MBR 분석 / 디지털 포렌식 / 파티션 복구

gunicorn --bind unix:/tmp/mysite.sock "monitor:create_app()"

import ctypes import os import struct import subprocess import json def is_admin(): """관리자 권한 실행 여부 확인""" try: return ctypes.windll.shell32.IsUserAnAdmin() != 0 except Exception: return False def get_physical_disks(): """PowerShell Get-Disk 명령으로 물리 디스크 정보 조회""" ps_cmd = "Get-Disk | Select-Object Number, FriendlyName, Size, PartitionStyle, OperationalStatus | ConvertTo-Json" try: result = subprocess.run(["powershell", "-Command", ps_cmd], capture_output=True, text=True, check=True) data = json.loads(result.stdout) if isinstance(data, dict): data = [data] return data except Exception as e: print(f"[!] 디스크 목록 조회 실패: {e}") return [] def format_hex_ascii(data, base_offset=0): lines = [] for i in range(0, len(data), 16): chunk = data[i:i+16] hex_str = " ".join(f"{b:02X}" for b in chunk) ascii_str = "".join(chr(b) if 32 <= b <= 126 else "." for b in chunk) current_offset = base_offset + i lines.append(f"0x{current_offset:03X} ({current_offset:03d}) | {hex_str:<47} | {ascii_str}") return "\n".join(lines) def parse_partition_entry(entry_bytes, entry_num): if len(entry_bytes) != 16: return None status, sys_id, lba_start, sector_count = struct.unpack("> 파티션 엔트리 세부 분석:") for p in partitions: print(f" - 파티션 {p['num']}:") if p['sector_count'] == 0 and p['lba_start'] == 0: print(" [미사용 항목]") else: print(f" * 상태 (Status) : {p['status']}") print(f" * 파일시스템 ID : {p['sys_id']}") print(f" * 시작 LBA 섹터 : {p['lba_start']:,}") print(f" * 총 섹터 수 : {p['sector_count']:,}") print(f" * 파티션 용량 : {p['size_gb']:.2f} GB ({p['size_mb']:.1f} MB)") print(f" * Raw Hex (16B) : {p['raw_hex']}") print("\n" + "-" * 80) print("[4] Boot Signature (오프셋 0x1FE ~ 0x1FF)") print("-" * 80) print(f" Raw Hex : 0x{signature_hex}") if signature_bytes == b'\x55\xaa': print(" 검증 : [성공] 0x55AA (유효한 MBR)") else: print(" 검증 : [실패] 0x55AA 아님") print("=" * 80) def main(): if not is_admin(): print("[!] 관리자 권한 필요") return disks = get_physical_disks() if not disks: print("[!] 연결된 물리 디스크 없음") return print("=== 물리 디스크 목록 ===") disk_map = {} for idx, d in enumerate(disks, start=1): num = d.get('Number') name = d.get('FriendlyName', 'Unknown') size_gb = d.get('Size', 0) / (1024**3) style = {0:"RAW",1:"MBR",2:"GPT"}.get(d.get('PartitionStyle'), str(d.get('PartitionStyle'))) print(f"[{idx}] Disk {num} | {name} | {size_gb:.2f} GB | {style}") disk_map[idx] = (num, name) selection = int(input("\n분석할 디스크 번호: ")) if selection in disk_map: disk_num, disk_name = disk_map[selection] device_path = f"\\\\.\\PhysicalDrive{disk_num}" with open(device_path, "rb") as disk: mbr_data = disk.read(512) analyze_mbr(mbr_data, f"PhysicalDrive{disk_num} - {disk_name}") if __name__ == "__main__": main()

/forensic/mbr /forensic/vbr