Screen Shots

These are some screen shots that demonstrate various features of PyFlag.

Browsing the Virtual File System

The screenshot below shows how the VFS can be browsed. Note the deleted and unallocated virtual directories. These can be browsed as well.

Browse Types

The screenshot below demonstrates how the types of the files in the disk image can be browsed. Since the report uses a standard PyFlag table, we can use the filtering function to view only the images.

HexDump View

When we view the data near the end of the file, it is possible to see where the file finishes and slack space begins. We can also see (in red) a single block after the file in case slack space continues into it.

Viewing file

This screenshot shows the statistics of the file.