Added Nautilus scripts for TSK

This commit is contained in:
Patrick Neumann 2020-11-29 22:29:48 +01:00
parent 5336abb4d9
commit 5230d1d602
5 changed files with 676 additions and 0 deletions

View File

@ -0,0 +1,117 @@
#!/bin/bash
#===============================================================================
#
# DIRECTORY:
# /home/*/.local/share/nautilus/scripts/03-TSK/
# OR
# /home/*/.gnome2/nautilus-sctipts/03-TSK/ (deprecated)
#
# FILE:
# 01-mmstat
#
# USAGE:
# Right klick on the first file of an EWF image (or a RAW image) and
# choose this nautilus script from the context menu.
#
# OPTIONS:
# none
#
# DESCRIPTION:
# Shows/stores the partition scheme off a block device or image
# in an EWF image.
#
# REQUIREMENTS:
# bash, zenity and sleuthkit
#
# BUGS:
# ---
#
# NOTES:
# Tested on
# - Debian 8+
# - Arch Linux
#
# AUTHOR:
# Patrick Neumann, patrick@neumannsland.de
#
# COMPANY:
# (privately)
#
# VERSION:
# 0.9 (beta)
#
# LINK TO THE MOST CURRENT VERSIONS:
# ...
#
# CREATED:
# 15.09.2020
#
# COPYRIGHT (C):
# 2015-2020 - Patrick Neumann
#
# LICENSE:
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# WARRANTY:
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
# TODO:
# ---
#
# HISTORY:
# 0.9 - Patrick Neumann - Initial (public) release
#
#===============================================================================
#-------------------------------------------------------------------------------
# Additional supported Distribution(s) (add before Library!).
#-------------------------------------------------------------------------------
SUPPORTED_OSR="arch"
#-------------------------------------------------------------------------------
# Check for library (casualscripter_nautilus-scripts_functions.sh).
#-------------------------------------------------------------------------------
readonly LIBRARY="${0%/*/*}/.casualscripter_nautilus-scripts_functions.sh"
if [ ! -f "${LIBRARY}" ] ; then
zenity --error \
--text \
"ERROR: casualscripter_nautilus-scripts_functions.sh MISSING!"
exit 1
fi
source "${LIBRARY}"
#-------------------------------------------------------------------------------
# Checks (see library "casualscripter_nautilus-scripts_functions.sh").
#-------------------------------------------------------------------------------
check_dep "${MMLS_BIN}" "sleuthkit"
check_ext "${SOURCE}" "[eE]01|dd|DD|raw|RAW|img|IMG"
check_tmp
#-------------------------------------------------------------------------------
# Generate mmstat...txt, if necessary.
#-------------------------------------------------------------------------------
readonly MMSTAT="${TMP}/mmstat-0-$( ${BASENAME_BIN} "${SOURCE}" ).txt"
# partition scheme
if [ ! -f "${MMSTAT}" ] ; then
${MMSTAT_BIN} "${SOURCE}" > "${MMSTAT}"
fi
#-------------------------------------------------------------------------------
# Display content of the resultfile "mmstat...txt".
#-------------------------------------------------------------------------------
display_resultfile "${MMSTAT}"
exit 0

