You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In Analysis mode, each disk image is scanned and reported on. When complete, an "analysis.csv" file is created containing the following information for each disk image:
15
15
16
16
* Disk image name
17
-
* File system
17
+
* Volumes
18
+
* File systems
18
19
* Date statement
19
20
* Date begin
20
21
* Date end
@@ -26,7 +27,7 @@ The destination directory also contains a "reports" directory containing a sub-d
26
27
27
28
* A DFXML file
28
29
* Text output from "disktype"
29
-
* Brunnhilde reports (including logs and reports from clamAV and bulk_extractor)
30
+
* Brunnhilde reports (including logs and reports from ClamAV and bulk_extractor)
30
31
31
32
Optionally, the destination directory may also contain a "files" directory, containing exported logical files from each recognized disk image in the source.
In Processing mode, each disk image is turned into a SIP, packaged as an ideal transfer to Archivematica's Automation tools, and reported on.
40
41
41
-
For disks with most file systems, `fiwalk` is used to generate DFXML and The Sleuth Kit's `tsk_recover` utility is used to carve allocated files from each disk image. Modified dates for the carved files are then restored from their recorded values in the fiwalk-generated DFXML file.
42
+
From v1.1.0, Disk Image Processor will export files from multiple volumes if they are present on the disk image. In v1.0.0 and earlier, only one volume was exported depending on the first file system volume found by disktype.
42
43
43
-
For disks with an HFS file system, files are exported from the disk image using CLI version of HFSExplorer and DFXML is generated using the `walk_to_dfxml.py` script from the DFXML Python bindings.
44
+
For most file systems, `fiwalk` is used to generate DFXML and The Sleuth Kit's `tsk_recover` utility is used to carve allocated files from each disk image. Modified dates for the carved files are then restored from their recorded values in the fiwalk-generated DFXML file.
44
45
45
-
For disks with a UDF file system, files are copied from the mounted disk image and `walk_to_dfxml.py` is used to generate DFXML.
46
+
For HFS file systems, files are exported from the disk image using CLI version of HFSExplorer and DFXML is generated using the `walk_to_dfxml.py` script from the DFXML Python bindings.
47
+
48
+
For UDF file systems, files are copied from the mounted disk image and `walk_to_dfxml.py` is used to generate DFXML.
46
49
47
50
When complete, a "description.csv" spreadsheet is created containing some pre-populated archival description:
48
51
* Date statement
@@ -59,9 +62,9 @@ By default, the "objects" directory in each SIP contains both a copy of a raw di
59
62
60
63
The "metadata/submissionDocumentation" directory in each SIP contains:
61
64
62
-
*A DFXML file
65
+
*One or more DFXML files
63
66
* Text output from "disktype"
64
-
* Brunnhilde reports (including logs and reports from clamAV and, optionally, bulk_extractor)
67
+
* Brunnhilde reports (including logs and reports from ClamAV and, optionally, bulk_extractor)
65
68
66
69
### Process a single disk image, providing options to tsk_recover (CLI only)
67
70
@@ -104,24 +107,19 @@ Disk Image Processor recognizes which files are disk images by their file extens
104
107
105
108
## Installation and dependencies
106
109
107
-
This utility is designed for easy use in BitCurator v1.8.0+. All dependencies should already be installed in new releases of BitCurator. Installation outside of BitCurator is possible but difficult, with many dependencies, including Python3, PyQt5, TSK, Bulk Extractor, and the DFXML Python bindings. You will likely also need to modify some hardcoded paths in `main.py`and the processing scripts.
110
+
This utility is designed for easy use in BitCurator versions 2-4. All dependencies should already be installed in new releases of BitCurator. Installation outside of BitCurator is possible but difficult, with many dependencies, including Python3, PyQt5, TSK, HFS Explorer, md5deep, and Bulk Extractor.
108
111
109
112
### Install as part of CCA Tools
110
113
111
114
Install all of the CCA Tools together using the installation script included in the [CCA Tools repo](https://github.com/CCA-Public/cca-tools).
* Make install script executable (may need to be run with sudo privileges):
118
-
`chmod u+x install.sh`
119
-
* Run the install script with sudo privileges:
120
-
`sudo ./install.sh`
121
-
122
-
### PyQt4 version
123
-
124
-
Please note that Disk Image Processor v1.0.0 uses PyQt5. Installation of PyQt5 may cause issues with existing PyQt4 programs in BitCurator. For the a PyQt4 version of the Disk Image Processor that will not affect the functionality of other tools, see the [0.7.3 release](https://github.com/CCA-Public/diskimageprocessor/releases/tag/v0.7.3).
121
+
* Run the install script with sudo privileges (assuming BitCurator 4; for BitCurator 2-3 run `./install-bc2-ubuntu18.sh` instead):
0 commit comments