Difference between pages "AppleDouble header file" and "Libmsiecf"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
m (can't figure we'd need to duplicate the wikipedia Resource Fork article locally)
 
(History)
 
Line 1: Line 1:
A separate file in a filesystem containing the [http://en.wikipedia.org/wiki/Resource_fork Apple resource fork] for a related data file, developed by Apple for A/UX and therefore compatible with other filesystems including those mounted remotely.  They are heavily used under [[ Mac OS X ]].
+
{{Infobox_Software |
 +
  name = libmsiecf |
 +
  maintainer = [[Joachim Metz]] |
 +
  os = [[Linux]], [[FreeBSD]], [[NetBSD]], [[OpenBSD]], [[Mac OS X]], [[Windows]] |
 +
  genre = {{Analysis}} |
 +
  license = {{LGPL}} |
 +
  website = [http://libmsiecf.sourceforge.net libmsiecf.sourceforge.net] |
 +
}}
  
This file is named the same as the data file, with "<code>._</code>" prepended to the original name.  These header files are automatically included in ZIP files under a hierarchy starting with "<code>__MACOSX</code>" when utilizing the Finder's "Archive as..." function.
+
The '''libmsiecf''' package contains a library and applications to read the [[Internet Explorer History File Format | MSIE Cache File]] format.
  
== References ==
+
== Tools ==  
 +
The libmsiecf package contains the following tools:
 +
* '''msiecfexport''', which exports the items stored in MSIECF files.
 +
* '''msiecfinfo''', which shows the information about MSIECF files.
  
; http://users.phg-online.de/tk/netatalk/doc/Apple/v1/
+
== Examples ==
: from "A/UX Toolbox: Macintosh ROM Interface manual", Chapter 6 File Systems and File Formats
+
: identifies the magic number <code>0x00051607</code> for AppleDouble files as the first 4 bytes in the file
+
  
; http://en.wikipedia.org/wiki/AppleDouble
+
Exporting items from an index.dat:
: background and additional information
+
<pre>
 +
msiecfexport -m items index.dat
 +
</pre>
  
; http://www.ietf.org/rfc/rfc1740.txt
+
Exporting recovered items from an index.dat:
: MIME Encapsulation of Macintosh files - MacMIME
+
<pre>
 +
msiecfexport -m recovered index.dat
 +
</pre>
  
[[Category:File Formats]]
+
Exporting an index.dat from a Chinese Windows installation:
 +
<pre>
 +
msiecfexport -c windows-936 index.dat
 +
</pre>
 +
 
 +
== History ==
 +
Libmsiecf was created by [[Joachim Metz]] in 2009, while working for [http://en.hoffmannbv.nl/ Hoffmann Investigations].
 +
 
 +
Libmsiecf is a rewrite of [http://sourceforge.net/projects/odessa/ pasco] with support for more recent versions of [[Internet Explorer History File Format | MSIE Cache Files]]
 +
 
 +
== See Also ==
 +
* [[Internet Explorer History File Format | MSIE Cache Files]]
 +
 
 +
== External Links ==
 +
* [http://code.google.com/p/libmsiecf/ Project site]
 +
* [http://libmsiecf.sourceforge.net/ Old project site]

Revision as of 02:23, 26 August 2012

libmsiecf
Maintainer: Joachim Metz
OS: Linux, FreeBSD, NetBSD, OpenBSD, Mac OS X, Windows
Genre: Analysis
License: LGPL
Website: libmsiecf.sourceforge.net

The libmsiecf package contains a library and applications to read the MSIE Cache File format.

Tools

The libmsiecf package contains the following tools:

  • msiecfexport, which exports the items stored in MSIECF files.
  • msiecfinfo, which shows the information about MSIECF files.

Examples

Exporting items from an index.dat:

msiecfexport -m items index.dat

Exporting recovered items from an index.dat:

msiecfexport -m recovered index.dat

Exporting an index.dat from a Chinese Windows installation:

msiecfexport -c windows-936 index.dat

History

Libmsiecf was created by Joachim Metz in 2009, while working for Hoffmann Investigations.

Libmsiecf is a rewrite of pasco with support for more recent versions of MSIE Cache Files

See Also

External Links