Carver 2.0 Planning Page

From ForensicsWiki
Revision as of 16:43, 26 October 2008 by Simsong (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

This page is for planning Carver 2.0.

Requirements

  • AFF and EWF file images supported from scratch.
  • File system aware layer.
    • By default, files are not carved.
  • Plug-in architecture for validation.
  • Ship with validators for:
    • JPEG
    • MSOLE
    • ZIP
  • Simple fragment recovery carving using gap carving.
  • Recovering of individual ZIP sections and JPEG icons that are not sector aligned.
  • Autonomous operation.
  • Tested on 500GB-sized images. Should be able to carve a 500GB image in roughly 50% longer than it takes to read the image.
  • Parallelizable.
  • Can read Scalpel and Foremost config files.
  • Can output audit.txt file.
  • Easy integration into ascription software.


Ideas

  • Use as much TSK if possible. Don't carry your own FS implementation there way photorec does.