Difference between pages "Libmsiecf" and "Virtual Hard Disk (VHD)"

From Forensics Wiki
(Difference between pages)
Jump to: navigation, search
 
(Image types)
 
Line 1: Line 1:
{{Infobox_Software |
+
{{expand}}
  name = libmsiecf |
+
  maintainer = [[Joachim Metz]] |
+
  os = [[Linux]], [[FreeBSD]], [[NetBSD]], [[OpenBSD]], [[Mac OS X]], [[Windows]] |
+
  genre = {{Analysis}} |
+
  license = {{LGPL}} |
+
  website = [http://code.google.com/p/libmsiecf/ code.google.com/p/libmsiecf/] |
+
}}
+
  
The '''libmsiecf''' package contains a library and applications to read the [[Internet Explorer History File Format | MSIE Cache File]] format.
+
== Image types ==
 +
There are multiple types of Virtual Hard Disk (VHD) images:
 +
* Fixed-size hard disk image
 +
* Dynamic-size (or sparse) hard disk image
 +
* Differencing (or delta) hard disk image
  
== Tools ==  
+
== External Links ==
The libmsiecf package contains the following tools:
+
* '''msiecfexport''', which exports the items stored in MSIECF files.
+
* '''msiecfinfo''', which shows the information about MSIECF files.
+
  
== Examples ==
+
* [http://en.wikipedia.org/wiki/VHD_(file_format) VHD (file format)], by Wikipedia
 +
* [http://technet.microsoft.com/en-us/library/bb676673.aspx Virtual Hard Disk Image Format Specification], by Microsoft
  
Exporting items from an index.dat:
 
<pre>
 
msiecfexport -m items index.dat
 
</pre>
 
  
Exporting recovered items from an index.dat:
+
[[Category:File Formats]]
<pre>
+
msiecfexport -m recovered index.dat
+
</pre>
+
 
+
Exporting an index.dat from a Chinese Windows installation:
+
<pre>
+
msiecfexport -c windows-936 index.dat
+
</pre>
+
 
+
== History ==
+
Libmsiecf was created by [[Joachim Metz]] in 2009, while working for [http://en.hoffmannbv.nl/ Hoffmann Investigations].
+
 
+
Libmsiecf is a rewrite of [http://sourceforge.net/projects/odessa/ pasco] with support for more recent versions of [[Internet Explorer History File Format | MSIE Cache Files]]
+
 
+
== See Also ==
+
* [[Internet Explorer History File Format | MSIE Cache Files]]
+
 
+
== External Links ==
+
* [http://code.google.com/p/libmsiecf/ Project site]
+
* [http://libmsiecf.sourceforge.net/ Old project site]
+

Revision as of 04:01, 13 September 2012

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

Image types

There are multiple types of Virtual Hard Disk (VHD) images:

  • Fixed-size hard disk image
  • Dynamic-size (or sparse) hard disk image
  • Differencing (or delta) hard disk image

External Links