http://www.forensicswiki.org/w/index.php?title=Carver_2.0_Planning_Page&feed=atom&action=history 2013-05-22T00:30:12Z Revision history for this page on the wiki MediaWiki 1.20.3 http://www.forensicswiki.org/w/index.php?title=Carver_2.0_Planning_Page&diff=8837&oldid=prev 2012-09-25T08:09:04Z

<p></p> <table class='diff diff-contentalign-left'> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr style='vertical-align: top;'> <td colspan='2' style="background-color: white; color:black;">← Older revision</td> <td colspan='2' style="background-color: white; color:black;">Revision as of 08:09, 25 September 2012</td> </tr><tr><td colspan="2" class="diff-lineno">Line 12:</td> <td colspan="2" class="diff-lineno">Line 12:</td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>&lt;s&gt;bad idea&lt;/s&gt;</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>&lt;s&gt;bad idea&lt;/s&gt;</div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>:: good idea</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>:: good idea</div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins style="color: red; font-weight: bold; text-decoration: none;"></ins></div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins style="color: red; font-weight: bold; text-decoration: none;">= Progress =</ins></div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins style="color: red; font-weight: bold; text-decoration: none;"></ins></div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins style="color: red; font-weight: bold; text-decoration: none;">There is a proof-of-concept open-source solution available: [https://github.com/rpoisel/mmc Multimedia File Carver] which focuses currently on the recovery of fragmented multimedia files (movies) or fragmented JPEG files (experimental). The following features have already been implemented:</ins></div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins style="color: red; font-weight: bold; text-decoration: none;">* Multi-Platform support (Linux and Windows)</ins></div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins style="color: red; font-weight: bold; text-decoration: none;">* Graphical User Interface (PySide)</ins></div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins style="color: red; font-weight: bold; text-decoration: none;">* Backend in C (performance critical); GUI in Python</ins></div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins style="color: red; font-weight: bold; text-decoration: none;">* Support for Multi-Processing during the classification phase</ins></div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins style="color: red; font-weight: bold; text-decoration: none;">* Support for Multi-Processing during the reassembly phase (ffmpeg)</ins></div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins style="color: red; font-weight: bold; text-decoration: none;">* Support for The Sleuth Kit (TSK) to identify unallocated blocks</ins></div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins style="color: red; font-weight: bold; text-decoration: none;"></ins></div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins style="color: red; font-weight: bold; text-decoration: none;">Feel free to contact me if you need any further information, if you want to contribute, or if you need help to get it running: [mailto:rainer.poisel@gmail.com Rainer Poisel]. </ins></div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>= License =</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>= License =</div></td></tr> </table>

Dubbaluga http://www.forensicswiki.org/w/index.php?title=Carver_2.0_Planning_Page&diff=8836&oldid=prev 2012-09-06T05:42:18Z

<p></p> <table class='diff diff-contentalign-left'> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr style='vertical-align: top;'> <td colspan='2' style="background-color: white; color:black;">← Older revision</td> <td colspan='2' style="background-color: white; color:black;">Revision as of 05:42, 6 September 2012</td> </tr><tr><td colspan="2" class="diff-lineno">Line 426:</td> <td colspan="2" class="diff-lineno">Line 426:</td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>The MT approach makes for different design decisions</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>The MT approach makes for different design decisions</div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>: It is virtually impossible to turn a non-MT application into an MT application .[[User:Simsong|Simsong]] 06:37, 3 November 2008 (UTC)</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>: It is virtually impossible to turn a non-MT application into an MT application .[[User:Simsong|Simsong]] 06:37, 3 November 2008 (UTC)</div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins style="color: red; font-weight: bold; text-decoration: none;"></ins></div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins style="color: red; font-weight: bold; text-decoration: none;">[[Category:Research]]</ins></div></td></tr> </table>

Joachim Metz http://www.forensicswiki.org/w/index.php?title=Carver_2.0_Planning_Page&diff=8835&oldid=prev 2009-10-10T13:02:06Z

