Libesedb - How to r...
 
Notifications
Clear all

Libesedb - How to read edb?

5 Posts
4 Users
0 Reactions
2,711 Views
(@si2013)
Eminent Member
Joined: 12 years ago
Posts: 36
Topic starter  

I'm currently a student, studying Computer Forensics. For my final year project, I'm going to attempt to create a piece of software that lets you query the Windows.edb file and outputs that row of information about a file.

I've just installed Libesedb on my Linux testing machine. Does anyone have any example code? How do I actually read a database with it?

There's very little information about it. At the moment, i've got the folder 'libesedb-20120102' on my Linux desktop and a Windows.edb file.

Anyone got any suggestions how to read it?


   
Quote
(@angrybadger)
Estimable Member
Joined: 18 years ago
Posts: 164
 

https://code.google.com/p/libesedb/wiki/libesedb

Developing C/C++ code using libesedb


   
ReplyQuote
binarybod
(@binarybod)
Reputable Member
Joined: 17 years ago
Posts: 272
 

You don't seem to have installed the tools. Installing applications in Linux isn't usually just a case of downloading an '.exe' file you actually have to compile them.

There is much to go wrong and you'll need to ensure you have a suitable compiler (usually gcc) and the autotools suite installed (in most 'out of the box' distros they usually are).

The steps thereafter are
1) cd into the directory (libesedb-20120102 in your case)
2) type './configure' to run the configure script
3) type 'make' to compile the libraries and executables
4) type ' sudo make install' to copy the new files to the relevant locations. You may need to provide your user password to allow this command to execute.

I tend to issue these commands separately but I have seen people issue them all together
./configure ; make ; sudo make install It's just a matter of faith in whether the build will work or not…

Once all this done you can use the tools esedbinfo and esedbexport on your edb file; indeed you can get all the options and read how to use the tools by typing
man esedbinfo or
man esedbexport

Good luck )


   
ReplyQuote
(@joachimm)
Estimable Member
Joined: 17 years ago
Posts: 181
 

It is a "stock install from source" on Linux.

Step 1 build and install it see
https://code.google.com/p/libesedb/wiki/Building

Step 2 check the man pages
man libesedb
man esedbinfo
man esedbexport

Or the help output
esedbinfo -h
esedbexport -h

Step 3 run it

> 'm going to attempt to create a piece of software that lets you query the Windows.edb file and outputs
> that row of information about a file.

That is what esedbexport already does for you. Why reinvent the wheel?


   
ReplyQuote
(@si2013)
Eminent Member
Joined: 12 years ago
Posts: 36
Topic starter  

Thanks guys. I had built the tool in Linux, perhaps it's the wrong terminology but I am just used to saying 'installed' due to my Windows background.

I haven't got to play around with esedbexport yet but I'll try that today. If it already does what I want it to, then that is excellent!

Thanks again wink


   
ReplyQuote
Share: