@@ -0,0 +1,2315 @@
+#!/usr/bin/python%0A#%0A# Simple script that looks for INDX records at 4096 (decimal) byte boundaries on a raw disk. %0A# It saves the INDX records to a binary output file that can be parsed with INDXparse.py. %0A#%09Tested against Windows Server 2003%0A#%0A#   Copyright 2015, Jacob Garner %3Cjacob.garner@mandiant.com%3E %0A#                    while at Mandiant %3Chttp://www.mandiant.com%3E%0A#%0A#   Licensed under the Apache License, Version 2.0 (the %22License%22);%0A#   you may not use this file except in compliance with the License.%0A#   You may obtain a copy of the License at%0A#%0A#       http://www.apache.org/licenses/LICENSE-2.0%0A#%0A#   Unless required by applicable law or agreed to in writing, software%0A#   distributed under the License is distributed on an %22AS IS%22 BASIS,%0A#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.%0A#   See the License for the specific language governing permissions and%0A#   limitations under the License.%0A%0Aimport sys%0Aif sys.argv%5B1%5D == %22-h%22:%0A%09print %22%5Ctpython ./INDXfind.py %3Cewfmount'd drive%3E%22%0A%09print %22%5Ctex:%5Ctpython ./INDXfind.py /mnt/ewf/ewf1%22%0A%09sys.exit()%0A%0Af = open(sys.argv%5B1%5D, 'rb')%09%09%09# ewfmount'd drive expected as first argument on command line%0AindxBytes = %22494e445828000900%22  %09%09# 49 4e 44 58 28 00 09 00  %22INDX( header%22%0Aoffset = 0 %09%09%09%09%09# data processed%0AbyteChunk=%22go%22 %09%09%09%09%09# cheap do-while%0ArecordsFound = 0 %09%09%09%09# for progress%0AoutFile = open(%22INDX_records.raw%22, 'wb')%09# output file%0A%0Aprint%09%22%5Cn%5CtRunning... progress will output every GigaByte. In testing this was every 15-20 seconds.%5Cn%22 %5C%0A%09%22%5CtThe output file is named %5C%22INDX_records.raw%5C%22.%5Cn%22 %5C%0A%09%22%5CtINDX_records.raw should be parsed with INDXparser.py which can be found at:%5Cthttps://github.com/williballenthin/INDXParse%5Cn%22 %0A%0Awhile byteChunk != %22%22:%0A%09byteChunk = f.read(4096)%09# Only searching for cluster aligned (4096 on Windows Server 2003) INDX records... records all appear to be 4096 bytes%0A%09compare = byteChunk%5B0:8%5D%09# Compare INDX header to first 8 bytes of the byteChunk%0A%09if compare.encode(%22hex%22) == indxBytes:%0A%09%09recordsFound = recordsFound + 1%0A%09%09outFile.write(byteChunk) # Write the byteChunk to the output file%0A%0A%09offset = offset + 4096%09%09# Update offset for progress tracking%0A%0A%09# Progress%0A%09if offset %25 1073741824 == 0:%0A%09%09print %22Processed: %25d GB. INDX records found: %25d%22 %25 ((offset / 1073741824), recordsFound)%0A%0AoutFile.close()%0A

add indxfind by @jacobgarner