Hello Reader,
After some testing James Alwood in our office was able to get dfVFS installed using just MSI packages from the log2timeline project. This is a big step for us as it severly lowers the bar of who can take advantage of all the advanced capabilities that dfVFS provides versus modules like pytsk on their own. In this first post in the dfVFS series James has written a walk through on how to do install it and make sure it works.
Digital Forensics Virtual File System (dfVFS) is a flexible
file system that allows its users to access many different kinds of image
formats using Python. Getting it up and
running can be difficult and confusing.
This guide will help you install everything you need to get started
using dfVFS on Windows. I am assuming
you already have 32 bit Python 2.7.9 or .10 installed.
Dependencies
dfVFS has a lot of dependencies, fortunately most of them
packaged together and made available for log2timeline.
2) Click on the “Download ZIP” button on the right side of
the screen
3) Unzip the file
4) Go to the win32 folder
5) Install the msi’s for the following packages into your
Python installation (name is before version number):
six
construct
protobuf
pytsk3
pybde
pyewf
pycrypto
pycrypto
libqcow
libsigscan
libsmdev
libsmraw
libvhdi
libvmdk
libvshadow
libfsntfs
libvslvm
libfsntfs
libvslvm
6) Open a Python
session in IDLE or from a command prompt
7) Enter
>>>import sqlite3
>>>sqlite3.sqlite_version
8) If the output
is below version 3.7.8 (fresh Python installs seem to have 3.6.21) go to https://www.sqlite.org/download.html
9) Download sqlite-dll-win32-x86-3081002.zip and unzip the file
10) In
C:\Python27\DLLs back up the sqlite3.dll and then copy the new sqlite3.dll you
just downloaded to this folder
11) If you
haven’t already, end your Python session then restart it. Run the lines from Step 7 again. You should now be on a more current version
of sqlite3
12) All of your
dependencies should now be installed
Installing dfVFS
With all the dependencies installed we can now get the dfVFS
module installed.
1) Go back into the win32 folder in the log2timelines
archive from step 4 in part 1
2) Run the dfvfs msi located inside the win32 folder
3) When it is complete dfVFS will be added to your Python
installation and ready for use
4) If you would like to test the installation to verify it
was successful download the dfVFS zip available on Github: https://github.com/log2timeline/dfvfs
5) Unzip the
archive. DO NOT use the extract option included in Windows, it makes minor
modifications to some of the test files while unpacking them and will cause
tests to fail.
6) Open a
command prompt and cd into the
directory where you unpacked the dfVFS archive
7) Run python run_tests.py from this directory to verify that dfVFS
was properly installed
8) If you rename or delete the dfvfs folder in your unzipped
dfVFS archive and rerun run_tests.py the
tester will run dfVFS from the installed package in your Python directory
.png)
