Add support for EWF-L01 files about dfvfs HOT 3 OPEN

FYI this is also on the roadmap: https://github.com/log2timeline/dfvfs/wiki/Roadmap, so this is definitely a feature we want to put in. However currently the main priority is improving NTFS support seeing there are more interesting artifacts to be obtained and L01 can be also be read after mouting with "ewfmount -f files".

I suggest either adding support for L01s in pytsk3 or developing EWF file entry and file system objects to manage these directly.

This would add yet another abstraction layer and seeing the state of TSK abstraction I rater not. Also L01 is more like an archive file than a disk image.

from dfvfs.

This would add yet another abstraction layer and seeing the state of TSK abstraction I rater not. Also L01 is more like an archive file than a disk image.

This is why I suggested developing an EWF file entry and file system separate from using TSK. It would remove a layer of abstraction. The pyewf library contains enough methods to traverse through the internal directories to implement our own dfvfs file system type that does not rely on TSK.

L01 can be also be read after mouting with "ewfmount -f files".

Thank you for pointing me to this tool. This solution will work until there is official support.

from dfvfs.

This is why I suggested developing an EWF file entry and file system separate from using TSK. It would remove a layer of abstraction. The pyewf library contains enough methods to traverse through the internal directories to implement our own dfvfs file system type that does not rely on TSK.

Agree, I'll try to bump the priority on this but libewf needs some love as well but currently other features have a higher priority e.g. improving NTFS support which has uncovered some limitations in pytsk/TSK that need to solved or worked-around.

from dfvfs.