View File

@ -0,0 +1,117 @@
#!/bin/bash
#===============================================================================
#
# DIRECTORY:
# /home/*/.local/share/nautilus/scripts/03-TSK/
# OR
# /home/*/.gnome2/nautilus-sctipts/03-TSK/ (deprecated)
#
# FILE:
# 02a-mmls
#
# USAGE:
# Right klick on the first file of an EWF image (or a RAW image) and
# choose this nautilus script from the context menu.
#
# OPTIONS:
# none
#
# DESCRIPTION:
# Shows/stores the partition layout off a block device or image
# in an EWF image.
#
# REQUIREMENTS:
# bash, zenity and sleuthkit
#
# BUGS:
# ---
#
# NOTES:
# Tested on
# - Debian 8+
# - Arch Linux
#
# AUTHOR:
# Patrick Neumann, patrick@neumannsland.de
#
# COMPANY:
# (privately)
#
# VERSION:
# 0.9 (beta)
#
# LINK TO THE MOST CURRENT VERSIONS:
# ...
#
# CREATED:
# 15.09.2020
#
# COPYRIGHT (C):
# 2015-2020 - Patrick Neumann
#
# LICENSE:
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# WARRANTY:
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
# TODO:
# ---
#
# HISTORY:
# 0.9 - Patrick Neumann - Initial (public) release
#
#===============================================================================
#-------------------------------------------------------------------------------
# Additional supported Distribution(s) (add before Library!).
#-------------------------------------------------------------------------------
SUPPORTED_OSR="arch"
#-------------------------------------------------------------------------------
# Check for library (casualscripter_nautilus-scripts_functions.sh).
#-------------------------------------------------------------------------------
readonly LIBRARY="${0%/*/*}/.casualscripter_nautilus-scripts_functions.sh"
if [ ! -f "${LIBRARY}" ] ; then
zenity --error \
--text \
"ERROR: casualscripter_nautilus-scripts_functions.sh MISSING!"
exit 1
fi
source "${LIBRARY}"
#-------------------------------------------------------------------------------
# Checks (see library "casualscripter_nautilus-scripts_functions.sh").
#-------------------------------------------------------------------------------
check_dep "${MMLS_BIN}" "sleuthkit"
check_ext "${SOURCE}" "[eE]01|dd|DD|raw|RAW|img|IMG"
check_tmp
#-------------------------------------------------------------------------------
# Generate mmls...txt, if necessary.
#-------------------------------------------------------------------------------
readonly MMLS="${TMP}/mmls-0-$( ${BASENAME_BIN} "${SOURCE}" ).txt"
# partition table
if [ ! -f "${MMLS}" ] ; then
${MMLS_BIN} -r "${SOURCE}" > "${MMLS}"
fi
#-------------------------------------------------------------------------------
# Display content of the resultfile "mmls...txt".
#-------------------------------------------------------------------------------
display_resultfile "${MMLS}"
exit 0

View File

@ -0,0 +1,117 @@
#!/bin/bash
#===============================================================================
#
# DIRECTORY:
# /home/*/.local/share/nautilus/scripts/03-TSK/
# OR
# /home/*/.gnome2/nautilus-sctipts/03-TSK/ (deprecated)
#
# FILE:
# 02b-mmls-force-MBR
#
# USAGE:
# Right klick on the first file of an EWF image (or a RAW image) and
# choose this nautilus script from the context menu.
#
# OPTIONS:
# none
#
# DESCRIPTION:
# Shows/stores the MBR-partition layout off a block device or image
# in an EWF image even if it is actually GPT.
#
# REQUIREMENTS:
# bash, zenity and sleuthkit
#
# BUGS:
# ---
#
# NOTES:
# Tested on
# - Debian 8+
# - Arch Linux
#
# AUTHOR:
# Patrick Neumann, patrick@neumannsland.de
#
# COMPANY:
# (privately)
#
# VERSION:
# 0.9 (beta)
#
# LINK TO THE MOST CURRENT VERSIONS:
# ...
#
# CREATED:
# 13.11.2020
#
# COPYRIGHT (C):
# 2015-2020 - Patrick Neumann
#
# LICENSE:
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# WARRANTY:
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
# TODO:
# ---
#
# HISTORY:
# 0.9 - Patrick Neumann - Initial (public) release
#
#===============================================================================
#-------------------------------------------------------------------------------
# Additional supported Distribution(s) (add before Library!).
#-------------------------------------------------------------------------------
SUPPORTED_OSR="arch"
#-------------------------------------------------------------------------------
# Check for library (casualscripter_nautilus-scripts_functions.sh).
#-------------------------------------------------------------------------------
readonly LIBRARY="${0%/*/*}/.casualscripter_nautilus-scripts_functions.sh"
if [ ! -f "${LIBRARY}" ] ; then
zenity --error \
--text \
"ERROR: casualscripter_nautilus-scripts_functions.sh MISSING!"
exit 1
fi
source "${LIBRARY}"
#-------------------------------------------------------------------------------
# Checks (see library "casualscripter_nautilus-scripts_functions.sh").
#-------------------------------------------------------------------------------
check_dep "${MMLS_BIN}" "sleuthkit"
check_ext "${SOURCE}" "[eE]01|dd|DD|raw|RAW|img|IMG"
check_tmp
#-------------------------------------------------------------------------------
# Generate mmls...txt, if necessary.
#-------------------------------------------------------------------------------
readonly MMLS="${TMP}/mmls-force-MBR-0-$( ${BASENAME_BIN} "${SOURCE}" ).txt"
# partition table
if [ ! -f "${MMLS}" ] ; then
${MMLS_BIN} -t dos -r "${SOURCE}" > "${MMLS}"
fi
#-------------------------------------------------------------------------------
# Display content of the resultfile "mmls...txt".
#-------------------------------------------------------------------------------
display_resultfile "${MMLS}"
exit 0

