Difference between pages "Talk:Fileobject" and "Jump Lists"

From Forensics Wiki
(Difference between pages)
Jump to: navigation, search
 
(Initial stub)
 
Line 1: Line 1:
===sugestion: Use carvpath anotations===
+
{{expand}}
I see the use of colons in byte_runs content. Earlier versions of libcarvpath used such a notation, but cross platform concerns resulted in this being changed into the plus sign.
+
'''Jump Lists''' are a feature found in Windows 7.
I would suggest that the [http://sourceforge.net/apps/mediawiki/carvpath/index.php?title=CarvPath_annotations  CarvPath annotation format] may be a suitable alternative for annotating
+
byte_runs content. This is a straight forward and simple format, for example:
+
+
  4096+53248_258048+28672_S1047552
+
  
Would be the way to annotate a byte_runs consisting of:
+
[[List of Jump List IDs]]
 +
17d3eb086439f0d7 TrueCrypt 7.0a
 +
adecfb853d77462a MSWord 2007
 +
c71ef2c372d322d7 PGP Desktop 10
 +
cdf30b95c55fd785 MSExcel 2007
 +
f5ac5390b9115fdb MSPowerPoint 2007
  
1) A 53248 byte fragment at offset 4096
+
12dc1ea8e34b5a6 MSPaint 6.1
 +
431a5b43435cc60b Python (.pyc)
 +
469e4a7982cea4d4 ? (.job)
 +
500b8c1d5302fc9c (.pyw)
 +
50620fe75ee0093 VMWare Player 3.1.4
 +
65009083bfa6a094 (app launched via XPMode)
 +
7e4dca80246863e3 Control Panel (?)
 +
83b03b46dcd30a0e iTunes 10
 +
b0459de4674aab56 (.vmcx)
  
2) A 28672 byte fragment at offset 258048
 
  
3) 1047552 bytes of sparse data.
+
{{Windows}}
 
+
I don't suggest adding long token notations. Just the '+', '_' and 'S' stuff, and possibly the '/' for nesting purposes.
+

Revision as of 08:17, 23 August 2011

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

Jump Lists are a feature found in Windows 7.

List of Jump List IDs 17d3eb086439f0d7 TrueCrypt 7.0a adecfb853d77462a MSWord 2007 c71ef2c372d322d7 PGP Desktop 10 cdf30b95c55fd785 MSExcel 2007 f5ac5390b9115fdb MSPowerPoint 2007

12dc1ea8e34b5a6 MSPaint 6.1 431a5b43435cc60b Python (.pyc) 469e4a7982cea4d4 ? (.job) 500b8c1d5302fc9c (.pyw) 50620fe75ee0093 VMWare Player 3.1.4 65009083bfa6a094 (app launched via XPMode) 7e4dca80246863e3 Control Panel (?) 83b03b46dcd30a0e iTunes 10 b0459de4674aab56 (.vmcx)Windows