ATTENTION: The new home of the Digital Forensics Wiki is at https://forensicswiki.xyz/. Yeah, it's a silly name, but it was cheap.
This wiki will be going offline permanently in the near future. An exact date will be announced soon. Thank you for being a part of this community.
If you wish to work on the new forensicswiki, please join the Google Group forensicswiki-reborn

Talk:Fileobject

From ForensicsWiki
Revision as of 09:25, 23 August 2011 by Capibara (Talk | contribs) (sugestion: Use carvpath anotations)

Jump to: navigation, search

sugestion: Use carvpath anotations

I see the use of colons in byte_runs content. Earlier versions of libcarvpath used such a notation, but cross platform concerns resulted in this being changed into the plus sign. I would suggest that the CarvPath annotation format may be a suitable alternative for annotating byte_runs content. This is a straight forward and simple format, for example:

 4096+53248_258048+28672_S1047552

Would be the way to annotate a byte_runs consisting of:

1) A 53248 byte fragment at offset 4096 2) A 28672 byte fragment at offset 258048 3) 1047552 bytes of sparse data.

I don't suggest adding long token notations. Just the '+', '_' and 'S' stuff.