<p>‎<span dir="auto"><span class="autocomment">Ideas</span></span></p> <table class='diff diff-contentalign-left'> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr style='vertical-align: top;'> <td colspan='2' style="background-color: white; color:black;">← Older revision</td> <td colspan='2' style="background-color: white; color:black;">Revision as of 13:02, 10 October 2009</td> </tr><tr><td colspan="2" class="diff-lineno">Line 183:</td> <td colspan="2" class="diff-lineno">Line 183:</td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>::::[[User:Capibara|Rob J Meijer]]&#160; I'm currently working on wrapping TSK filesystem as several loadable modules for OCFA. In OCFA a loadable (tree-graph) module implements the OCFA tree-graph API that basically states 'everything is a tree-graph node'. Possibly you could look at the OCFA treegraph API and module loading interface as an example, or we could work together on changing the API and module loading interface in such a way that it doesn't break OCFA and is usefull for the stand alone carver, but allowing both to use exactly the same tree-graph loadable modules. &#160;</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>::::[[User:Capibara|Rob J Meijer]]&#160; I'm currently working on wrapping TSK filesystem as several loadable modules for OCFA. In OCFA a loadable (tree-graph) module implements the OCFA tree-graph API that basically states 'everything is a tree-graph node'. Possibly you could look at the OCFA treegraph API and module loading interface as an example, or we could work together on changing the API and module loading interface in such a way that it doesn't break OCFA and is usefull for the stand alone carver, but allowing both to use exactly the same tree-graph loadable modules. &#160;</div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>* Extracting/carving data from [[Thumbs.db]]? I've used [[foremost]] for it with some success. [[Vinetto]] has some critical bugs :( [[User:.FUF|.FUF]] 19:18, 28 October 2008 (UTC)</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>* Extracting/carving data from [[Thumbs.db]]? I've used [[foremost]] for it with some success. [[Vinetto]] has some critical bugs :( [[User:.FUF|.FUF]] 19:18, 28 October 2008 (UTC)</div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins style="color: red; font-weight: bold; text-decoration: none;">* Extracting/carving executable binaries, dlls etc [[Volatility]], JE.</ins></div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>==Recursive Carving==</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>==Recursive Carving==</div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>[[User:Joachim Metz|Joachim]] do we want to support (let's call it) 'recursive in file carving' (for now) this is different from embedded files because there is a file system structure in the file and not just another file structure</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>[[User:Joachim Metz|Joachim]] do we want to support (let's call it) 'recursive in file carving' (for now) this is different from embedded files because there is a file system structure in the file and not just another file structure</div></td></tr> </table>

Echo6 http://www.forensicswiki.org/w/index.php?title=Carver_2.0_Planning_Page&diff=8834&oldid=prev 2009-10-09T05:33:07Z

<p>‎<span dir="auto"><span class="autocomment">Existing Code that we have</span></span></p> <table class='diff diff-contentalign-left'> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr style='vertical-align: top;'> <td colspan='2' style="background-color: white; color:black;">← Older revision</td> <td colspan='2' style="background-color: white; color:black;">Revision as of 05:33, 9 October 2009</td> </tr><tr><td colspan="2" class="diff-lineno">Line 383:</td> <td colspan="2" class="diff-lineno">Line 383:</td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>* photorec FS code</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>* photorec FS code</div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>* implementations of FS in Linux/BSD</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>* implementations of FS in Linux/BSD</div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins style="color: red; font-weight: bold; text-decoration: none;">* The tree-graph loadable module support, module loader and loadable modules of the Open Computer Forensics Architecture.</ins></div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>Content support</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>Content support</div></td></tr> </table>

Capibara http://www.forensicswiki.org/w/index.php?title=Carver_2.0_Planning_Page&diff=8833&oldid=prev 2009-10-09T05:31:25Z

<p>‎<span dir="auto"><span class="autocomment">Ideas</span></span></p> <table class='diff diff-contentalign-left'> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr style='vertical-align: top;'> <td colspan='2' style="background-color: white; color:black;">← Older revision</td> <td colspan='2' style="background-color: white; color:black;">Revision as of 05:31, 9 October 2009</td> </tr><tr><td colspan="2" class="diff-lineno">Line 180:</td> <td colspan="2" class="diff-lineno">Line 180:</td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>= Ideas =</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>= Ideas =</div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>* Use as much TSK if possible. Don't carry your own FS implementation the way photorec does.</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>* Use as much TSK if possible. Don't carry your own FS implementation the way photorec does.</div></td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div>:: [[User:Joachim Metz|Joachim]] using TSK as much as possible would not allow to add your own file system support (i.e. mobile phones, memory structures, cap files) I would propose wrapping TSK and using it as much as possible but allow to integrate own FS implementations. &#160;</div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div>:: [[User:Joachim Metz|Joachim]] using TSK as much as possible would not allow to add your own file system support (i.e. mobile phones, memory structures, cap files) I would propose wrapping TSK and using it as much as possible but allow to integrate own FS implementations<ins class="diffchange diffchange-inline">.</ins></div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins class="diffchange diffchange-inline">::::[[User:Capibara|Rob J Meijer]]&#160; I'm currently working on wrapping TSK filesystem as several loadable modules for OCFA. In OCFA a loadable (tree-graph) module implements the OCFA tree-graph API that basically states 'everything is a tree-graph node'. Possibly you could look at the OCFA treegraph API and module loading interface as an example, or we could work together on changing the API and module loading interface in such a way that it doesn't break OCFA and is usefull for the stand alone carver, but allowing both to use exactly the same tree-graph loadable modules</ins>. &#160;</div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>* Extracting/carving data from [[Thumbs.db]]? I've used [[foremost]] for it with some success. [[Vinetto]] has some critical bugs :( [[User:.FUF|.FUF]] 19:18, 28 October 2008 (UTC)</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>* Extracting/carving data from [[Thumbs.db]]? I've used [[foremost]] for it with some success. [[Vinetto]] has some critical bugs :( [[User:.FUF|.FUF]] 19:18, 28 October 2008 (UTC)</div></td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div><del style="color: red; font-weight: bold; text-decoration: none;"></del></div></td><td colspan="2">&#160;</td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>==Recursive Carving==</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>==Recursive Carving==</div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>[[User:Joachim Metz|Joachim]] do we want to support (let's call it) 'recursive in file carving' (for now) this is different from embedded files because there is a file system structure in the file and not just another file structure</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>[[User:Joachim Metz|Joachim]] do we want to support (let's call it) 'recursive in file carving' (for now) this is different from embedded files because there is a file system structure in the file and not just another file structure</div></td></tr> </table>

