Difference between pages "Raw Image Format" and "Libsmraw"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
 
 
Line 1: Line 1:
The RAW Image Format is used to store a disk or volume image.
+
{{Infobox_Software |
 +
  name = libsmraw |
 +
  maintainer = [[Joachim Metz]] |
 +
  os = [[Linux]], [[FreeBSD]], [[NetBSD]], [[OpenBSD]], [[Mac OS X]], [[Windows]] |
 +
  genre = {{Disk imaging}} |
 +
  license = {{LGPL}} |
 +
  website = [https://code.google.com/p/libsmraw/ code.google.com/p/libsmraw/] |
 +
}}
  
== File types ==
+
The '''libsmraw''' package contains a library and applications to read and write (split) RAW storage media bitstream copies.
Some variants of the RAW Image Format split the data among multiple segment files, which is also known as split RAW.
+
Libsmraw contains supports for multiple (split) RAW naming schemes.
  
There are various naming schemes for RAW Image Format files, some of the more common used for disk or volume images are:
+
== History ==
* PREFIX.dd
+
* PREFIX.dmg
+
* PREFIX.img
+
* PREFIX.raw
+
* PREFIX.0 - PREFIX.#; variations: starting with either 0 or 1, consisting of multiple digits e.g. PREFIX.000
+
* PREFIX0 - PREFIX#; variations: starting with either 0 or 1, consisting of multiple digits e.g. PREFIX000
+
* PREFIXaa - PREFIXzz; variations: consisting of more letters e.g. PREFIX.aaa
+
* PREFIX.1of5 - PREFIX.5of5; variations: consisting of multiple segment files
+
* PREFIX001.asb - PREFIX###.asb
+
* PREFIX-f001.vmdk - PREFIX-f###.vmdk; variations: starting with 001
+
  
 +
Libsmraw was created by [[Joachim Metz]] in 2010, while working for [http://en.hoffmannbv.nl/ Hoffmann Investigations].
 +
Libsmraw is a rewrite of earlier work for the proof-of-concept multi-threaded imager: GNOME Forensic Imager.
  
Note that there are also RAW Image Formats specific to the storage media, e.g. RAW optical disc image.
+
== Tools ==
 +
The '''libsmraw''' package contains the following tools:
 +
* '''smrawmount''', which FUSE mounts (split) RAW image files.
  
These often are accompanied by a table of contents file often in the [[CUE Sheet format]], e.g.
+
The '''libsmraw''' package also contains the following bindings:
* BIN/CUE
+
* '''pysmraw''', bindings for Python.
* ISO/CUE
+
  
== Contents ==
+
== Examples ==  
The RAW Image Format is basically a bit-for-bit copy of the RAW data of either the disk or the volume, without any additions or deletions.
+
  
There is no [[metadata]] stored in RAW Image Format files. However sometimes the metadata is stored in additional files.
+
FUSE mounting a split RAW image (libsmraw 20110916 or later)
 +
<pre>
 +
smrawmount image.raw.000 mount_point
 +
</pre>
  
The RAW Image Format was original used by [[dd]], but is supported by most of the computer forensics applications.
+
Or:
 +
<pre>
 +
smrawmount image.raw.??? mount_point
 +
</pre>
  
== See Also ==
+
== Also See ==
* [[Disk Images]]
+
[[Raw_Image_Format | RAW Image format]]
  
== Tools ==
+
== External Links ==
* [[Dd|dd]]
+
* [[dc3dd]]
+
* [[dcfldd]]
+
* [[dd_rescue]]
+
* [[ddrescue]]
+
  
[[Category:Forensics File Formats]]
+
* [https://code.google.com/p/libsmraw/ Project site]

Revision as of 08:45, 21 June 2014

libsmraw
Maintainer: Joachim Metz
OS: Linux, FreeBSD, NetBSD, OpenBSD, Mac OS X, Windows
Genre: Disk imaging
License: LGPL
Website: code.google.com/p/libsmraw/

The libsmraw package contains a library and applications to read and write (split) RAW storage media bitstream copies. Libsmraw contains supports for multiple (split) RAW naming schemes.

History

Libsmraw was created by Joachim Metz in 2010, while working for Hoffmann Investigations. Libsmraw is a rewrite of earlier work for the proof-of-concept multi-threaded imager: GNOME Forensic Imager.

Tools

The libsmraw package contains the following tools:

  • smrawmount, which FUSE mounts (split) RAW image files.

The libsmraw package also contains the following bindings:

  • pysmraw, bindings for Python.

Examples

FUSE mounting a split RAW image (libsmraw 20110916 or later)

smrawmount image.raw.000 mount_point

Or:

smrawmount image.raw.??? mount_point

Also See

RAW Image format

External Links