I'm currently a student, studying Computer Forensics. For my final year project, I'm going to attempt to create a piece of software that lets you query the Windows.edb file and outputs that row of information about a file.
I've just installed Libesedb on my Linux testing machine. Does anyone have any example code? How do I actually read a database with it?
There's very little information about it. At the moment, i've got the folder 'libesedb-20120102' on my Linux desktop and a Windows.edb file.
Anyone got any suggestions how to read it?
https://
Developing C/C++ code using libesedb
You don't seem to have installed the tools. Installing applications in Linux isn't usually just a case of downloading an '.exe' file you actually have to compile them.
There is much to go wrong and you'll need to ensure you have a suitable compiler (usually gcc) and the autotools suite installed (in most 'out of the box' distros they usually are).
The steps thereafter are
1) cd into the directory (libesedb-20120102 in your case)
2) type './configure' to run the configure script
3) type 'make' to compile the libraries and executables
4) type ' sudo make install' to copy the new files to the relevant locations. You may need to provide your user password to allow this command to execute.
I tend to issue these commands separately but I have seen people issue them all together
./configure ; make ; sudo make install It's just a matter of faith in whether the build will work or not…
Once all this done you can use the tools esedbinfo and esedbexport on your edb file; indeed you can get all the options and read how to use the tools by typing
man esedbinfo or
man esedbexport
Good luck )
It is a "stock install from source" on Linux.
Step 1 build and install it see
https://
Step 2 check the man pages
man libesedb
man esedbinfo
man esedbexport
Or the help output
esedbinfo -h
esedbexport -h
Step 3 run it
> 'm going to attempt to create a piece of software that lets you query the Windows.edb file and outputs
> that row of information about a file.
That is what esedbexport already does for you. Why reinvent the wheel?
Thanks guys. I had built the tool in Linux, perhaps it's the wrong terminology but I am just used to saying 'installed' due to my Windows background.
I haven't got to play around with esedbexport yet but I'll try that today. If it already does what I want it to, then that is excellent!
Thanks again wink