Capibara http://www.forensicswiki.org/w/index.php?title=Carver_2.0_Planning_Page&diff=8832&oldid=prev 2009-10-06T16:32:56Z

<p>‎<span dir="auto"><span class="autocomment">Background: Why be File System Aware?</span></span></p> <table class='diff diff-contentalign-left'> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr style='vertical-align: top;'> <td colspan='2' style="background-color: white; color:black;">← Older revision</td> <td colspan='2' style="background-color: white; color:black;">Revision as of 16:32, 6 October 2009</td> </tr><tr><td colspan="2" class="diff-lineno">Line 308:</td> <td colspan="2" class="diff-lineno">Line 308:</td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>* Some file systems may store things off sector boundaries. (ReiserFS with tail packing)</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>* Some file systems may store things off sector boundaries. (ReiserFS with tail packing)</div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>* Increasingly file systems have compression (NTFS compression)</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>* Increasingly file systems have compression (NTFS compression)</div></td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div>:: Carving NTFS-compressed (lznt1) files (http://sourceforge.net/projects/revit/files/Documentation/Carving%20NTFS-compressed%20data/Carving%20for%20NTFS%20compressed%20files.pdf/download)</div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div>:: <ins class="diffchange diffchange-inline">[[User:Joachim Metz|Joachim]] </ins>Carving NTFS-compressed (lznt1) files (http://sourceforge.net/projects/revit/files/Documentation/Carving%20NTFS-compressed%20data/Carving%20for%20NTFS%20compressed%20files.pdf/download)</div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>* Carve just the sectors that are not in allocated files.</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>* Carve just the sectors that are not in allocated files.</div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins style="color: red; font-weight: bold; text-decoration: none;">:: [[User:Joachim Metz|Joachim]] sparse (file system) blocks e.g. NTFS cluster blocks</ins></div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>==Tasks that would be required==</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>==Tasks that would be required==</div></td></tr> </table>

Joachim Metz http://www.forensicswiki.org/w/index.php?title=Carver_2.0_Planning_Page&diff=8831&oldid=prev 2009-10-06T16:31:53Z

<p>‎<span dir="auto"><span class="autocomment">Background: Why be File System Aware?</span></span></p> <table class='diff diff-contentalign-left'> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr style='vertical-align: top;'> <td colspan='2' style="background-color: white; color:black;">← Older revision</td> <td colspan='2' style="background-color: white; color:black;">Revision as of 16:31, 6 October 2009</td> </tr><tr><td colspan="2" class="diff-lineno">Line 308:</td> <td colspan="2" class="diff-lineno">Line 308:</td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>* Some file systems may store things off sector boundaries. (ReiserFS with tail packing)</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>* Some file systems may store things off sector boundaries. (ReiserFS with tail packing)</div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>* Increasingly file systems have compression (NTFS compression)</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>* Increasingly file systems have compression (NTFS compression)</div></td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div>:: <del class="diffchange diffchange-inline">ntfs compression </del>(lznt1) ( http://sourceforge.net/projects/revit/files/Documentation/Carving%20NTFS-compressed%20data/Carving%20for%20NTFS%20compressed%20files.pdf/download )</div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div>:: <ins class="diffchange diffchange-inline">Carving NTFS-compressed </ins>(lznt1) <ins class="diffchange diffchange-inline">files </ins>(http://sourceforge.net/projects/revit/files/Documentation/Carving%20NTFS-compressed%20data/Carving%20for%20NTFS%20compressed%20files.pdf/download)</div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>* Carve just the sectors that are not in allocated files.</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>* Carve just the sectors that are not in allocated files.</div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"></td></tr> </table>

