posted with kind permission of Jamie
Reconnoitre – looking for beta testers/feedback
Over the last year I have been working on and off on some new software, Reconnoitre, amongst other things it allows you to look at file differences that are stored within volume shadow copies as part of a normal ‘tree’. With Reconnoitre you just open up a disk/image and the shadowed files are shown alongside their ‘real’ brethren. No more mounting images with PDE, no playing with complex vssadmin command lines – just point at an image like you are used to with main stream forensic tools.
Reconnoitre supports physical and logical disks as well as S/E01 and DD format image files.
For the moment while I iron out some of the existing issues I am releasing a time limited proof of concept/early beta test ‘lite’ tool that is intended to generate some feedback – it is a 0.0.1 release and probably buggy so don’t rely on it ). At the moment only the last three VSCs are processed (makes debuging easier)
Reconnoitre at the moment is lite in that its functionality is limited to displaying files (and shadow files) as well as copying these files out of an image.
Please download the Reconnoitre installer from the link below and let me know what you think.
Further info about future versions will be made public on twitter, on various forums (including my own) and via our website.
Typical )
Now I am testing outside of the Development Environment a few new bugs have popped up. A fix has been posted to the same URL. If you have already downloaded please accept my apologies and uninstall the previous version (there is an uninstall option on the start menu) and download the new version 0.0.2 from the link above.
Paul
Paul,
Got my first bug report ) What is your email address for these reports (I'm waiting for a password reset for your forum atm).
cheers
A screenshot showing two different versions of the source code to this program and the date of the VSC file that contains the shadowed version.
OK getting lots of good feedback so for the moment I am halting downloads so that I don't get snowed and end up spending more time dealing with emails than developing software.