Difference between pages "Gpart" and "Tsk-cp"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
m
 
(New page: Tsk-cp is a set of LibCarvPath aware versions of Sleuthkit tools, that are for use together with the normal versions of the other sleuthkit tools in the process of doing [[zero sto...)
 
Line 1: Line 1:
{{Infobox_Software |
+
Tsk-cp is a set of [[LibCarvPath]] aware versions of [[Sleuthkit]] tools, that are for use together with the
  name = gpart |
+
normal versions of the other sleuthkit tools in the process of doing [[zero storage carving]].
  maintainer = [[Michail Brzitwa]] |
+
  os = {{Linux}}, {{FreeBSD}} |
+
  genre = [[Partitions]] |
+
  license = {{GPL}} |
+
  website = [http://www.stud.uni-hannover.de/user/76201/gpart/ stud.uni-hannover.de/user/76201/gpart/] |
+
}}
+
  
'''gpart''' is a tool which guesses the primary [[partition table]] of a PC-type [[disk drive]].
+
The tools are:
 +
 
 +
* mmls-cp : A CarvPath based version of mmls for listing a partitioned carvpath disk images as a list of partition carvpaths.
 +
* dls-cp : A CarvPath based version of dls for listing all continuous unallocated fragments of a carvpath partition holding a filesystem as a list of unallocated block carvpaths.
 +
* icat-cp : A CarvPath based version of icat that instead of copying out the data of an inode within a carvpath partition holding a filesystem as the carvpath of the file and the carvpath of the [[file slack]].
 +
 
 +
The carvpaths output by dls-cp can be used as the input of a CarvPath aware carving tool.

Revision as of 14:49, 12 December 2008

Tsk-cp is a set of LibCarvPath aware versions of Sleuthkit tools, that are for use together with the normal versions of the other sleuthkit tools in the process of doing zero storage carving.

The tools are:

  • mmls-cp : A CarvPath based version of mmls for listing a partitioned carvpath disk images as a list of partition carvpaths.
  • dls-cp : A CarvPath based version of dls for listing all continuous unallocated fragments of a carvpath partition holding a filesystem as a list of unallocated block carvpaths.
  • icat-cp : A CarvPath based version of icat that instead of copying out the data of an inode within a carvpath partition holding a filesystem as the carvpath of the file and the carvpath of the file slack.

The carvpaths output by dls-cp can be used as the input of a CarvPath aware carving tool.