Skip to content
Evidence Fetcher (efetch) is a web-based file explorer, viewer, and analyzer.
Branch: master
Clone or download
Michael Maurer Michael Maurer
Michael Maurer and Michael Maurer Fixed major issue with zip files in pathspec_helper. Added additional…
… yaml plugins.
Latest commit 9928e5c Jan 24, 2019
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
efetch_server
kibana/efetch-0.1.0
scripts CSS, JS, and template clean up. Added RAW plugin. Nov 17, 2017
.gitignore Major commit. Created new docker with Ubuntu 16.04. Added about a doz… Nov 16, 2018
Dockerfile Added extract and expand plugins. Fixed minor bugs. Jan 16, 2019
LICENSE Moved dfvfs util to the util folder. Moved reglib into the regview pl… Mar 19, 2016
MANIFEST.in
README Updated styles, added evtx yaml plugins, and added prefetch yaml plugins Nov 19, 2018
README.md Updated styles, added evtx yaml plugins, and added prefetch yaml plugins Nov 19, 2018
dfvfs.requirements.txt Dockerfile Jul 25, 2018
efetch Added extract and expand plugins. Fixed minor bugs. Jan 16, 2019
efetch_plugins.yml Fixed major issue with zip files in pathspec_helper. Added additional… Jan 25, 2019
install.sh Update install.sh Oct 22, 2016
setup.cfg
setup.py Major commit. Created new docker with Ubuntu 16.04. Added about a doz… Nov 16, 2018
stdeb.cfg

README.md

efetch

Evidence Fetcher (efetch) is a web-based file explorer, viewer, and analyzer. Efetch supports viewing hundreds of file types including office, registry, PST, image, and SQLite files. Efetch supports navigating RAW, E01, ZIP, GZ, TAR, VMDK, VHD, QCOW, and BZ2 files thanks to dfVFS.

Docker

The fastest way to get started with Efetch is using Docker. Download efetch and cd to its direcotry. Then create the Docker image:

docker build -t efetch -f Dockerfile .

Then run the Docker container in a directory with your evidence:

docker run -p 8080:8080 -v $(pwd):$(pwd) -w $(pwd) efetch efetch --address=0.0.0.0 --defaultpath=$(pwd)

Finaly goto "http://localhost:8080" using a web browser

Install

Below is a list of dependencies for efetch:

  • python
  • plaso
  • setuptools (>=28.5.0)
  • pip
  • libpff
  • zlib
  • libjpeg
  • libtff

On Ubuntu 16.04 these packages can be installed using the following commands:

sudo add-apt-repository -y ppa:gift/stable
sudo add-apt-repository -y ppa:sift/stable
sudo apt-get update
sudo apt-get install -y python-plaso python-dev python-setuptools unoconv libpff libpff-python zlib1g-dev libjpeg-dev libtiff5-dev python-pip
sudo pip install setuptools -U

Once these dependencies are met, efetch can be installed using the python setup tools. Download the efetch repository and run setup.py:

sudo python setup.py install

Usage

After installation run the command efetch in the terminal and navigate to localhost:8080 in a browser. From the home page, either browse your local file system directly using the browse option or enter a pathspec. Evidence can be navigated by simply clicking the file name or icon.

alt tag

The efetch command supports the following arguments:

usage: efetch [-h] [-d] [-v] [-a ADDRESS] [-p PORT] [-e ELASTIC] [-c CACHE]
              [-m MAXFILESIZE] [-u DEFAULTPATH] [-f PLUGINSFILE]

optional arguments:
  -h, --help            show this help message and exit
  -d, --debug           Displays debug messages
  -v, --version         Prints Efetch version
  -a ADDRESS, --address ADDRESS
                        IP address for the Efetch server
  -p PORT, --port PORT  Port for the Efetch server
  -e ELASTIC, --elastic ELASTIC
                        Elasticsearch URL, i.e. localhost:9200
  -c CACHE, --cache CACHE
                        Directory to store cached files
  -m MAXFILESIZE, --maxfilesize MAXFILESIZE
                        Max file size to cache in Megabytes, default 1GB
  -u DEFAULTPATH, --defaultpath DEFAULTPATH
                        Default path used by the home page
  -f PLUGINSFILE, --pluginsfile PLUGINSFILE
                        Path to the plugins config file

Plugins

Efetch can be easily extended with simple plugins by editing the /etc/efetch_plugin.yml file. Efetch automatically detects any changes to the plugin file. Below is an example of a ClamAV efetch plugin:

  clamscan:
    name: Clam Scan
    command: "clamscan '{{ file_cache_path }}'"

Additionally, efetch supports more advanced python plugins. These plugins can be created using the scripts/create_plugin.py script. For more information see https://github.com/maurermj08/efetch/wiki/Create-Plugin.

Note

Efetch is in Beta and really needs the community's support, so please post any bugs. As far as this project is concerned, there is no such thing as a bad bug report.

For more information about efetch please see: https://github.com/maurermj08/efetch/wiki

You can’t perform that action at this time.