EWF Format not work due to filename renaming after upload

[gregorygui]

Hi,

I'm really interested in OpenRelik project and associated workflow. So first, thank for your amazing work.

I'm usually working with EWF image disk format (E01) chunked in different files (usually 8/16Gb). The naming convention is .E0X where X is incremented by each chunk (starting with 1, so E01, E01, etc).

I tried to upload a ZIP archive containing a small disk image (5 chunks), then run the un-archive worker then run evtx files extraction.

However, file are renamed after upload with an unique ID. I understand the requirement. However it breaks usage of the EWF format.

Is there a way to modify the unique ID process for the filename on disk ?

[berggren]

Hi, good catch! I'll take a look at this as soon as time permits and find a solution.

[berggren]

Looked into this a bit. We do not support segmented EWF disk images at the moment du to the requirement of filename being the same in order to process the image correctly. We will add support for this but it needs a bit of thinking beforehand as there are a few edge cases to cater for.

One quick partial fix would be to add support for segmented EWF files for the plaso and extractor workers. If the input files is a list of .E0* files then hard link them with the same filename. This would mean that in order to process segmented EWF images you need to provide all (and only) the E0* files.

[berggren]

Support for segmented EWF files in plaso worker:
openrelik/openrelik-worker-plaso#18