Windows Server 2016, 2019, 2022 Extracter & Recovery

Parsing files from Deduplicated volumes. It can also recover deleted files from NTFS Filesystem that were deduplicated.

Installation

git clone https://github.com/starson1/WinDedup_Extracter

Usage

python windedup.py [options] imagefile
ex) python main.py -m 1 test.001

Needs

1. "Raw" Image File

2. System Volume Information Directory exported from image file

   ex) WinDedup_Extracter/System Volume Information

Supporting E01, Raw, AD1 --> TBU

Structure of System Volume Information:

System Volume Information
├─ Dedup                 
│  ├─ ChunkStore                  
│  │  ├─ {GUID}.ddp
│  │      ├─ Data
│  │      ├─ HotSpot
│  │      ├─ Stream 
│  │      └─ …
│  ├─ Logs                
│  │  └─ …
|  ├─ Settings
│  │  └─ …
|  ├─ State
│  │  └─ …
└─ WPSettings.dat

Documentation on Windows Deduplication

• TBA: Paper where WinDedup is presented.
• Forensic analysis of deduplication file systems
• A Study of Method to Restore Deduplicated Files in Windows Server 2012