dfvfs

The Digital Forensics Virtual File System (dfVFS) is designed for digital forensics investigations, enabling read-only access to file-system objects across diverse storage media and formats. This ensures data integrity during analysis, which is critical in forensic workflows.

Use cases include examining disk images, encrypted volumes, and proprietary file formats without altering the original data. It supports a wide range of back-ends for technologies like EWF, BDE, APFS, HFS, NTFS, XFS, VDE, LUKSDE, QCOW, VHDI, VMDK, VSHADOW, and VSLVM.

dfVFS is typically used as a library within other forensic tools, providing a unified path abstraction for accessing nested and multi-layered storage structures. Its dependency on libraries like libewf, libfsntfs, and libvmdk allows handling complex forensic images from various sources.

dfVFS operates through a generic interface that abstracts file-system objects, leveraging specialized back-ends for specific storage media types, volume systems, and file systems. These back-ends implement read-only access protocols for formats including EWF, BDE, APFS, HFS+, NTFS, XFS, VDE, LUKSDE, QCOW, VHDI, VMDK, VSHADOW, and LVM, using dependencies like python3-libewf, python3-libfsntfs, and python3-libvmdk. It provides path resolution and mounting capabilities for virtual file systems, enabling seamless navigation of multi-layered storage without modifying source data.