

      >>>sqlite3.sqlite_version

8) If the output is below version 3.7.8 (fresh Python installs seem to have 3.6.21) go to https://www.sqlite.org/download.html

9) Download sqlite-dll-win32-x86-3081002.zip and unzip the file

10) In C:\Python27\DLLs back up the sqlite3.dll and then copy the new sqlite3.dll you just downloaded to this folder

11) If you haven’t already, end your Python session then restart it.  Run the lines from Step 7 again.  You should now be on a more current version of sqlite3

12) All of your dependencies should now be installed

With all the dependencies installed we can now get the dfVFS module installed.

1) Go back into the win32 folder in the log2timelines archive from step 4 in part 1

2) Run the dfvfs msi located inside the win32 folder

3) When it is complete dfVFS will be added to your Python installation and ready for use

4) If you would like to test the installation to verify it was successful download the dfVFS zip available on Github: https://github.com/log2timeline/dfvfs

5) Unzip the archive.  DO NOT use the extract option included in Windows, it makes minor modifications to some of the test files while unpacking them and will cause tests to fail.

6) Open a command prompt and cd into the directory where you unpacked the dfVFS archive

7) Run python run_tests.py from this directory to verify that dfVFS was properly installed

8) If you rename or delete the dfvfs folder in your unzipped dfVFS archive and rerun run_tests.py the tester will run dfVFS from the installed package in your Python directory