3 releases (1 stable)

1.0.0 Jul 24, 2022
1.0.0-rc.1 Jul 17, 2022
1.0.0-beta.4 May 14, 2022
1.0.0-beta.1 Apr 20, 2022
0.1.0 Feb 18, 2022

#32 in #forensics

MIT/Apache

85KB
1.5K SLoC

zffanalyze

zffanalyze is a command line utility to analyze zff images.

Installation

Prerequisites

First, you need to install rust and cargo to build or install zffanalyze.

After that you still need the gcc, which you can install as follows (depends on the distribution):

Debian/Ubuntu
$ sudo apt-get install gcc
Fedora
$ sudo dnf install gcc

Then you can easily build this tool yourself by using cargo:

[/home/ph0llux/projects/zffanalyze] $ cargo build --release

Or you can install the tool directly from crates.io:

$ cargo install zffanalyze

Usage

To show the metadata of the given zff file, execute:

zffanalyze -i <YOUR_ZFF_IMAGE.z01>

If you want to perform an integrity check, you can simply execute:

zffanalyze -i <YOUR_ZFF_IMAGE.z01> -c

If you want to determine the authenticity of the data with an existing public key, then execute:

zffanalyze -i <YOUR_ZFF_IMAGE.z01> -k "c9IvuVj4lnGVSXR5Azx8SAyqQBpeHMKpB/4v8/Cj4Ew="

Dependencies

~16MB
~285K SLoC