in reply to disk image forensics
Perl's not really suited to low-level stuff, except maybe for the regexing of the binary data you pump out. I know an old trick to read a bios is to use dd (on linux)
You probably can use this same technique on raw disks, likedd if=/dev/mem bs=32k skip=31 count=1 | strings -n 10 | grep -i bios
To put it in Perl, you probably can run it thru a piped open, and regex the outputdd if=/dev/hdb0 | strings -n 10 | grep -i secretkey
my $pid = open(FH, " dd if=/dev/hdb0 | ") or die "$!\n"; while( my $rrv = sysread( FH, my $buf, 1012 ) ){ #regex your $buf here for whatever #of course you will have to worry about missing full strings #on your chunk boundaries, so you may need to save a few #hunderd bytes of each $buf to add to the next one }
|
|---|