Package: slack-handler
Slack_handlerSlack_handler is a python tool for extracting File slacks in raw format and writing their details to a CSV file.The File slacks considered are both RAM and DISK file slacks which represent the data between the none multiple size of the file and the allocated size in clusters. No volume slack is considered.A presentation is available onYoutube(~17min).A description article isavailableon IEEE Xplore.FeaturesImplemented so far:extract all file slacks from raw or ewf disk image to a directory.display file slacks in LATIN-1 or Hex encoding to the console/terminal.pretty print all found file slack data in the provided disk image.Write-out File slacks details to a CSV file including: the original file, the file slack size, the parent directories, MD5 and SHA1 hashes, etc.Support for 'RAW' disk images.Support for 'EWF' disk images.Add CI using Github action.Add a helper function for MD5_calc and SHA1_calc in 'utils' module for factoring the code.Add EWF disk image to test_data.add more tests 'test__file_slack_nbr' and computed MD5 hashs.fix shenanigans of compressed files.add more tests 'test__file_slack_content' (inspection at binary level).add a test case for no_file_slack file.Add relative/absolute location details to CSV report file.cache and optimize Github actions.Add support for disk images in AFF formats.Optimize the way it locates the File slack space.Simulate user behaviors in test disk images using a Bash script.Generate more disk images for validation.add XML description file of each disk image using fiwalk or fls.package everything.Installation on a Debian/GNU Linux for developersCreate a Virtual environmentDownload thelatest releaseClone pytskrepositoryupdate the repo (get libtsk)python setup.py updatebuild (libtsk)python setup.py buildinstall (which will install pytsk bindings)python setup.py ìnstallpip listnow you should see pytsk installed if everything is ok!clone pyewfrepository./synclibs.sh: Script that synchronizes the local library dependencies./autogen.sh./configure --enable-pythonpython setup.py buildpython setup.py installFor further details, please check the steps of the jobBuildused in Github actions process.Installation from Pypi (In progress ... )The tool is hosted onPypipip3 install slack-handlerslack_handler --versionUsageTo dump all File slacks to 'slacks/' folder and extract all the information to CSV format file named 'report.csv' from a raw image 'USB-NTFS.dd' :slack_handler --type raw --dump slacks/ --csv report.csv images/USB-NTFS.ddHelp:usage: slack_handler [-h] [-e ENCODING] -t TYPE [-p] [-d DUMP] [-c CSV] [-v] [--version] disk image

Extract the file slack spaces.

positional arguments:
  disk image

optional arguments:
  -h, --help            show this help message and exit
  -e ENCODING, --encoding ENCODING
                        Display slack space in LATIN-1 or Hex. Supported options 'latin-1', 'hex'.
  -t TYPE, --type TYPE  Type of the disk image. Currently supported options 'raw' and 'ewf'.
  -p, --pprint          Pretty print all found file slack spaces.
  -d DUMP, --dump DUMP  Dump file slack spaces of each file in raw format to a directory if specified, by default temporary dir.
  -c CSV, --csv CSV     Write file slacks information to a CSV file.
  -v, --verbose         Control the verbosity of the output.
  --version             show program's version number and exitLICENSEFeel free to read the fileLICENSE.HistoryOriginal version Date: 13/06/2012 by Sokratis Vidrossokratis.vidros@gmail.comCurrent updated version: 0.1 since 25/10/2020 by ALJI Mohamedsim4n6@gmail.comSpecial Thanks fly toJoachim Metzfor providing an initial feedback on the little tool related to the different types of disk slack space and the licensing.David Cowenfor the awesome serie of "How-to on programming using libtsk and python".Any feedback is a welcome via Githubissuesor reach out viaThe Open Source DFIR Slack communityusing the registrationlink.