You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
What new feature do you think would be cool to add to artemis?
Currently artemis just labels files that are compressed with the builtin NTFS compression types. It would be cool if it could decompress the data.
This is primarily useful when hashing files and reporting file sizes.
Describe the solution you'd like
Support decompressing NTFS compressed files. Might be dependent/solvable by #6
Additional context
NTFS compressed files are kind of finicky to deal with. For example, if explorer.exe is compressed with the builtin NTFS compression and we want to answer the question "How big is the file?". Do we want the compressed size or decompressed size? But if someone copies the file to a different location/drive, Windows decompresses the file and now the size is different.
What new feature do you think would be cool to add to artemis?
Currently artemis just labels files that are compressed with the builtin NTFS compression types. It would be cool if it could decompress the data.
This is primarily useful when hashing files and reporting file sizes.
Describe the solution you'd like
Support decompressing NTFS compressed files. Might be dependent/solvable by #6
Additional context
NTFS compressed files are kind of finicky to deal with. For example, if
explorer.exe
is compressed with the builtin NTFS compression and we want to answer the question "How big is the file?". Do we want the compressed size or decompressed size? But if someone copies the file to a different location/drive, Windows decompresses the file and now the size is different.NTFS: https://en.wikipedia.org/wiki/NTFS (File Compression)
libyal: https://github.com/libyal/libfsntfs/blob/main/documentation/New%20Technologies%20File%20System%20(NTFS).asciidoc#9-compression
The text was updated successfully, but these errors were encountered: