Skip to content

B
binwalk
Commit 8c2f3699 by devttys0
Options

Added sleuthkit extraction rule for ext file systems

parent c6600660
Showing with 3 additions and 0 deletions
src/binwalk/config/extract.conf
...@@ -48,6 +48,9 @@ ...@@ -48,6 +48,9 @@
^cramfs filesystem:cramfs:cramfsck -x '%%cramfs-root%%' '%e':0:False ^cramfs filesystem:cramfs:cramfsck -x '%%cramfs-root%%' '%e':0:False
^cramfs filesystem:cramfs:cramfsswap '%e' '%e.swap' && cramfsck -x '%%cramfs-root%%' '%e.swap':0:False ^cramfs filesystem:cramfs:cramfsswap '%e' '%e.swap' && cramfsck -x '%%cramfs-root%%' '%e.swap':0:False
# Extract EXT filesystems using sleuth kit
^linux ext:ext:tsk_recover -i raw -f ext -a -v '%e' '%%ext-root%%':0:False
# Try mounting the file system (this requires root privileges) # Try mounting the file system (this requires root privileges)
^squashfs filesystem:squashfs:mkdir squashfs-root && mount -t squashfs '%e' squashfs-root:0:False ^squashfs filesystem:squashfs:mkdir squashfs-root && mount -t squashfs '%e' squashfs-root:0:False
^cramfs filesystem:cramfs:mkdir cramfs-root && mount -t cramfs '%e' cramfs-root:0:False ^cramfs filesystem:cramfs:mkdir cramfs-root && mount -t cramfs '%e' cramfs-root:0:False
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment