DiskAnalyzer

Description

This package implements multiples libraries and tools to parse, analyze and extract informations from disk on the live system.

• Pure python package
• Running on live Windows system
• Analyze MBR (Master Boot Record) and GPT (GUID Partition Table)
• List partitions
• Analyze VBR (Volume Boot Record) for NTFS partition (New Technology File System)
• Analyze MFT file and attribute (Master File Table)
• Extract MFT file

Requirements

This package require:

• python3
• python3 Standard Library

Installation

Pip

python3 -m pip install DiskAnalyzer

Git

git clone "https://github.com/mauricelambert/DiskAnalyzer.git"
cd "DiskAnalyzer"
python3 -m pip install .

Wget

wget https://github.com/mauricelambert/DiskAnalyzer/archive/refs/heads/main.zip
unzip main.zip
cd DiskAnalyzer-main
python3 -m pip install .

cURL

curl -O https://github.com/mauricelambert/DiskAnalyzer/archive/refs/heads/main.zip
unzip main.zip
cd DiskAnalyzer-main
python3 -m pip install .

Usages

Command line

DiskAnalyzer              # Using CLI package executable
python3 -m DiskAnalyzer   # Using python module
python3 DiskAnalyzer.pyz  # Using python executable
DiskAnalyzer.exe          # Using python Windows executable

NtfsAnalyzer              # Using CLI package executable
python3 -m NtfsAnalyzer   # Using python module
python3 NtfsAnalyzer.pyz  # Using python executable
NtfsAnalyzer.exe          # Using python Windows executable

MftAnalyzer               # Using CLI package executable
python3 -m MftAnalyzer    # Using python module
python3 MftAnalyzer.pyz   # Using python executable
MftAnalyzer.exe           # Using python Windows executable

Python script

from DiskAnalyzer import *

print(disk_parsing().to_partition())

file, vbr, ntfs_offset = ntfs_parse()
file.close()

with open("$MFT", "rb") as file:
    for data in get_mft_content():
        file.write(data)

Links

• Pypi
• Github
• DiskAnalyzer - Documentation
• DiskAnalyzer - Python executable
• DiskAnalyzer - Python Windows executable
• NtfsAnalyzer - Documentation
• NtfsAnalyzer - Python executable
• NtfsAnalyzer - Python Windows executable
• MftAnalyzer - Documentation
• MftAnalyzer - Python executable
• MftAnalyzer - Python Windows executable

License

Licensed under the GPL, version 3.