|Maintainer:||Kristinn Gudjonsson, Joachim Metz|
|OS:||Linux, Mac OS X, Windows|
dfVFS, or Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats. The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
dfVFS is currently implemented as a Python module.
Storage media types
- Encase image file format or EWF (EWF-E01, EWF-Ex01, EWF-S01) using libewf
- Raw Image Format or RAW using Python
- QCOW Image Format or QCOW using libqcow
- Storage media devices using libsmdev
- Virtual Disk Image (VDI) or VHD using libvhdi
- VMWare Virtual Disk Format (VMDK) using libvmdk
- using sleuthkit and pytsk
dfVFS originates from the Plaso project. It was largely rewritten and made into a stand-alone project to provide more flexibility and allow other projects to make use of the VFS functionality. dfVFS originally was named PyVFS, but that name conflicted with another project.