add multi volume support

[joachimmetz]

Depends on phased processing changes

• change source scanner and collector to handle multiple file system path specs
• add support to process multi volumes to the extraction frontend
• add support for encrypted volumes for now BDE
  • https://codereview.appspot.com/251910043
  • make sure to rescan BDE for VSS in BDE
  • determine which credentials are actually available in the BDE volume
• add support to select a range of partitions/volumes
• fix preprocessor to handle more than one system configuration
  • moved to Change preprocessor and knowledge base to handle more than one system configuration #2286
• fix tools to handle more than one source
  • moved to Change tools to support more than 1 source (input) file #2287
• Store scanning options in VolumeScanOptions objects ?
  • https://codereview.appspot.com/340700043/
  • make VolumeShadowSnapshotsOptions more generic?
  • move part of this functionality into dfvfs
  • moved to Consolidate CLI volume scanning code dfvfs#341
• print overview of volumes to be processed
  • moved to print overview of volumes to be processed #4610

Related:

• Make --partition argument accept a list or "all" #180
• https://codereview.appspot.com/238390043
• https://codereview.appspot.com/232710043
• https://codereview.appspot.com/246600043

[f-s-p]

+1

[pettai]

Is this issue about being able to understand Linux LVM too? (I noted that LVM was mentioned in #180) Or should I open a new issue?

It doesn't seem to it work ATM:

-bash-4.3$ log2timeline.py plaso.dump clone.vmdk
[INFO] Data files will be loaded from /usr/share/plaso by default.
The following partitions were found:
Identifier Offset (in bytes) Size (in bytes)
p1 1048576 (0x00100000) 243.0MiB / 254.8MB (254803968 B)
p2 256901120 (0x0f500000) 19.8GiB / 21.2GB (21216886784 B)

Please specify the identifier of the partition that should be processed.
All partitions can be defined as: "all". Note that you can abort with Ctrl^C.
p2
2015-09-13 16:29:54,395 WARNING PID:24955 No supported file system found in source.

[joachimmetz]

Is this issue about being able to understand Linux LVM too?

Yes. Also see: https://github.com/log2timeline/dfvfs/wiki/Roadmap#volume-systems

It doesn't seem to it work ATM:

This is still on the to do list.

[pettai]

just wanna add +1 for fixing LVM support