Difference between revisions of "Talk:Fileobject"
From Forensics Wiki
(Created page with "===sugestion: Use carvpath anotations=== I see the use of colons in byte_runs content. Earlier versions of libcarvpath used such a notation, but cross platform concerns resulted ...") |
|||
| Line 2: | Line 2: | ||
I see the use of colons in byte_runs content. Earlier versions of libcarvpath used such a notation, but cross platform concerns resulted in this being changed into the plus sign. | I see the use of colons in byte_runs content. Earlier versions of libcarvpath used such a notation, but cross platform concerns resulted in this being changed into the plus sign. | ||
I would suggest that the [http://sourceforge.net/apps/mediawiki/carvpath/index.php?title=CarvPath_annotations | CarvPath annotation format] may be a suitable alternative for annotating | I would suggest that the [http://sourceforge.net/apps/mediawiki/carvpath/index.php?title=CarvPath_annotations | CarvPath annotation format] may be a suitable alternative for annotating | ||
| − | byte_runs content. | + | byte_runs content. This is a straight forward and simple format, for example: |
| + | |||
| + | 4096+53248_258048+28672_S1047552 | ||
| + | |||
| + | Would be the way to annotate a byte_runs consisting of: | ||
| + | |||
| + | 1) A 53248 byte fragment at offset 4096 | ||
| + | 2) A 28672 byte fragment at offset 258048 | ||
| + | 3) 1047552 bytes of sparse data. | ||
| + | |||
| + | I don't suggest adding long token notations. Just the '+', '_' and 'S' stuff. | ||
Revision as of 04:24, 23 August 2011
sugestion: Use carvpath anotations
I see the use of colons in byte_runs content. Earlier versions of libcarvpath used such a notation, but cross platform concerns resulted in this being changed into the plus sign. I would suggest that the | CarvPath annotation format may be a suitable alternative for annotating byte_runs content. This is a straight forward and simple format, for example:
4096+53248_258048+28672_S1047552
Would be the way to annotate a byte_runs consisting of:
1) A 53248 byte fragment at offset 4096 2) A 28672 byte fragment at offset 258048 3) 1047552 bytes of sparse data.
I don't suggest adding long token notations. Just the '+', '_' and 'S' stuff.
