initial code for dumping imessages in a reasonable format

dump-imessages/iphone-dataprotection/python_scripts/emf_undelete.py

@@ -0,0 +1,25 @@
+import os
+import sys
+from hfs.emf import EMFVolume
+from hfs.journal import do_emf_carving
+from util.bdev import FileBlockDevice
+
+if __name__ == "__main__":
+    if len(sys.argv) < 2:
+        print "Usage: emf_undelete.py disk_image.bin"
+        sys.exit(0)
+    filename = sys.argv[1]
+    volume = EMFVolume(FileBlockDevice(filename), None)
+    dirname = os.path.dirname(filename)
+    if dirname == "":
+        dirname = "."
+    outdir = dirname + "/" + volume.volumeID().encode("hex") + "_" + os.path.basename(filename)
+    carveokdir = outdir + "/undelete/"
+    carvenokdir = outdir + "/junk/"
+    try:
+        os.makedirs(carveokdir)
+        os.makedirs(carvenokdir)
+    except:
+        pass
+    
+    do_emf_carving(volume, carveokdir, carvenokdir)