159 lines
4.9 KiB
Bash
Executable File
159 lines
4.9 KiB
Bash
Executable File
#!/bin/bash
|
|
#===============================================================================
|
|
#
|
|
# DIRECTORY:
|
|
# /home/*/.local/share/nautilus/scripts/03-TSK/
|
|
# OR
|
|
# /home/*/.gnome2/nautilus-sctipts/03-TSK/ (deprecated)
|
|
#
|
|
# FILE:
|
|
# 03-sigfind-ng
|
|
#
|
|
# USAGE:
|
|
# Right klick on the first file of an EWF image (or RAW image) and
|
|
# choose this nautilus script from the context menu.
|
|
#
|
|
# OPTIONS:
|
|
# none
|
|
#
|
|
# DESCRIPTION:
|
|
# Runs modified sigfind (The Sleuth Kit) by Rune Nordvik to find sectors
|
|
# with possible GPT headers or VBRs with more precision.
|
|
#
|
|
# REQUIREMENTS:
|
|
# bash, zenity, gnome-terminal, sigfind (modified) and procps
|
|
#
|
|
# BUGS:
|
|
# ---
|
|
#
|
|
# NOTES:
|
|
# Tested on
|
|
# - Debian 8+
|
|
# - Arch Linux
|
|
#
|
|
# AUTHOR:
|
|
# Patrick Neumann, patrick@neumannsland.de
|
|
#
|
|
# COMPANY:
|
|
# (privately)
|
|
#
|
|
# VERSION:
|
|
# 0.9 (beta)
|
|
#
|
|
# LINK TO THE MOST CURRENT VERSIONS:
|
|
# https://
|
|
#
|
|
# CREATED:
|
|
# 24.03.2016
|
|
#
|
|
# COPYRIGHT (C):
|
|
# 2015-2020 - Patrick Neumann
|
|
#
|
|
# LICENSE:
|
|
# This program is free software: you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# WARRANTY:
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
#
|
|
# TODO:
|
|
# ---
|
|
#
|
|
# HISTORY:
|
|
# 0.9 - Patrick Neumann - Initial (public) release
|
|
#
|
|
#===============================================================================
|
|
|
|
#-------------------------------------------------------------------------------
|
|
# Additional supported Distribution(s) (add before Library!).
|
|
#-------------------------------------------------------------------------------
|
|
SUPPORTED_OSR="arch"
|
|
|
|
#-------------------------------------------------------------------------------
|
|
# Check for library (casualscripter_nautilus-scripts_functions.sh).
|
|
#-------------------------------------------------------------------------------
|
|
readonly LIBRARY="${0%/*/*}/.casualscripter_nautilus-scripts_functions.sh"
|
|
if [ ! -f "${LIBRARY}" ] ; then
|
|
zenity --error \
|
|
--text \
|
|
"ERROR: casualscripter_nautilus-scripts_functions.sh MISSING!"
|
|
exit 1
|
|
fi
|
|
|
|
source "${LIBRARY}"
|
|
|
|
#-------------------------------------------------------------------------------
|
|
# Checks (see library "casualscripter_nautilus-scripts_functions.sh").
|
|
#-------------------------------------------------------------------------------
|
|
check_dep "${MMLS_BIN}" "sleuthkit"
|
|
check_dep "${GTERMINAL_BIN}" "gnome-terminal"
|
|
check_dep "${SLEEP_BIN}" "coreutils"
|
|
check_dep "${PGREP_BIN}" "procps"
|
|
check_dep "${BASENAME_BIN}" "coreutils"
|
|
|
|
# needs modified sigfind by Rune Nordvik
|
|
check_dep "${SIGFIND_BIN}" "sigfind"
|
|
|
|
if ! "${SIGFIND_BIN}" 2>&1 | "${GREP_BIN}" --fixed-strings "Nordvik" > /dev/null ; then
|
|
${ZENITY_BIN} --error \
|
|
--text \
|
|
"ERROR: modified sigfind by Rune Nordvik NOT found!"
|
|
exit 1
|
|
fi
|
|
|
|
check_ext "${SOURCE}" "[eE]01|dd|DD|raw|RAW|img|IMG"
|
|
|
|
check_tmp
|
|
|
|
#-------------------------------------------------------------------------------
|
|
# Ask user for signature template.
|
|
#-------------------------------------------------------------------------------
|
|
multi_sigfind_tmpl() {
|
|
${ZENITY_BIN} --list \
|
|
--text "Please select a template!" \
|
|
--radiolist \
|
|
--column "" \
|
|
--column "Template (-t):" TRUE dospart FALSE gpt FALSE fat12or16 FALSE fat32 FALSE exfat FALSE ntfs FALSE hfsx FALSE apfs FALSE ext2 FALSE ext3 FALSE ext4 \
|
|
--width="320" \
|
|
--height="320"
|
|
}
|
|
|
|
readonly TEMPLATE="$( multi_sigfind_tmpl )"
|
|
|
|
if [ -z "${TEMPLATE}" ] ; then
|
|
${ZENITY_BIN} --error \
|
|
--text \
|
|
"ERROR: no template choosen!"
|
|
exit 1
|
|
fi
|
|
|
|
#-------------------------------------------------------------------------------
|
|
# Run sigfind.
|
|
#-------------------------------------------------------------------------------
|
|
SIGFIND_TXT="${TMP}/sigfind_${TEMPLATE}_$( ${BASENAME_BIN} "${SOURCE%.*}" ).txt"
|
|
${GTERMINAL_BIN} --hide-menubar -- ${BASH_BIN} -c \
|
|
"${UNBUFFER_BIN} ${SIGFIND_BIN} -t '${TEMPLATE}' '${SOURCE}' \
|
|
| ${TEE_BIN} --append '${SIGFIND_TXT}'"
|
|
|
|
${SLEEP_BIN} 3
|
|
|
|
# We have to wait until multi_sigfind has finished...
|
|
while ${PGREP_BIN} --full "${SIGFIND_BIN}" > /dev/null 2>&1; do
|
|
${SLEEP_BIN} 1
|
|
done
|
|
|
|
#-------------------------------------------------------------------------------
|
|
# Display content of the resultfile "sigfind...txt".
|
|
#-------------------------------------------------------------------------------
|
|
display_resultfile "${SIGFIND_TXT}"
|
|
|
|
exit 0
|