extract_all_i30.sh

#!/bin/bash
# Extracts all INDX attributes from an NTFS image using Sleuthkit utilities
# Willi Ballenthin <[email protected]>
# 2013-01-09

usage() 
{
    cat <<EOF
 Usage: $0   /path/to/image/  /path/to/output/directory/
EOF

sbz

def hexdump(src, length=16):
    FILTER = ''.join([(len(repr(chr(x))) == 3) and chr(x) or '.' for x in range(256)])
    lines = []
    for c in xrange(0, len(src), length):
        chars = src[c:c+length]
        hex = ' '.join(["%02x" % ord(x) for x in chars])
        printable = ''.join(["%s" % ((ord(x) <= 127 and FILTER[ord(x)]) or '.') for x in chars])
        lines.append("%04x  %-*s  %s\n" % (c, length*3, hex, printable))
    return ''.join(lines)