A python script that reconstruct filesystem structures and recover files on NTFS filesystems


RecuperaBit is a python script developed by Andrea Lazzarotto useful for attempting to reconstruct a corrupted NTFS filesystem.

RecuperaBit attempts reconstruction of the directory structure regardless of:

  • missing partition table
  • unknown partition boundaries
  • partially-overwritten metadata
  • quick format

The project and the reconstruction algorithms, are part of Andrea’s MSc thesis:

[embed]https://www.scribd.com/doc/309337813/RecuperaBit-Forensic-File-System-Reconstruction-Given-Partially-Corrupted-Metadata[/embed]

And below a brief presentation on Slideshare:

[embed]https://www.slideshare.net/TheLazza/recuperabit-forensic-file-system-reconstruction-given-partially-corrupted-metadata[/embed]

Usage

usage: main.py [-h] [-s SAVEFILE] [-w] [-o OUTPUTDIR] path

Reconstruct the directory structure of possibly damaged filesystems.

positional arguments:
  path                  path to the disk image

optional arguments:
  -h, --help            show this help message and exit
  -s SAVEFILE, --savefile SAVEFILE
                        path of the scan save file
  -w, --overwrite       force overwrite of the save file
  -o OUTPUTDIR, --outputdir OUTPUTDIR
                        directory for restored contents and output files

RecuperaBit does not modify the disk image, however it does read some parts of it multiple times through the execution. It should also work on real devices, such as /dev/sda but this is not advised.

More info and downloads

[embed]https://github.com/Lazza/RecuperaBit[/embed]