Difference between revisions of "Talk:Fileobject"

From Forensics Wiki
Jump to: navigation, search
(Created page with "===sugestion: Use carvpath anotations=== I see the use of colons in byte_runs content. Earlier versions of libcarvpath used such a notation, but cross platform concerns resulted ...")
 
 
(3 intermediate revisions by one user not shown)
Line 1: Line 1:
 
===sugestion: Use carvpath anotations===
 
===sugestion: Use carvpath anotations===
 
I see the use of colons in byte_runs content. Earlier versions of libcarvpath used such a notation, but cross platform concerns resulted in this being changed into the plus sign.
 
I see the use of colons in byte_runs content. Earlier versions of libcarvpath used such a notation, but cross platform concerns resulted in this being changed into the plus sign.
I would suggest that the [http://sourceforge.net/apps/mediawiki/carvpath/index.php?title=CarvPath_annotations | CarvPath annotation format] may be a suitable alternative for annotating
+
I would suggest that the [http://sourceforge.net/apps/mediawiki/carvpath/index.php?title=CarvPath_annotations CarvPath annotation format] may be a suitable alternative for annotating
byte_runs content.
+
byte_runs content. This is a straight forward and simple format, for example:
 +
 +
  4096+53248_258048+28672_S1047552
 +
 
 +
Would be the way to annotate a byte_runs consisting of:
 +
 
 +
1) A 53248 byte fragment at offset 4096
 +
 
 +
2) A 28672 byte fragment at offset 258048
 +
 
 +
3) 1047552 bytes of sparse data.
 +
 
 +
I don't suggest adding long token notations. Just the '+', '_' and 'S' stuff, and possibly the '/' for nesting purposes.

Latest revision as of 05:21, 23 August 2011

sugestion: Use carvpath anotations

I see the use of colons in byte_runs content. Earlier versions of libcarvpath used such a notation, but cross platform concerns resulted in this being changed into the plus sign. I would suggest that the CarvPath annotation format may be a suitable alternative for annotating byte_runs content. This is a straight forward and simple format, for example:

 4096+53248_258048+28672_S1047552

Would be the way to annotate a byte_runs consisting of:

1) A 53248 byte fragment at offset 4096

2) A 28672 byte fragment at offset 258048

3) 1047552 bytes of sparse data.

I don't suggest adding long token notations. Just the '+', '_' and 'S' stuff, and possibly the '/' for nesting purposes.