recursivefs

README

recursive fs

A recursive file system that processes container files according to their file type. You can use it e.g. to read a pdf from a zip file on an NTFS disk image (s. below). It also provides the fs command line tool do use the functionality from the command line. recursivefs implements io/fs.FS.

Example

func main() {
	// Read the pdf header from a zip file on an NTFS disk image.

	// parse the file system
	fsys := recursivefs.New()

	// create fslib path
	wd, _ := os.Getwd()
	fpath, _ := fslib.ToFSPath(path.Join(wd, "testdata/data/filesystem/ntfs.dd/container/Computer forensics - Wikipedia.zip/Computer forensics - Wikipedia.pdf"))

	// get handle the README.md
	file, err := fsys.Open(fpath)
	if err != nil {
		panic(err)
	}

	// get content
	content, _ := io.ReadAll(file)

	// print content
	fmt.Println(string(content[0:4]))
	// Output: %PDF
}

---

The fs command

The fs command line tool that has various subcommands which imitate unix commands but for nested file system structures.

• fs cat: Print files
• fs file: Determine files types
• fs hashsum: Print hashsums
• fs ls: List directory contents
• fs stat: Display file status
• fs tree: List contents of directories in a tree-like format

Download

https://github.com/forensicanalysis/recursivefs/releases

Usage Examples

List all files in a zip file:

fs ls test.zip

Extract the Amcache.hve file from a NTFS image in a zip file:

fs cat case/evidence.zip/ntfs.dd/Windows/AppCompat/Programs/Amcache.hve > Amcache.hve

Hash all files in a zip file:

fs hashsum case/evidence.zip/*

Documentation

Overview

Package recursivefs provides an io/fs implementation that can open paths in nested file systems recursively. The forensicfs are identified using the filetype library. This way e.g. a file in a zip inside a disk image can be accessed.

Example

package main

import (
	"fmt"
	"io"
	"log"
	"os"
	"path"

	"github.com/forensicanalysis/fslib"
	"github.com/forensicanalysis/recursivefs"
)

func main() {
	// Read the pdf header from a zip file on an NTFS disk image.

	// parse the file system
	fsys := recursivefs.New()

	// create fslib path
	wd, _ := os.Getwd()
	nestedPath := "testdata/data/filesystem/ntfs.dd/document/Computer forensics - Wikipedia.pdf"
	fpath, _ := fslib.ToFSPath(path.Join(wd, nestedPath))

	file, err := fsys.Open(fpath)
	if err != nil {
		log.Fatal(err)
	}

	// get content
	content, _ := io.ReadAll(file)

	// print content
	fmt.Println(string(content[0:4]))
	// Outputx: %PDF
}

Index

• type FS
  • func New() *FS
  • func NewFS(root fs.FS) *FS
  • func (fsys *FS) Open(name string) (f fs.File, err error)
• type Info
  • func (m *Info) Info() (fs.FileInfo, error)
  • func (m *Info) IsDir() bool
  • func (m *Info) ModTime() time.Time
  • func (m *Info) Mode() fs.FileMode
  • func (m *Info) Name() string
  • func (m *Info) Size() int64
  • func (m *Info) Sys() interface{}
  • func (m *Info) Type() fs.FileMode
• type Item
  • func (i *Item) Close() error
  • func (i *Item) Read(bytes []byte) (int, error)
  • func (i *Item) ReadDir(n int) (entries []fs.DirEntry, err error)
  • func (i *Item) Stat() (fs.FileInfo, error)

Examples

• Package

Types

type FS

type FS struct {
	// contains filtered or unexported fields
}

FS implements a read-only meta file system that can access nested file system structures.

func New

func New() *FS

New creates a new recursive FS.

func NewFS

func NewFS(root fs.FS) *FS

New creates a new recursive FS.

func (*FS) Open

func (fsys *FS) Open(name string) (f fs.File, err error)

Open returns a File for the given location.

type Info

type Info struct {
	// contains filtered or unexported fields
}

Info wraps the fs.FileInfo.

func (*Info) Info

func (m *Info) Info() (fs.FileInfo, error)

func (*Info) IsDir

func (m *Info) IsDir() bool

IsDir returns if the item is a directory. Returns true for files that are file systems (e.g. zip archives).

func (*Info) ModTime

func (m *Info) ModTime() time.Time

func (*Info) Mode

func (m *Info) Mode() fs.FileMode

func (*Info) Name

func (m *Info) Name() string

func (*Info) Size

func (m *Info) Size() int64

func (*Info) Sys

func (m *Info) Sys() interface{}

func (*Info) Type

func (m *Info) Type() fs.FileMode

type Item

type Item struct {
	// contains filtered or unexported fields
}

Item describes files and directories in the file system.

func (*Item) Close

func (i *Item) Close() error

func (*Item) Read

func (i *Item) Read(bytes []byte) (int, error)

func (*Item) ReadDir

func (i *Item) ReadDir(n int) (entries []fs.DirEntry, err error)

ReadDir returns up to n child items of a directory.

func (*Item) Stat

func (i *Item) Stat() (fs.FileInfo, error)

Stat return an fs.FileInfo object that describes a file.