@@ -0,0 +1,1630 @@
+#This sample program goes with the blog post found here:%0A#http://www.hecfblog.com/2016/04/daily-blog-367-automating-dfir-with.html%0A#%0Aimport sys%0Aimport logging%0A%0Afrom dfvfs.analyzer import analyzer%0Afrom dfvfs.lib import definitions%0Afrom dfvfs.path import factory as path_spec_factory%0Afrom dfvfs.volume import tsk_volume_system%0A%0Asource_path=%22Stage2.vhd%22%0A%0Apath_spec = path_spec_factory.Factory.NewPathSpec(%0A          definitions.TYPE_INDICATOR_OS, location=source_path)%0A%0Atype_indicators = analyzer.Analyzer.GetStorageMediaImageTypeIndicators(%0A          path_spec)%0A%0Asource_path_spec = path_spec_factory.Factory.NewPathSpec(%0A            type_indicators%5B0%5D, parent=path_spec)%0A%0Avolume_system_path_spec = path_spec_factory.Factory.NewPathSpec(%0A        definitions.TYPE_INDICATOR_TSK_PARTITION, location=u'/',%0A        parent=source_path_spec)%0A%0Avolume_system = tsk_volume_system.TSKVolumeSystem()%0Avolume_system.Open(volume_system_path_spec)%0A%0Avolume_identifiers = %5B%5D%0Afor volume in volume_system.volumes:%0A  volume_identifier = getattr(volume, 'identifier', None)%0A  if volume_identifier:%0A    volume_identifiers.append(volume_identifier)%0A %0Aprint(u'The following partitions were found:')%0Aprint(u'Identifier%5CtOffset%5Ct%5Ct%5CtSize')%0A%0Afor volume_identifier in sorted(volume_identifiers):%0A  volume = volume_system.GetVolumeByIdentifier(volume_identifier)%0A  if not volume:%0A    raise RuntimeError(%0A        u'Volume missing for identifier: %7B0:s%7D.'.format(volume_identifier))%0A%0A  volume_extent = volume.extents%5B0%5D%0A  print(%0A      u'%7B0:s%7D%5Ct%5Ct%7B1:d%7D (0x%7B1:08x%7D)%5Ct%7B2:d%7D'.format(%0A          volume.identifier, volume_extent.offset, volume_extent.size))%0A%0Aprint(u'')%0A%0A

Create dfvfsWizardv1.py