zffacquire

Crates.iozffacquire
lib.rszffacquire
version2.0.0-beta.0
sourcesrc
created_at2021-10-17 21:59:21.026956
updated_at2023-12-28 15:36:17.117177
descriptionA command line utility for acquiring data into the forensic format Zff.
homepagehttps://zff.dev
repositoryhttps://github.com/zff-team/zffacquire
max_upload_size
id466436
size106,765
(ph0llux)

documentation

README

zffacquire

zffacquire is a command line utility for acquiring images and/or logical file/folder structures into the forensic format Zff.

Installation

Prerequisites

First, you need to install rust and cargo to build or install zffacquire.

After that you still need the gcc, which you can install as follows (depends on the distribution):

Debian/Ubuntu
$ sudo apt-get install gcc
Fedora
$ sudo dnf install gcc

Then you can easily build this tool yourself by using cargo:

[/home/ph0llux/projects/zffacquire] $ cargo build --release

Or you can install the tool directly from crates.io:

$ cargo install zffacquire

Usage

To create an image with the default parameters, the following command is just enough:

zffacquire physical -i /dev/sda -o /media/usb-hdd/my_zff_container

You can also dump a logical folder structure into a logical zff container:

zffacquire logical -i /home/ph0llux/pictures -o /media/usb-hdd/my_zff_container

And you can extend an zff container by adding additional containers:

zffacquire physical -i /dev/sda -o /media/usb-hdd/my_zff_container
zffacquire extend logical -i /home/ph0llux/pictures -a /media/usb-hdd/my_zff_container.z01
zffacquire extend physical -i /dev/sdb -a /media/usb-hdd/my_zff_container.z01

The complete feature set of zffacquire can be shown using zffacquire -h.

Commit count: 84

cargo fmt