in reply to disk image forensics

First of all, only test this stuff on spare, unimportant partitions. I warned you!!!

Perl's not really suited to low-level stuff, except maybe for the regexing of the binary data you pump out. I know an old trick to read a bios is to use dd (on linux)

dd if=/dev/mem bs=32k skip=31 count=1 | strings -n 10 | grep -i bios
You probably can use this same technique on raw disks, like
dd if=/dev/hdb0 | strings -n 10 | grep -i secretkey
To put it in Perl, you probably can run it thru a piped open, and regex the output
my $pid = open(FH, " dd if=/dev/hdb0 | ") or die "$!\n"; while( my $rrv = sysread( FH, my $buf, 1012 ) ){ #regex your $buf here for whatever #of course you will have to worry about missing full strings #on your chunk boundaries, so you may need to save a few #hunderd bytes of each $buf to add to the next one }

I'm not really a human, but I play one on earth Remember How Lucky You Are