Module
Contents |
Using a module
Within DFF, modules are used to perform a specific kind of tasks. They can be graphical, such as text or pictures viewers, or used to analyzed a given type of data, such as the parsing of a file system or carving. All the module can take several input parameters, as for example :
- The path to a file, node or directory.
- The type of file to analyze.
- Options specific to the module or to the type of the analyzed data.
- Etc.
We will in this page present how to start a module, and how to input it parameters. We will take as an example the fat module, used to parse fat file systems.
The first thing to do is to load a fat dump into DFF. This part explains how to do so. Once this is done, you will have to right click on the node on which you want to use FAT, and go into the Open with -> File systems -> Fat sub-menu.
The different modules are grouped by categories. A dialog box with the appearance of the following screen shot will be opened.
Several information are available on this window, in the information part :
- A brief description of the module.
- Its name (fatfs in the example).
- Its type (File systems in the example).
In the Arguments part is, on the left, the list of arguments which can be input to the module. In this case, only two of them are available :
- file : the node on which we want to apply fat.
- meta_carve : a FAT specific option.
On the right part of the Arguments area are a description of the parameter, and an area used to give it a value (in the case of the file parameter there is line edit with the path to the node and a Browse button). This last area is different from one parameter's type to an other.
Select the parameter you want to configure, and the appearance of the dialog box will change depending on its type. For example, the file parameter type is Node : there is the line edit and a 
... button, allowing to change the path.
If we select meta_carve, the dialog box will change :
This parameter is not activated by default, meaning that it is optional. It can only has two states, Activated or no activated if the check box is left empty.
Some modules can have more than two parameters, with different types, but their configuration is quite simple and it works just as we described on this page.
List of available modules
In this part is the list of modules, classified by category.
Connectors
Volumes
Statistics
File systems
The file systems modules are used to rebuild entire file systems and recover deleted data.
Viewers
Viewers category contains module able to display different kind of data under different form.