View File

@ -0,0 +1,158 @@
#!/bin/bash
#===============================================================================
#
# DIRECTORY:
# /home/*/.local/share/nautilus/scripts/03-TSK/
# OR
# /home/*/.gnome2/nautilus-sctipts/03-TSK/ (deprecated)
#
# FILE:
# 03-sigfind-ng
#
# USAGE:
# Right klick on the first file of an EWF image (or RAW image) and
# choose this nautilus script from the context menu.
#
# OPTIONS:
# none
#
# DESCRIPTION:
# Runs modified sigfind (The Sleuth Kit) by Rune Nordvik to find sectors
# with possible GPT headers or VBRs with more precision.
#
# REQUIREMENTS:
# bash, zenity, gnome-terminal, sigfind (modified) and procps
#
# BUGS:
# ---
#
# NOTES:
# Tested on
# - Debian 8+
# - Arch Linux
#
# AUTHOR:
# Patrick Neumann, patrick@neumannsland.de
#
# COMPANY:
# (privately)
#
# VERSION:
# 0.9 (beta)
#
# LINK TO THE MOST CURRENT VERSIONS:
# https://
#
# CREATED:
# 24.03.2016
#
# COPYRIGHT (C):
# 2015-2020 - Patrick Neumann
#
# LICENSE:
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# WARRANTY:
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
# TODO:
# ---
#
# HISTORY:
# 0.9 - Patrick Neumann - Initial (public) release
#
#===============================================================================
#-------------------------------------------------------------------------------
# Additional supported Distribution(s) (add before Library!).
#-------------------------------------------------------------------------------
SUPPORTED_OSR="arch"
#-------------------------------------------------------------------------------
# Check for library (casualscripter_nautilus-scripts_functions.sh).
#-------------------------------------------------------------------------------
readonly LIBRARY="${0%/*/*}/.casualscripter_nautilus-scripts_functions.sh"
if [ ! -f "${LIBRARY}" ] ; then
zenity --error \
--text \
"ERROR: casualscripter_nautilus-scripts_functions.sh MISSING!"
exit 1
fi
source "${LIBRARY}"
#-------------------------------------------------------------------------------
# Checks (see library "casualscripter_nautilus-scripts_functions.sh").
#-------------------------------------------------------------------------------
check_dep "${MMLS_BIN}" "sleuthkit"
check_dep "${GTERMINAL_BIN}" "gnome-terminal"
check_dep "${SLEEP_BIN}" "coreutils"
check_dep "${PGREP_BIN}" "procps"
check_dep "${BASENAME_BIN}" "coreutils"
# needs modified sigfind by Rune Nordvik
check_dep "${SIGFIND_BIN}" "sigfind"
if ! "${SIGFIND_BIN}" 2>&1 | "${GREP_BIN}" --fixed-strings "Nordvik" > /dev/null ; then
${ZENITY_BIN} --error \
--text \
"ERROR: modified sigfind by Rune Nordvik NOT found!"
exit 1
fi
check_ext "${SOURCE}" "[eE]01|dd|DD|raw|RAW|img|IMG"
check_tmp
#-------------------------------------------------------------------------------
# Ask user for signature template.
#-------------------------------------------------------------------------------
multi_sigfind_tmpl() {
${ZENITY_BIN} --list \
--text "Please select a template!" \
--radiolist \
--column "" \
--column "Template (-t):" TRUE dospart FALSE gpt FALSE fat12or16 FALSE fat32 FALSE exfat FALSE ntfs FALSE hfsx FALSE apfs FALSE ext2 FALSE ext3 FALSE ext4 \
--width="320" \
--height="320"
}
readonly TEMPLATE="$( multi_sigfind_tmpl )"
if [ -z "${TEMPLATE}" ] ; then
${ZENITY_BIN} --error \
--text \
"ERROR: no template choosen!"
exit 1
fi
#-------------------------------------------------------------------------------
# Run sigfind.
#-------------------------------------------------------------------------------
SIGFIND_TXT="${TMP}/sigfind_${TEMPLATE}_$( ${BASENAME_BIN} "${SOURCE%.*}" ).txt"
${GTERMINAL_BIN} --hide-menubar -- ${BASH_BIN} -c \
"${UNBUFFER_BIN} ${SIGFIND_BIN} -t '${TEMPLATE}' '${SOURCE}' \
| ${TEE_BIN} --append '${SIGFIND_TXT}'"
${SLEEP_BIN} 3
# We have to wait until multi_sigfind has finished...
while ${PGREP_BIN} --full "${SIGFIND_BIN}" > /dev/null 2>&1; do
${SLEEP_BIN} 1
done
#-------------------------------------------------------------------------------
# Display content of the resultfile "sigfind...txt".
#-------------------------------------------------------------------------------
display_resultfile "${SIGFIND_TXT}"
exit 0

