ATTENTION: The new home of the Digital Forensics Wiki is at Yeah, it's a silly name, but it was cheap.
This wiki will be going offline permanently in the near future. An exact date will be announced soon. Thank you for being a part of this community.
If you wish to work on the new forensicswiki, please join the Google Group forensicswiki-reborn

Difference between revisions of "Dfvfs"

From ForensicsWiki
Jump to: navigation, search
(Volume systems)
(File systems)
Line 28: Line 28:
=== File systems ===
=== File systems ===
* using [[sleuthkit]] and [[pytsk]]
* using [[sleuthkit]] and [[pytsk]]
** ext 2, 3, 4  
** [[Extended File System (Ext)]] or ext 2, 3, 4  
** FAT
** FAT

Revision as of 07:41, 2 January 2014

Maintainer: Kristinn Gudjonsson, Joachim Metz
OS: Linux, Mac OS X, Windows
Genre: Analysis
License: APL

dfVFS, or Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats. The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.

dfVFS is currently implemented as a Python module.

Supported Formats

Storage media types

Volume systems

File systems


dfVFS originates from the Plaso project. It was largely rewritten and made into a stand-alone project to provide more flexibility and allow other projects to make use of the VFS functionality. dfVFS originally was named PyVFS, but that name conflicted with another project.

See Also

External Links