Was this page helpful?

Scalpel

內容表格
沒有標頭

http://www.digitalforensicssolutions.com/Scalpel/
當File system  嚴重損壞時.Rstudio 這類軟體由於算法不夠理想,碎片跟Block無法計算正確.
會有不少錯誤大檔.
Scalpel 為先進 file carver recovery  數據恢復程式 ,用覺佳file header 跟block 算法.
效果跟速度比Rstudio 算式效果好
但是Scalpel 為純command 使用方式 介面不友善

因此本實驗室自行編寫其前台介面軟體
原始碼公開如下 (請尊重GPL 標準) 

使用方法 下載 ZIP 包.解開
1.選擇Sources IMG 或指定物理磁碟 
2.勾選預定恢復的附檔格式.
3.選定輸出目錄 (裡面不可有檔案) 就會自動執行

 

sc.jpg

 


#-*- coding: UTF-8 -*-
# Scalpel GUI 0.1
# Code by OSSLab  thx  .


import wx
import os
import wmi
import subprocess

ext = """# art y 150000 \\x4a\\x47\\x04\\x0e \\xcf\\xc7\\xcb
# art y 150000 \\x4a\\x47\\x03\\x0e \\xd0\\xcb\\x00\\x00
# gif y 5000000 \\x47\\x49\\x46\\x38\\x37\\x61 \\x00\\x3b
# gif y 5000000 \\x47\\x49\\x46\\x38\\x39\\x61 \\x00\\x00\\x3b
# jpg y 200000000 \\xff\\xd8\\xff\\xe0\\x00\\x10 \\xff\\xd9
# jpg y 200000000 \\xff\\xd8\\xff\\xe1 \\xff\\xd9
# png y 20000000 \\x50\\x4e\\x47? \\xff\\xfc\\xfd\\xfe
# bmp y 100000 BM??\\x00\\x00\\x00
# tif y 200000000 \\x49\\x49\\x2a\\x00
# tif y 200000000 \\x4D\\x4D\\x00\\x2A
# avi y 50000000 RIFF????AVI
# mov y 10000000 ????moov
# mov y 10000000 ????mdat
# mov y 10000000 ????widev
# mov y 10000000 ????skip
# mov y 10000000 ????free
# mov y 10000000 ????idsc
# mov y 10000000 ????pckg
# mpg y 50000000 \\x00\\x00\\x01\\xba \\x00\\x00\\x01\\xb9
# mpg y 50000000 \\x00\\x00\\x01\\xb3 \\x00\\x00\\x01\\xb7
# fws y 4000000 FWS
# wav y 200000 RIFF????WAVE
# ra y 1000000 .RMF
# ra y 1000000 \\x2e\\x72\\x61\\xfd
# asf y 8000000 \\x30\\x26\\xB2\\x75\\x8E\\x66\\xCF\\x11\\xA6\\xD9\\x00\\xAA\\x00\\x62\\xCE\\x6C
# wmv y 20000000 \\x30\\x26\\xB2\\x75\\x8E\\x66\\xCF\\x11\\xA6\\xD9\\x00\\xAA\\x00\\x62\\xCE\\x6C
# wma y 8000000 \\x30\\x26\\xB2\\x75 \\x00\\x00\\x00\\xFF
# wma y 8000000 \\x30\\x26\\xB2\\x75 \\x52\\x9A\\x12\\x46
# mp3 y 8000000 \\xFF\\xFB??\\x44\\x00\\x00
# mp3 y 8000000 \\x57\\x41\\x56\\45 \\x00\\x00\\xFF\\
# mp3 y 8000000 \\xFF\\xFB\\xD0\\ \\xD1\\x35\\x51\\xCC\\
# mp3 y 8000000 \\x49\\x44\\x33\\
# mp3 y 8000000 \\x4C\\x41\\x4D\\x45\\
# doc y 10000000 \\xd0\\xcf\\x11\\xe0\\xa1\\xb1\\x1a\\xe1\\x00\\x00 \\xd0\\xcf\\x11\\xe0\\xa1\\xb1\\x1a\\xe1\\x00\\x00 NEXT
# doc y 10000000 \\xd0\\xcf\\x11\\xe0\\xa1\\xb1
# pst y 500000000 \\x21\\x42\\x4e\\xa5\\x6f\\xb5\\xa6
# ost y 500000000 \\x21\\x42\\x44\\x4e
# dbx y 10000000 \\xcf\\xad\\x12\\xfe\\xc5\\xfd\\x74\\x6f
# idx y 10000000 \\x4a\\x4d\\x46\\x39
# mbx y 10000000 \\x4a\\x4d\\x46\\x36
# wpc y 1000000 ?WPC
# htm n 50000 <html </html>
# pdf y 5000000 %PDF %EOF\\x0d REVERSE
# pdf y 5000000 %PDF %EOF\\x0a REVERSE
# mail y 500000 \\x41\\x4f\\x4c\\x56\\x4d
# rpm y 1000000 \\xed\\xab
# dat y 4000000 regf
# dat y 4000000 CREG
# zip y 10000000 PK\\x03\\x04 \\x3c\\xac
# rar y 10000000 Rar!
# java y 1000000 \\xca\\xfe\\xba\\xbe
# max y 1000000 \\x56\\x69\\x47\\x46\\x6b\\x1a\\x00\\x00\\x00\\x00 \\x00\\x00\\x05\\x80\\x00\\x00
# pins y 8000 \\x50\\x49\\x4e\\x53\\x20\\x34\\x2e\\x32\\x30\\x0d
# vbox y 10000000000 <<<????????????????????????????????????????????????????????????\\x00\\x7f\\x10\\xda\\xbe
# tgz y 2000000 \\x1f\\x8b\\x08\\x08
# 7z y 2147483648 \\x37\\x7a\\xbc\\xaf\\x27\\x1c
# ogg y 15728640 x4fx67x67x53x00x02 x4fx67x67x53x00x02 NEXT
# lnk y 4000 \\x4c\\x00\\x00\\x00\\x01\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x46
# shd y 2000 \\x67\\x49\\x00\\x00
# shd y 2000 \\x4B\\x49\\x00\\x00
# blend y 1000000000 BLENDER_v ENDB
# mus y 1000000000 ENIGMA\\x20BINARY\\x20FILE \\x13\\x00\\x06\\x00\\x00\\x00
# dat y 8192 DynamicDictionary
# amr y 65535 #!AMR
# plist y 4096 <plist </plist
# email y 4096 From:"""