View File

@ -0,0 +1,167 @@
#!/bin/bash
#===============================================================================
#
# DIRECTORY:
# /home/*/.local/share/nautilus/scripts/03-TSK/
# OR
# /home/*/.gnome2/nautilus-sctipts/03-TSK/ (deprecated)
#
# FILE:
# 04-fsstat-and-fls-root
#
# USAGE:
# Right klick on the first file of an EWF image (or a RAW image) and
# choose this nautilus script from the context menu.
#
# OPTIONS:
# none
#
# DESCRIPTION:
# Shows/stores all file system information incl. content of the root
# directoryoff all partitions off a block device or image in an EWF image.
#
# REQUIREMENTS:
# bash, zenity and sleuthkit
#
# BUGS:
# ---
#
# NOTES:
# Tested on
# - Debian 8+
# - Arch Linux
#
# AUTHOR:
# Patrick Neumann, patrick@neumannsland.de
#
# COMPANY:
# (privately)
#
# VERSION:
# 0.9 (beta)
#
# LINK TO THE MOST CURRENT VERSIONS:
# ...
#
# CREATED:
# 15.09.2020
#
# COPYRIGHT (C):
# 2015-2020 - Patrick Neumann
#
# LICENSE:
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# WARRANTY:
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
# TODO:
# ---
#
# HISTORY:
# 0.9 - Patrick Neumann - Initial (public) release
#
#===============================================================================
#-------------------------------------------------------------------------------
# Additional supported Distribution(s) (add before Library!).
#-------------------------------------------------------------------------------
SUPPORTED_OSR="arch"
#-------------------------------------------------------------------------------
# Check for library (casualscripter_nautilus-scripts_functions.sh).
#-------------------------------------------------------------------------------
readonly LIBRARY="${0%/*/*}/.casualscripter_nautilus-scripts_functions.sh"
if [ ! -f "${LIBRARY}" ] ; then
zenity --error \
--text \
"ERROR: casualscripter_nautilus-scripts_functions.sh MISSING!"
exit 1
fi
source "${LIBRARY}"
#-------------------------------------------------------------------------------
# Checks (see library "casualscripter_nautilus-scripts_functions.sh").
#-------------------------------------------------------------------------------
check_dep "${MMLS_BIN}" "sleuthkit"
check_dep "${FIND_BIN}" "findutils"
check_dep "${FSSTAT_BIN}" "sleuthkit"
check_ext "${SOURCE}" "[eE]01|dd|DD|raw|RAW|img|IMG"
check_tmp
#-------------------------------------------------------------------------------
# Generate fsinfo...txt files, if necessary.
#-------------------------------------------------------------------------------
