ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.

Carver 2.0 Planning Page

From ForensicsWiki
Revision as of 20:43, 26 October 2008 by Simsong (Talk | contribs) (New page: This page is for planning Carver 2.0. =Requirements= * AFF and EWF file images supported from scratch. * File system aware layer. ** By default, files are not carved. * Plug-in architect...)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

This page is for planning Carver 2.0.

Requirements

  • AFF and EWF file images supported from scratch.
  • File system aware layer.
    • By default, files are not carved.
  • Plug-in architecture for validation.
  • Ship with validators for:
    • JPEG
    • MSOLE
    • ZIP
  • Simple fragment recovery carving using gap carving.
  • Recovering of individual ZIP sections and JPEG icons that are not sector aligned.
  • Autonomous operation.
  • Tested on 500GB-sized images. Should be able to carve a 500GB image in roughly 50% longer than it takes to read the image.
  • Parallelizable.
  • Can read Scalpel and Foremost config files.
  • Can output audit.txt file.
  • Easy integration into ascription software.


Ideas

  • Use as much TSK if possible. Don't carry your own FS implementation there way photorec does.