Wombat Tools
A set of 10 command line tools for working with the wombat forensic and logical image format. These custom images will be integrated into wombatforensics which will be able to read and parse the images as well as create and verify them.
The wombat forensic image (wfi) will be a walafus read only zstd compressed file system. The wfi image file contains the raw forensic image as well as the log file from the creation of the image and the info file which contains the forensic propertis such as case number, examiner, evidence number, description, and blake3 hashes for the source device. If verification was enabled, the forensic image hash and the verification status will be included.
The wombat logical image (wli), will be a walafus read only zstd compressed file system. The wli image file contains the logical file contents with the relevant metadata stored in an info file in csv format as well as a log file fro mthe creation of the image. Optional verification is available.
Version 0.2 Tools
- wombatexport - export files and their properties from a wombat logical image.
- wombatimager - create a walafus read only zstd compressed forensic image given a source device and an image format name.
- wombatinfo - displays the forensic or logical image metadata information.
- wombatlist - displays the files and their sizes within the wombat forensic or logical image.
- wombatlog - displays the log from the creation of the forensic or logical image.
- wombatlogical - create a walafus read only zstd compressed logical forensic image containing the exported files and their respective properties.
- wombatmount - FUSE mount a forensic or logical image and access the files.
- wombatreader - reads the raw forensic image and sends to stdout for use with other tools such as b3sum, xxd, etc.
- wombatrestore - restores the raw forensic image to a physical device and can optionally verify the device when done.
- wombaverify - verifies the raw forensic image within the wombat forensic image or the logical image to ensure nothing has changed.