Difference between pages "Pdfinfo" and "Tsk-cp"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(Infobox and categories.)
 
 
Line 1: Line 1:
{{Infobox_Software |
+
Tsk-cp is a set of [[LibCarvPath]] aware versions of [[Sleuthkit]] tools, that are for use together with the
  name = pdfinfo |
+
normal versions of the other sleuthkit tools in the process of doing [[zero storage carving]].
  maintainer = [[Foo labs]] |
+
  os = {{Cross-platform}} |
+
  genre = {{Metadata}} |
+
  license = {{GPL}} |
+
  website = [http://www.foolabs.com/xpdf/ foolabs.com/xpdf/] |
+
}}
+
  
'''pdfinfo''' is a small utility which shows (parts of) the metadata stored in [[PDF]] files. It is part of the [[xpdf]] package.
+
The tools are:
  
== Example ==
+
* mmls-cp : A CarvPath based version of mmls for listing a partitioned carvpath disk images as a list of partition carvpaths.
 +
* dls-cp : A CarvPath based version of dls for listing all continuous unallocated fragments of a carvpath partition holding a filesystem as a list of unallocated block carvpaths.
 +
* icat-cp : A CarvPath based version of icat that instead of copying out the data of an inode within a carvpath partition holding a filesystem as the carvpath of the file and the carvpath of the [[file slack]].
  
$ pdfinfo nsa-redact.pdf
+
The carvpaths output by dls-cp can be used as the input of a CarvPath aware carving tool.
Title:          Redacting with Confidence:  How to Safely Publish Sanitized Reports Converted from Word to PDF
+
Subject:        I333-015R-2005
+
Keywords:      word, pdf, redaction, metadata
+
Author:        SNAC
+
Creator:        activePDF DocConverter
+
Producer:      5D PDFLib
+
CreationDate:  Tue Jan 10 11:15:26 2006
+
ModDate:        Fri Jan 20 09:05:43 2006
+
Tagged:        no
+
Pages:          14
+
Encrypted:      no
+
Page size:      612 x 792 pts (letter)
+
File size:      681417 bytes
+
Optimized:      yes
+
PDF version:    1.3
+
  
The <tt>-meta</tt> command line option shows some more metadata (in [[XML]] format).
+
== See Also ==
 +
* [Open Computer Forensics Architecture]

Revision as of 01:30, 11 August 2012

Tsk-cp is a set of LibCarvPath aware versions of Sleuthkit tools, that are for use together with the normal versions of the other sleuthkit tools in the process of doing zero storage carving.

The tools are:

  • mmls-cp : A CarvPath based version of mmls for listing a partitioned carvpath disk images as a list of partition carvpaths.
  • dls-cp : A CarvPath based version of dls for listing all continuous unallocated fragments of a carvpath partition holding a filesystem as a list of unallocated block carvpaths.
  • icat-cp : A CarvPath based version of icat that instead of copying out the data of an inode within a carvpath partition holding a filesystem as the carvpath of the file and the carvpath of the file slack.

The carvpaths output by dls-cp can be used as the input of a CarvPath aware carving tool.

See Also

  • [Open Computer Forensics Architecture]