Library and tools to access the New Technology File System (NTFS).

Note that this project currently only focuses on the analysis of the format.

Library to provide generic file value functions for the libyal family of libraries.

Library to provide Windows NT data type support for the libyal family of libraries.
libyal is typically used in digital forensic tools.

Library to access the Windows Shell Item format for the libyal family of libraries.
libyal is typically used in digital forensic tools.

A library to support various Hash-based Message Authentication Codes
(HMAC).

Library to access the Windows Shortcut File (LNK) Format files.

Library and tooling to access the QEMU Copy-On-Write (QCOW) image format.

Library to access Windows Registry Files. Typically used by computer forensics applications.

libsmdev is a library to access and read storage media devices.

libsmraw is a library to access the storage media RAW format.
The library supports both RAW and split RAW.

libuna is a library to support Unicode and ASCII (byte string) conversions. It currently supports: 7-bit ASCII, ISO 8859-{1..15}, Windows 874, 932, 936, 949, 950, 1250, 1251, 1252, 1253, 1254, 1255, 1256, 1257, 1258, KOI8-R, KOI8-U, UTF-7, UTF-8, UTF-16, UTF-32.

Library and tools to access the Virtual Hard Disk (VHD) image format.

Read supported formats:

VHD version 1
- Supported image types:

Fixed-size hard disk image
- Dynamic-size (or sparse) hard disk image
- Differential (or differencing) hard disk image
- Note that an undo disk image (.vud) is also a differential image

Library and tools to access the VMware Virtual Disk (VMDK) image format.

Read supported extent file formats:
- RAW (flat)
- COWD version 1 (sparse)
- VMDK version 1, 2 and 3 (sparse)

Supported VMDK format features:
- delta links
- grain compression (as of version 20131209)
- data markers (as of version 20140416)

VMDK format features not supported at the moment:
- images that use a physical device
- changed block tracking (CBT) (supported by VMDK version 3 (sparse)) / change tracking filek

Library and tools to access the Volume Shadow Snapshot (VSS) format. The VSS format is used by Windows, as of Vista, to maintain copies of data on a storage media volume.

The package includes 2 support docs:

OSDFC 2012: Paper - Windowless Shadow Snapshots
OSDFC 2012: Slides - Windowless Shadow Snapshots

Project for firewall-related sources, sources from the Netfilter group, and for iproute.

NOTE: Automatically created during Factory devel project migration by admin.

The conntrack-tools are a set of tools targeted at system administrators. They are conntrack, the userspace command line interface, and conntrackd, the userspace daemon. The tool conntrack provides a full featured interface that is intended to replace the old /proc/net/ip_conntrack interface. Using conntrack, you can view and manage the in-kernel connection tracking state table from userspace. On the other hand, conntrackd covers the specific aspects of stateful firewalls to enable highly available scenarios, and can be used as statistics collector as well.