Difference between revisions of "Tsk-cp"

From ForensicsWiki
Jump to: navigation, search
(New page: Tsk-cp is a set of LibCarvPath aware versions of Sleuthkit tools, that are for use together with the normal versions of the other sleuthkit tools in the process of doing [[zero sto...)
 
 
(2 intermediate revisions by 2 users not shown)
Line 9: Line 9:
  
 
The carvpaths output by dls-cp can be used as the input of a CarvPath aware carving tool.
 
The carvpaths output by dls-cp can be used as the input of a CarvPath aware carving tool.
 +
 +
== See Also ==
 +
* [[Open Computer Forensics Architecture]]

Latest revision as of 01:31, 11 August 2012

Tsk-cp is a set of LibCarvPath aware versions of Sleuthkit tools, that are for use together with the normal versions of the other sleuthkit tools in the process of doing zero storage carving.

The tools are:

  • mmls-cp : A CarvPath based version of mmls for listing a partitioned carvpath disk images as a list of partition carvpaths.
  • dls-cp : A CarvPath based version of dls for listing all continuous unallocated fragments of a carvpath partition holding a filesystem as a list of unallocated block carvpaths.
  • icat-cp : A CarvPath based version of icat that instead of copying out the data of an inode within a carvpath partition holding a filesystem as the carvpath of the file and the carvpath of the file slack.

The carvpaths output by dls-cp can be used as the input of a CarvPath aware carving tool.

See Also