Difference between revisions of "Carver 2.0 Planning Page"
From Forensics Wiki
m (New page: This page is for planning Carver 2.0. =Requirements= * AFF and EWF file images supported from scratch. * File system aware layer. ** By default, files are not carved. * Plug-in architect...) |
Revision as of 15:43, 26 October 2008
This page is for planning Carver 2.0.
Requirements
- AFF and EWF file images supported from scratch.
- File system aware layer.
- By default, files are not carved.
- Plug-in architecture for validation.
- Ship with validators for:
- JPEG
- MSOLE
- ZIP
- Simple fragment recovery carving using gap carving.
- Recovering of individual ZIP sections and JPEG icons that are not sector aligned.
- Autonomous operation.
- Tested on 500GB-sized images. Should be able to carve a 500GB image in roughly 50% longer than it takes to read the image.
- Parallelizable.
- Can read Scalpel and Foremost config files.
- Can output audit.txt file.
- Easy integration into ascription software.
Ideas
- Use as much TSK if possible. Don't carry your own FS implementation there way photorec does.