version v0.23.0

README.md

@@ -9,7 +9,6 @@ Forensic Artifacts Collecting Toolkit.
 - [fmount](docs/fmount.md)
 - [fmount.dd](docs/fmount.dd.md)
 - [fmount.vmdk](docs/fmount.vmdk.md)
-- [fkey](docs/fkey.md)
 - [ffind](docs/ffind.md)
 - [flog](docs/flog.md)
 - [flog.evtx](docs/flog.evtx.md)

cmd/fmount.dd/main.go

@@ -2,7 +2,7 @@
 //
 // Usage:
 //
-//	fmount.dd [-fsuzqhv] [-H CRC32|MD5|SHA1|SHA256] [-V SUM] [-B KEY] [-D DIR] IMAGE
+//	fmount.dd [-fruszqhv] [-H CRC32|MD5|SHA1|SHA256] [-V SUM] [-B KEY] [-D DIR] IMAGE
 //
 // The flags are:
 //
@@ -16,10 +16,12 @@
 //	 	The hash sum to verify.
 //	 -f
 //		Force type (bypass check).
-//	 -s
-//		System partition only.
+//	 -r
+//		Search recovery key ids.
 //	 -u
 //		Unmount image.
+//	 -s
+//		System partition only.
 //	 -z
 //		Unzip image.
 //	 -q
@@ -51,6 +53,7 @@ func main() {
 	H := flag.String("H", "", "Hash algorithm")
 	V := flag.String("V", "", "Hash sum")
 	f := flag.Bool("f", false, "Force mounting")
+	r := flag.Bool("r", false, "Recovery key ids")
 	s := flag.Bool("s", false, "System partition only")
 	u := flag.Bool("u", false, "Unmount image")
 	z := flag.Bool("z", false, "Unzip image")
@@ -68,7 +71,7 @@ func main() {
 	}
 
 	if *h || len(img) == 0 {
-		sys.Usage("fmount.dd [-fsuzqhv] [-H CRC32|MD5|SHA1|SHA256] [-V SUM] [-B KEY] [-D DIR] IMAGE")
+		sys.Usage("fmount.dd [-fruszqhv] [-H CRC32|MD5|SHA1|SHA256] [-V SUM] [-B KEY] [-D DIR] IMAGE")
 	}
 
 	if *q {
@@ -115,7 +118,9 @@ func main() {
 
 	var err error
 
-	if *u {
+	if *r {
+		_, err = dd.KeyIds(img)
+	} else if *u {
 		err = dd.Unmount(img)
 	} else {
 		_, err = dd.Mount(img, *D, *B, *s)

cmd/fmount.vmdk/main.go

@@ -2,7 +2,7 @@
 //
 // Usage:
 //
-//	fmount.vmdk [-fsuzqhv] [-H CRC32|MD5|SHA1|SHA256] [-V SUM] [-B KEY] [-D DIR] IMAGE
+//	fmount.vmdk [-fruszqhv] [-H CRC32|MD5|SHA1|SHA256] [-V SUM] [-B KEY] [-D DIR] IMAGE
 //
 // The flags are:
 //
@@ -16,10 +16,12 @@
 //	 	The hash sum to verify.
 //	 -f
 //		Force type (bypass check).
-//	 -s
-//		System partition only.
+//	 -r
+//		Search recovery key ids.
 //	 -u
 //		Unmount image.
+//	 -s
+//		System partition only.
 //	 -z
 //		Unzip image.
 //	 -q
@@ -51,6 +53,7 @@ func main() {
 	H := flag.String("H", "", "Hash algorithm")
 	V := flag.String("V", "", "Hash sum")
 	f := flag.Bool("f", false, "Force mounting")
+	r := flag.Bool("r", false, "Recovery key ids")
 	s := flag.Bool("s", false, "System partition only")
 	u := flag.Bool("u", false, "Unmount image")
 	z := flag.Bool("z", false, "Unzip image")
@@ -68,7 +71,7 @@ func main() {
 	}
 
 	if *h || len(img) == 0 {
-		sys.Usage("fmount.vmdk [-fsuzqhv] [-H CRC32|MD5|SHA1|SHA256] [-V SUM] [-B KEY] [-D DIR] IMAGE")
+		sys.Usage("fmount.vmdk [-fruszqhv] [-H CRC32|MD5|SHA1|SHA256] [-V SUM] [-B KEY] [-D DIR] IMAGE")
 	}
 
 	if *q {
@@ -115,7 +118,9 @@ func main() {
 
 	var err error
 
-	if *u {
+	if *r {
+		_, err = vmdk.KeyIds(img)
+	} else if *u {
 		err = vmdk.Unmount(img)
 	} else {
 		_, err = vmdk.Mount(img, *D, *B, *s)