for offset1 in $( ${MMLS_BIN} -aM "${SOURCE}" \
| ${AWK_BIN} '/^[[:digit:]]/ { print $3; }' \
| ${SED_BIN} 's/^0*//' )
do
mmstat="$( ${MMSTAT_BIN} -t bsd -o "${offset1}" "${SOURCE}" 2>/dev/null )"
# if not a BSD VBR
if [ -z "${mmstat}" ] ; then
fsstat1="$( ${FSSTAT_BIN} -o "${offset1}" "${SOURCE}" 2>/dev/null )"
# if file system type is known
if [ -n "${fsstat1}" ] ; then
echo "${fsstat1}" \
| ${AWK_BIN} '/File System Type|Volume (ID|Name|Label)/ { print; }' \
> "${TMP}/fsinfo-${offset1}-$( ${BASENAME_BIN} "${SOURCE}" ).txt"
echo >> "${TMP}/fsinfo-${offset1}-$( ${BASENAME_BIN} "${SOURCE}" ).txt"
${FLS_BIN} -o "${offset1}" "${SOURCE}" \
>> "${TMP}/fsinfo-${offset1}-$( ${BASENAME_BIN} "${SOURCE}" ).txt"
else
for block in $( ${PSTAT_BIN} -o "${offset1}" "${SOURCE}" 2>/dev/null | ${AWK_BIN} '/APSB Block Number:/ { print $NF; }' ) ; do
fsstat11="$( ${FSSTAT_BIN} -o "${offset1}" -B "${block}" "${SOURCE}" 2>/dev/null )"
# if file system type of a pool is known
if [ -n "${fsstat11}" ] ; then
echo "${fsstat11}" \
| ${AWK_BIN} '/File System Type|Volume UUID|APSB Block Number|Name \(Role\)/ { print; }' \
> "${TMP}/fsinfo-${offset1}-${block}-$( ${BASENAME_BIN} "${SOURCE}" ).txt"
echo >> "${TMP}/fsinfo-${offset1}-${block}-$( ${BASENAME_BIN} "${SOURCE}" ).txt"
${FLS_BIN} -o "${offset1}" -B "${block}" "${SOURCE}" \
>> "${TMP}/fsinfo-${offset1}-${block}-$( ${BASENAME_BIN} "${SOURCE}" ).txt"
fi
done
fi
# if a BSD VBR
else
echo "${mmstat}" > "${TMP}/mmstat-${offset1}-$( ${BASENAME_BIN} "${SOURCE}" ).txt"
for offset2 in $( ${MMLS_BIN} -t bsd -o "${offset1}" -aM "${SOURCE}"
| ${AWK_BIN} '/^[[:digit:]]/ { print $3; }' \
| ${SED_BIN} 's/^0*//' )
do
fsstat2="$( ${FSSTAT_BIN} -o "${offset2}" "${SOURCE}" 2>/dev/null )"
if [ -n "${fsstat2}" ] ; then
echo "${fsstat2}" \
| ${AWK_BIN} '/File System Type|Volume (ID|Name|Label)/ { print; }' \
> "${TMP}/fsinfo-${offset2}-$( ${BASENAME_BIN} "${SOURCE}" ).txt"
echo >> "${TMP}/fsinfo-${offset2}-$( ${BASENAME_BIN} "${SOURCE}" ).txt"
${FLS_BIN} -o "${offset2}" "${SOURCE}" \
>> "${TMP}/fsinfo-${offset2}-$( ${BASENAME_BIN} "${SOURCE}" ).txt"
fi
done
fi
done | ${ZENITY_BIN} --progress \
--title="fsinfo (stat and ls root)" \
--text="Please wait..." \
--pulsate
#-------------------------------------------------------------------------------
# Display content of the resultfiles.
#-------------------------------------------------------------------------------
for resultfile in $( ${FIND_BIN} "${TMP}" -type f -name "fsinfo-*-$( ${BASENAME_BIN} "${SOURCE}" ).txt" ) ; do
display_resultfile "${resultfile}"
done
exit 0