Difference between revisions of "Carver 2.0 Planning Page"

From ForensicsWiki
Jump to: navigation, search
m (New page: This page is for planning Carver 2.0. =Requirements= * AFF and EWF file images supported from scratch. * File system aware layer. ** By default, files are not carved. * Plug-in architect...)
(No difference)

Revision as of 16:43, 26 October 2008

This page is for planning Carver 2.0.

Requirements

  • AFF and EWF file images supported from scratch.
  • File system aware layer.
    • By default, files are not carved.
  • Plug-in architecture for validation.
  • Ship with validators for:
    • JPEG
    • MSOLE
    • ZIP
  • Simple fragment recovery carving using gap carving.
  • Recovering of individual ZIP sections and JPEG icons that are not sector aligned.
  • Autonomous operation.
  • Tested on 500GB-sized images. Should be able to carve a 500GB image in roughly 50% longer than it takes to read the image.
  • Parallelizable.
  • Can read Scalpel and Foremost config files.
  • Can output audit.txt file.
  • Easy integration into ascription software.


Ideas

  • Use as much TSK if possible. Don't carry your own FS implementation there way photorec does.