dc3-plaso
dc3-plaso
> This would add yet another abstraction layer and seeing the state of TSK abstraction I rater not. Also L01 is more like an archive file than a disk image....
I'm looking at the pylzma library, using their py7zlib module. This would open and decompress the files for us, however it will not allow for us to perform any type...
Agreed, I have currently implemented the 7z support using pylzma. It uses temporary files to read the files within the archive, but it should be trivial to change this to...
I will be able to get back to writing this next week.
Sounds good. I'm looking forward to it. In the meantime, I've been able to patch this feature into my own copy of plaso by simply adding the equivalent of the...