tabledevil
1a4af6db30
Cargo-installs --locked from crates.io on rust:1.96-alpine3.21 with build-base + linux-headers + gettext-dev (libesedb's bundled C tree needs all three). Final image is ~26MB on alpine:3.21.
33 lines
1.5 KiB
Docker
33 lines
1.5 KiB
Docker
# tabledevil/ntdsextract2 — Jan Starke's NTDS.DIT forensic analyser, Rust.
|
|
#
|
|
# Modern replacement for the old Python ntdsxtract; pulls users/groups/
|
|
# computers from an offline NTDS.DIT (and the matching SYSTEM hive for
|
|
# secret-decryption), emits a bodyfile timeline, walks the AD DIT tree.
|
|
#
|
|
# Upstream moved off GitHub to https://codeberg.org/janstarke/ntdsextract2
|
|
# (still on crates.io; we install from there to keep the build hermetic).
|
|
#
|
|
# docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 \
|
|
# user /data/ntds.dit
|
|
# docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 \
|
|
# timeline /data/ntds.dit --bodyfile > /tmp/timeline.body
|
|
|
|
FROM rust:1.96-alpine3.21 AS build
|
|
# build-base brings gcc + libc-dev + binutils + make (libesedb's bundled C
|
|
# tree fails to compile without them); linux-headers + gettext-dev are
|
|
# libyal-on-musl prerequisites (bindtextdomain etc.).
|
|
RUN apk add --no-cache --virtual .build build-base clang pkgconf linux-headers gettext-dev
|
|
|
|
# Crates.io build pulls upstream + embedded C code; takes ~5 min cold.
|
|
# --locked uses the upstream Cargo.lock (otherwise resolved transitive deps
|
|
# can demand newer rustc than the base image ships).
|
|
RUN cargo install --locked --root /opt/ntdsextract2 ntdsextract2
|
|
|
|
FROM alpine:3.21
|
|
RUN apk add --no-cache libgcc
|
|
COPY --from=build /opt/ntdsextract2/bin/ntdsextract2 /usr/local/bin/ntdsextract2
|
|
COPY start.sh /start.sh
|
|
RUN chmod +x /start.sh && mkdir -p /data
|
|
WORKDIR /data
|
|
ENTRYPOINT ["/start.sh"]
|