Difference between revisions of "Affuse"

From ForensicsWiki
Jump to: navigation, search
m (New page: '''affuse''' is a FUSE implementation that allows AFF files to appear as raw files on Linux systems. This allows the files to be processed with forensic tools that do not understand AF...)
 
m (Defined FUSE acronym and added external link)
 
Line 1: Line 1:
'''affuse''' is a FUSE implementation that allows [[AFF]] files to appear as raw files on Linux systems. This allows the files to be processed with forensic tools that do not understand AFF. It also allows the disk images to be actually mounted, should you want to do that.
+
'''affuse''' is a Filesystem in Userspace (FUSE) implementation that allows [[AFF]] files to appear as raw files on Linux systems. This allows the files to be processed with forensic tools that do not understand AFF. It also allows the disk images to be actually mounted, should you want to do that.
  
 
For example, say that /project/0089.aff is a disk image that you wish to process with raw tools.  With affuse you can mount it like this:
 
For example, say that /project/0089.aff is a disk image that you wish to process with raw tools.  With affuse you can mount it like this:
Line 16: Line 16:
 
   -r-xr-xr-x 1 root root 222390 May 11  1998 io.sys
 
   -r-xr-xr-x 1 root root 222390 May 11  1998 io.sys
 
   -r-xr-xr-x 1 root root      9 May 11  1998 msdos.sys
 
   -r-xr-xr-x 1 root root      9 May 11  1998 msdos.sys
 +
 +
== External Links ==
 +
* [http://fuse.sourceforge.net/ FUSE] - Filesystem in User Space

Latest revision as of 19:40, 31 May 2007

affuse is a Filesystem in Userspace (FUSE) implementation that allows AFF files to appear as raw files on Linux systems. This allows the files to be processed with forensic tools that do not understand AFF. It also allows the disk images to be actually mounted, should you want to do that.

For example, say that /project/0089.aff is a disk image that you wish to process with raw tools. With affuse you can mount it like this:


  # affuse /project/00709.aff /mnt/p
  # ls /mnt/p
  0070.aff.raw

This raw file could then be mounted:

  # mount -t vfat -o loop=/dev/loop0,ro,noexec,offset=32256 /mnt/p/0070.aff.raw  /mnt/r
  # ls /mnt/r
  total 316
  -rwxr-xr-x 1 root root  93880 May 11  1998 command.com
  -r-xr-xr-x 1 root root 222390 May 11  1998 io.sys
  -r-xr-xr-x 1 root root      9 May 11  1998 msdos.sys

External Links

  • FUSE - Filesystem in User Space