ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.
sugestion: Use carvpath anotations
I see the use of colons in byte_runs content. Earlier versions of libcarvpath used such a notation, but cross platform concerns resulted in this being changed into the plus sign. I would suggest that the CarvPath annotation format may be a suitable alternative for annotating byte_runs content. This is a straight forward and simple format, for example:
Would be the way to annotate a byte_runs consisting of:
1) A 53248 byte fragment at offset 4096
2) A 28672 byte fragment at offset 258048
3) 1047552 bytes of sparse data.
I don't suggest adding long token notations. Just the '+', '_' and 'S' stuff.