class MyApp(wx.App):
    #outputWindowClass = LogWindow
    def __init__(self, redirect=True):
        wx.App.__init__(self, redirect)


class main(wx.Frame):
    def __init__(self, parent, id, title, size):
        wx.Frame.__init__(self, parent, id, title, size = size)
        self._main()

    def CreateElement(self):
        # initial UI
        panel = wx.Panel(self, -1, style=wx.RAISED_BORDER)

        # Get physical disk driver
        c = [x.Name for x in wmi.WMI().query("SELECT * FROM Win32_DiskDrive")]
        self.phyDrivers = wx.Choice(panel, -1, choices =c)
        self.phyDrivers.SetSelection(0)

        # Create selecti image button
        self.file = wx.Button(panel, -1, u"選擇檔案")
        # Create Start scalpel button
        self.start = wx.Button(panel, -1, u"OK")

        # choice options
        global ext
        c = []
        for i in ext.split("# ")[1:]:
            __ = i.split(" ", 1)[0]
            if __ not in c:
                c.append( __ )

        self.checkList = wx.CheckListBox(panel, -1, size=wx.DefaultSize, choices=c)
        self.checkList.SetChecked(range(len(c)))

        # Create label
        self.label = wx.StaticText(panel, -1, self.phyDrivers.GetStringSelection())
        self.label.SetBackgroundColour('yellow')

        # Setting UI
        box = wx.BoxSizer(wx.VERTICAL)
        box.Add(self.phyDrivers, 0, wx.ALL|wx.EXPAND, 5)
        box.Add(self.file, 0, wx.ALL|wx.EXPAND, 5)
        box.Add(self.label, 0, wx.ALL|wx.EXPAND, 5)
        box.Add(wx.StaticLine(panel, -1), 0, wx.ALL, 5)
        box.Add(self.start, 0, wx.ALL|wx.EXPAND, 5)
        box.Add(self.checkList, 2, wx.ALL|wx.EXPAND, 5)
       
        # Binding event
        self.phyDrivers.Bind(wx.EVT_CHOICE, self.OnChoice)
        self.start.Bind(wx.EVT_BUTTON, self.OnStart)
        self.file.Bind(wx.EVT_BUTTON, self.OnSelectFile)

        panel.SetSizer(box)

    def OnChoice(self, evt):
        self.label.SetLabel( evt.GetString() )

    def OnSelectFile(self, evt):
        dlg = wx.FileDialog(
            self, message="Choose a image file",
            defaultDir=os.getcwd(),
            defaultFile="",
            #wildcard=wildcard,
            style=wx.OPEN | wx.MULTIPLE | wx.CHANGE_DIR
            )

        if dlg.ShowModal() == wx.ID_OK:
            paths = dlg.GetPaths()
            path = paths[0]
        else:
            path = None
        dlg.Destroy()

        if path:
            self.label.SetLabel( path )

    def OnStart(self, evt):
        # generate scalpel.conf
        global ext
        buf = []
        __ = ext.split("# ")
        for i in self.checkList.GetCheckedStrings():
            [buf.append(x) for x in ext.split("# ") if x.startswith(str(i))]

        with open("./scalpel.conf", "wb") as fp:
            fp.write( "".join(buf) )

        dlg = wx.DirDialog(self, "Choose output directory:",
                          style=wx.DD_DEFAULT_STYLE
                           #| wx.DD_DIR_MUST_EXIST
                           #| wx.DD_CHANGE_DIR
                           )

        if dlg.ShowModal() == wx.ID_OK:
            directory = dlg.GetPath()
        else:
            directory = None
        dlg.Destroy()

        if directory:
            img = self.label.GetLabelText()
            subprocess.call( "bin\\scalpel.exe -v -o %s %s" % (directory, img) )
            subprocess.call("rundll32.exe user32,MessageBoxA aaa")

    def _main(self):
        # Create Buttons & Texts
        self.CreateElement()

        self.Centre()
        self.Show()

if __name__ == "__main__":
    app = MyApp(redirect=True)

    frame = main(None, -1, "Scalpel", (300, 400))
    app.MainLoop()    
Was this page helpful?
標籤 (Edit tags)
  • No tags

文件 2

文件大小日期附件上傳者 
 sc.jpg
無描述
28.05 KB20:16, 1 Jun 2012thx動作
 Scalpel GUI.zip
無描述
6 MB20:13, 1 Jun 2012thx動作
查看第1個(總1個)評論: 查看所有
支持熊 qq544708832
發佈時間 14:36, 1 Jun 2012 ()
查看第1個(總1個)評論: 查看所有
您必須 登入 才能發佈評論。
Powered by MindTouch Core