Difference between revisions of "Affuse"
From Forensics Wiki
m (New page: '''affuse''' is a FUSE implementation that allows AFF files to appear as raw files on Linux systems. This allows the files to be processed with forensic tools that do not understand AF...) |
m (Defined FUSE acronym and added external link) |
||
| Line 1: | Line 1: | ||
| − | '''affuse''' is a FUSE implementation that allows [[AFF]] files to appear as raw files on Linux systems. This allows the files to be processed with forensic tools that do not understand AFF. It also allows the disk images to be actually mounted, should you want to do that. | + | '''affuse''' is a Filesystem in Userspace (FUSE) implementation that allows [[AFF]] files to appear as raw files on Linux systems. This allows the files to be processed with forensic tools that do not understand AFF. It also allows the disk images to be actually mounted, should you want to do that. |
For example, say that /project/0089.aff is a disk image that you wish to process with raw tools. With affuse you can mount it like this: | For example, say that /project/0089.aff is a disk image that you wish to process with raw tools. With affuse you can mount it like this: | ||
| Line 16: | Line 16: | ||
-r-xr-xr-x 1 root root 222390 May 11 1998 io.sys | -r-xr-xr-x 1 root root 222390 May 11 1998 io.sys | ||
-r-xr-xr-x 1 root root 9 May 11 1998 msdos.sys | -r-xr-xr-x 1 root root 9 May 11 1998 msdos.sys | ||
| + | |||
| + | == External Links == | ||
| + | * [http://fuse.sourceforge.net/ FUSE] - Filesystem in User Space | ||
Latest revision as of 18:40, 31 May 2007
affuse is a Filesystem in Userspace (FUSE) implementation that allows AFF files to appear as raw files on Linux systems. This allows the files to be processed with forensic tools that do not understand AFF. It also allows the disk images to be actually mounted, should you want to do that.
For example, say that /project/0089.aff is a disk image that you wish to process with raw tools. With affuse you can mount it like this:
# affuse /project/00709.aff /mnt/p # ls /mnt/p 0070.aff.raw
This raw file could then be mounted:
# mount -t vfat -o loop=/dev/loop0,ro,noexec,offset=32256 /mnt/p/0070.aff.raw /mnt/r # ls /mnt/r total 316 -rwxr-xr-x 1 root root 93880 May 11 1998 command.com -r-xr-xr-x 1 root root 222390 May 11 1998 io.sys -r-xr-xr-x 1 root root 9 May 11 1998 msdos.sys
[edit] External Links
- FUSE - Filesystem in User Space
