ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.

Difference between revisions of "Carver 2.0 Planning Page"

From ForensicsWiki
Jump to: navigation, search
m (New page: This page is for planning Carver 2.0. =Requirements= * AFF and EWF file images supported from scratch. * File system aware layer. ** By default, files are not carved. * Plug-in architect...)
(No difference)

Revision as of 20:43, 26 October 2008

This page is for planning Carver 2.0.

Requirements

  • AFF and EWF file images supported from scratch.
  • File system aware layer.
    • By default, files are not carved.
  • Plug-in architecture for validation.
  • Ship with validators for:
    • JPEG
    • MSOLE
    • ZIP
  • Simple fragment recovery carving using gap carving.
  • Recovering of individual ZIP sections and JPEG icons that are not sector aligned.
  • Autonomous operation.
  • Tested on 500GB-sized images. Should be able to carve a 500GB image in roughly 50% longer than it takes to read the image.
  • Parallelizable.
  • Can read Scalpel and Foremost config files.
  • Can output audit.txt file.
  • Easy integration into ascription software.


Ideas

  • Use as much TSK if possible. Don't carry your own FS implementation there way photorec does.