Hi!
Mobius Forensic Toolkit v2.0 has been released.
New module mobius::vfs, implemented in C++, replaces the old item.datasource structure. This development is an important milestone for Mobius Forensic Toolkit because:
- mobius::vfs implements a very powerful data block detection and decoding framework.
- mobius::vfs is highly modular. You can easily implement new data block detection modules as C++ extensions.
- mobius::vfs data block detection algorithm is fully recursive and support palimpsest structures, such as ISOHybrid disks, detecting multiple block types for each data block found.
- mobius::vfs handles multiblock structures, and as such, is fit for future detection and decoding of RAID, LVM, and Fusion disks, for example.
- mobius::vfs features a full Python C API, under mobius.vfs Python module.
- mobius::vfs shows all data blocks detected and has option to export individual blocks, for use with other tools.