Python Script cannot access drive to recover deleted files using pytsk3

85 views Asked by At
import tkinter as tk
from tkinter import filedialog
import pytsk3

drive_entry = None  # Global variable for drive_entry
output_entry = None  # Global variable for output_entry

def recover_files(drive_path, output_path):
    # Open the drive
    img_info = pytsk3.Img_Info(drive_path)
    # Open the file system
    fs_info = pytsk3.FS_Info(img_info)
    # Get the root directory
    root_dir = fs_info.open_dir('/')
    # Recursively search for deleted files
    for entry in root_dir:
        if entry.info.name.name.decode('utf-8').startswith('$'):
            # This is a deleted file
            file_data = entry.read_random(0, entry.info.meta.size)
            # Write the file data to disk
            with open(output_path + entry.info.name.name.decode('utf-8'), 'wb') as f:
                f.write(file_data)

def select_drive_path():
    global drive_entry  # Use the global drive_entry variable
    drive_path = filedialog.askopenfilename()
    drive_entry.delete(0, tk.END)
    drive_entry.insert(tk.END, drive_path)

def select_output_path():
    global output_entry  # Use the global output_entry variable
    output_path = filedialog.askdirectory()
    output_entry.delete(0, tk.END)
    output_entry.insert(tk.END, output_path)

def main():
    global drive_entry  # Use the global drive_entry variable
    global output_entry  # Use the global output_entry variable
    
    # Create the GUI
    root = tk.Tk()
    root.title('Deleted File Recovery')
    
    # Create the input fields
    drive_label = tk.Label(root, text='Drive Path:')
    drive_label.pack()
    drive_entry = tk.Entry(root)
    drive_entry.pack()
    
    drive_button = tk.Button(root, text='Select Drive', command=select_drive_path)
    drive_button.pack()
    
    output_label = tk.Label(root, text='Output Path:')
    output_label.pack()
    output_entry = tk.Entry(root)
    output_entry.pack()
    
    output_button = tk.Button(root, text='Select Output', command=select_output_path)
    output_button.pack()
    
    # Create the button
    recover_button = tk.Button(root, text='Recover Files', command=lambda: recover_files(drive_entry.get(), output_entry.get()))
    recover_button.pack()
    
    # Start the GUI
    root.mainloop()

if __name__ == '__main__':
    main()

It throws up this error:

Traceback (most recent call last):
  File "C:\Users\User\AppData\Local\Programs\Python\Python311\Lib\tkinter\__init__.py", line 1948, in __call__
    return self.func(*args)
           ^^^^^^^^^^^^^^^^
  File "C:\Users\User\Documents\transtech\ocha_app\CPU\data16.py", line 62, in <lambda>
    recover_button = tk.Button(root, text='Recover Files', command=lambda: recover_files(drive_entry.get(), output_entry.get()))
                                                                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\User\Documents\transtech\ocha_app\CPU\data16.py", line 12, in recover_files
    fs_info = pytsk3.FS_Info(img_info)
              ^^^^^^^^^^^^^^^^^^^^^^^^
OSError: FS_Info_Con: (tsk3.cpp:214) Unable to open the image as a filesystem at offset: 0x00000000 with error: Cannot determine file system type

I tried accessing drive directly it did not work and i converted the drive to an image using FTK .raw file still did not work

0

There are 0 answers