Parsing files from Deduplicated volumes. It can also recover deleted files from NTFS Filesystem that were deduplicated.

Installation

git clone https://github.com/starson1/WinDedup_Extracter

Usage

python windedup.py [options] imagefile
ex) python main.py -m 1 test.001

Needs

  1. “Raw” Image File

  2. System Volume Information Directory exported from image file

    ex) WinDedup_Extracter/System Volume Information

Supporting E01, Raw, AD1 –> TBU

Structure of System Volume Information:

System Volume Information
├─ Dedup                 
│  ├─ ChunkStore                  
│  │  ├─ {GUID}.ddp
│  │      ├─ Data
│  │      ├─ HotSpot
│  │      ├─ Stream 
│  │      └─ …
│  ├─ Logs                
│  │  └─ …
|  ├─ Settings
│  │  └─ …
|  ├─ State
│  │  └─ …
└─ WPSettings.dat

Documentation on Windows Deduplication