cmd/fmount/main.go

@@ -2,7 +2,7 @@
 //
 // Usage:
 //
-//	fmount [-suzqhv] [-H CRC32|MD5|SHA1|SHA256] [-V SUM] [-B KEY] [-T RAW|DD|VMDK] [-D DIR] IMAGE
+//	fmount [-ruszqhv] [-H CRC32|MD5|SHA1|SHA256] [-V SUM] [-B KEY] [-T RAW|DD|VMDK] [-D DIR] IMAGE
 //
 // The flags are:
 //
@@ -16,10 +16,12 @@
 //	 	The hash algorithm to use.
 //	 -V sum
 //	 	The hash sum to verify.
-//	 -s
-//		System partition only.
+//	 -r
+//		Search recovery key ids.
 //	 -u
 //		Unmount image.
+//	 -s
+//		System partition only.
 //	 -z
 //		Unzip image.
 //	 -q
@@ -52,8 +54,9 @@ func main() {
 	B := flag.String("B", "", "BitLocker key")
 	H := flag.String("H", "", "Hash algorithm")
 	V := flag.String("V", "", "Hash sum")
-	s := flag.Bool("s", false, "System partition only")
+	r := flag.Bool("r", false, "Recovery key ids")
 	u := flag.Bool("u", false, "Unmount image")
+	s := flag.Bool("s", false, "System partition only")
 	z := flag.Bool("z", false, "Unzip image")
 	q := flag.Bool("q", false, "Quiet mode")
 	h := flag.Bool("h", false, "Show usage")
@@ -69,7 +72,7 @@ func main() {
 	}
 
 	if *h || len(img) == 0 {
-		sys.Usage("fmount [-suzqhv] [-H CRC32|MD5|SHA1|SHA256] [-V SUM] [-B KEY] [-T RAW|DD|VMDK] [-D DIR] IMAGE")
+		sys.Usage("fmount [-ruszqhv] [-H CRC32|MD5|SHA1|SHA256] [-V SUM] [-B KEY] [-T RAW|DD|VMDK] [-D DIR] IMAGE")
 	}
 
 	it, err := fmount.DetectType(img, *T)
@@ -96,14 +99,18 @@ func main() {
 		args = append(args, "-V", *V)
 	}
 
-	if *s {
-		args = append(args, "-s")
+	if *r {
+		args = append(args, "-r")
 	}
 
 	if *u {
 		args = append(args, "-u")
 	}
 
+	if *s {
+		args = append(args, "-s")
+	}
+
 	if *z {
 		args = append(args, "-z")
 	}

docs/fmount.dd.md

@@ -2,7 +2,7 @@
 Mount forensic raw or dd disk images for read-only processing.
 
 ```sh
-# fmount.dd [-fsuzqhv] [-H CRC32|MD5|SHA1|SHA256] [-V SUM] [-B KEY] [-D DIR] IMAGE
+# fmount.dd [-fruszqhv] [-H CRC32|MD5|SHA1|SHA256] [-V SUM] [-B KEY] [-D DIR] IMAGE
 ```
 
 Available options:
@@ -12,8 +12,9 @@ Available options:
 - `-H` Hash algorithm
 - `-V` Verify hash sum
 - `-f` Force type
-- `-s` System partition only
+- `-r` Recovery key ids 
 - `-u` Unmount image
+- `-s` System partition only
 - `-z` Unzip image
 - `-q` Quiet mode
 - `-h` Show usage

docs/fmount.md

@@ -2,7 +2,7 @@
 Mount forensic disk images for read-only processing.
 
 ```sh
-# fmount [-suzqhv] [-H CRC32|MD5|SHA1|SHA256] [-V SUM] [-B KEY] [-T RAW|DD|VMDK] [-D DIR] IMAGE
+# fmount [-ruszqhv] [-H CRC32|MD5|SHA1|SHA256] [-V SUM] [-B KEY] [-T RAW|DD|VMDK] [-D DIR] IMAGE
 ```
 
 Available options:
@@ -12,8 +12,9 @@ Available options:
 - `-B` BitLocker key
 - `-H` Hash algorithm
 - `-V` Verify hash sum
-- `-s` System partition only
+- `-r` Recovery key ids 
 - `-u` Unmount image
+- `-s` System partition only
 - `-z` Unzip image
 - `-q` Quiet mode
 - `-h` Show usage

docs/fmount.vmdk.md

@@ -2,7 +2,7 @@
 Mount forensic [VMDK](https://forensics.wiki/vmware_virtual_disk_format_%28vmdk%29/) disk images for read-only processing.
 
 ```sh
-# fmount.vmdk [-fsuzqhv] [-H CRC32|MD5|SHA1|SHA256] [-V SUM] [-B KEY] [-D DIR] IMAGE
+# fmount.vmdk [-fruszqhv] [-H CRC32|MD5|SHA1|SHA256] [-V SUM] [-B KEY] [-D DIR] IMAGE
 ```
 
 Available options:
@@ -12,8 +12,9 @@ Available options:
 - `-H` Hash algorithm
 - `-V` Verify hash sum
 - `-f` Force type
-- `-s` System partition only
+- `-r` Recovery key ids 
 - `-u` Unmount image
+- `-s` System partition only
 - `-z` Unzip image
 - `-q` Quiet mode
 - `-h` Show usage