bmerinofe/metasploit-framework — pull request #1 by jvazquez-r7 (2013-04-30 18:23:27+00:00)
Title: Clean recovery_files

Added final cleanup for the module before merging. Mainly:

* Made the module not so verbose by default:

No verbose:

```
msf post(recovery_files) > set verbose false
verbose => false
msf post(recovery_files) > set files ""
files =>
msf post(recovery_files) > run

[*] System Info - OS: Windows XP (Build 2600, Service Pack 3)., Drive: E:
[*] $MFT is made up of 1 dataruns
[*] Searching deleted files in data run 1 ...
[*] Name: EULA10~1.TXT	ID: 35325952
[*] Name: EULA10~2.TXT	ID: 35326976
[*] Name: EULA10~3.TXT	ID: 35328000
[*] Name: EULA10~4.TXT	ID: 35329024
[*] Name: EU92E6~1.TXT	ID: 35330048
[*] Name: EU96C0~1.TXT	ID: 35331072
[+] MFT entries finished
[*] Post module execution completed
msf post(recovery_files) > set files 35325952
files => 35325952
msf post(recovery_files) > run

[*] System Info - OS: Windows XP (Build 2600, Service Pack 3)., Drive: E:
[*] File to download: EULA10~1.TXT
[*] The file is not resident. Saving EULA10~1.TXT ... (10134 bytes)
[+] File saved on /Users/juan/.msf4/loot/20130430132044_default_192.168.172.175_nonresident.file_586806.txt
[*] Post module execution completed

```

Verbose:

```
msf post(recovery_files) > set verbose true
verbose => true
msf post(recovery_files) > set files ""
files =>
msf post(recovery_files) > run

[*] System Info - OS: Windows XP (Build 2600, Service Pack 3)., Drive: E:
[*] Logical cluster : 0000000000010d4a
[*] NTFS Volumen Serial Number: b65424b654247b6f
[*] Bytes per Sector: 512
[*] Bytes per Cluster: 512
[*] Length of the MFT (bytes): 49152
[*] Logical cluster where MTF starts 68938
[*] $MFT is made up of 1 dataruns
[*] MFT data run 1 is at byte 35296256. It has a total of 96 clusters
[*] Searching deleted files in data run 1 ...
[*] Name: EULA10~1.TXT	ID: 35325952
[*] Name: EULA10~2.TXT	ID: 35326976
[*] Name: EULA10~3.TXT	ID: 35328000
[*] Name: EULA10~4.TXT	ID: 35329024
[*] Name: EU92E6~1.TXT	ID: 35330048
[*] Name: EU96C0~1.TXT	ID: 35331072
[+] MFT entries finished
[*] Post module execution completed
msf post(recovery_files) > set files 35325952
files => 35325952
msf post(recovery_files) > run

[*] System Info - OS: Windows XP (Build 2600, Service Pack 3)., Drive: E:
[*] File to download: EULA10~1.TXT
[*] Getting Data Runs ...
[*] The file is not resident. Saving EULA10~1.TXT ... (10134 bytes)
[*] Number of chunks: 2	Rest: 4 clusters	Chunk size: 8 clusters
[*] Save 1 chunk of 4096 bytes, there are 6038 left
[*] Save 1 chunk of 4096 bytes, there are 1942 left
[*] (Last datarun) Save 1 chunk of 1942
[+] File saved on /Users/juan/.msf4/loot/20130430132119_default_192.168.172.175_nonresident.file_888332.txt
[*] Post module execution completed

```

* When restoring a non resident file avoid to write to file system for every chunk. In this way you also avoid to use store_loot until recovery has finished. Please check which it doesn't affect expected recovery. I've tested with some TXT files and works fine after changes.

* Cosmetic changes

Please feel free to review, test, discuss anything and merge into you repo once you agree. In this way the original pull request https://github.com/rapid7/metasploit-framework/pull/1687 will be automatically updated and ready to merge if anyone stops me :)