Joachim Metz http://www.forensicswiki.org/w/index.php?title=Carver_2.0_Planning_Page&diff=8830&oldid=prev 2009-10-06T16:30:18Z

<p>‎<span dir="auto"><span class="autocomment">Background: Why be File System Aware?</span></span></p> <table class='diff diff-contentalign-left'> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr style='vertical-align: top;'> <td colspan='2' style="background-color: white; color:black;">← Older revision</td> <td colspan='2' style="background-color: white; color:black;">Revision as of 16:30, 6 October 2009</td> </tr><tr><td colspan="2" class="diff-lineno">Line 308:</td> <td colspan="2" class="diff-lineno">Line 308:</td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>* Some file systems may store things off sector boundaries. (ReiserFS with tail packing)</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>* Some file systems may store things off sector boundaries. (ReiserFS with tail packing)</div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>* Increasingly file systems have compression (NTFS compression)</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>* Increasingly file systems have compression (NTFS compression)</div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins style="color: red; font-weight: bold; text-decoration: none;">:: ntfs compression (lznt1) ( http://sourceforge.net/projects/revit/files/Documentation/Carving%20NTFS-compressed%20data/Carving%20for%20NTFS%20compressed%20files.pdf/download )</ins></div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>* Carve just the sectors that are not in allocated files.</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>* Carve just the sectors that are not in allocated files.</div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"></td></tr> </table>

Joachim Metz http://www.forensicswiki.org/w/index.php?title=Carver_2.0_Planning_Page&diff=8829&oldid=prev 2009-01-31T16:06:14Z

<p>‎<span dir="auto"><span class="autocomment">Recursive Carving</span></span></p> <table class='diff diff-contentalign-left'> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr style='vertical-align: top;'> <td colspan='2' style="background-color: white; color:black;">← Older revision</td> <td colspan='2' style="background-color: white; color:black;">Revision as of 16:06, 31 January 2009</td> </tr><tr><td colspan="2" class="diff-lineno">Line 191:</td> <td colspan="2" class="diff-lineno">Line 191:</td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>:--[[User:RB|RB]] 18:45, 2 November 2008 (UTC)</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>:--[[User:RB|RB]] 18:45, 2 November 2008 (UTC)</div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>:: [[User:Simsong|Simsong]] 06:30, 3 November 2008 (UTC) pyflag already does recursive carving. Are we just going to reimplement pyflag as a single executable?</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>:: [[User:Simsong|Simsong]] 06:30, 3 November 2008 (UTC) pyflag already does recursive carving. Are we just going to reimplement pyflag as a single executable?</div></td></tr> <tr><td colspan="2">&#160;</td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div><ins style="color: red; font-weight: bold; text-decoration: none;">::: [[User:Joachim Metz|Joachim]] that could be useful ;-)</ins></div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>==Library Dependencies==</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>==Library Dependencies==</div></td></tr> </table>

Joachim Metz http://www.forensicswiki.org/w/index.php?title=Carver_2.0_Planning_Page&diff=8828&oldid=prev 2009-01-31T16:04:30Z

<p>‎<span dir="auto"><span class="autocomment">Supported File Formats</span></span></p> <table class='diff diff-contentalign-left'> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr style='vertical-align: top;'> <td colspan='2' style="background-color: white; color:black;">← Older revision</td> <td colspan='2' style="background-color: white; color:black;">Revision as of 16:04, 31 January 2009</td> </tr><tr><td colspan="2" class="diff-lineno">Line 120:</td> <td colspan="2" class="diff-lineno">Line 120:</td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>** RAR</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>** RAR</div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>* E-mail files</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>* E-mail files</div></td></tr> <tr><td class='diff-marker'>−</td><td style="background: #ffa; color:black; font-size: smaller;"><div>** <del class="diffchange diffchange-inline">PFF </del>(PST<del class="diffchange diffchange-inline">/</del>OST)</div></td><td class='diff-marker'>+</td><td style="background: #cfc; color:black; font-size: smaller;"><div>** <ins class="diffchange diffchange-inline">[[Personal Folder File </ins>(<ins class="diffchange diffchange-inline">PAB, </ins>PST<ins class="diffchange diffchange-inline">, </ins>OST)<ins class="diffchange diffchange-inline">]]</ins></div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>** MBOX (text based format, base64 content support)</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>** MBOX (text based format, base64 content support)</div></td></tr> <tr><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>* Audio/Video files</div></td><td class='diff-marker'>&#160;</td><td style="background: #eee; color:black; font-size: smaller;"><div>* Audio/Video files</div></td></tr> </table>

Joachim Metz