in reply to disk image forensics

The problem with a disk image is that it's binary data in a format that depends on many factors.

What's the filesystem? That determines many other things. How are attributes, ownership, and timestamps stored? Is there journaling involved? If so, what part of the data is the journal?

What's the block size? Many filesystems allow different block sizes to be configured.

What's the byte order of the stored data? Is it determined by the filesystem spec, or does the filesystem use whatever is native to the platform?

The best reference for a filesystem is often the implementation of the FS driver for the platform on which the image was created. IOW, it's usually easiest to mount the file system (possibly read-only) and look at the files and directories that way.

Perl could certainly be used to read and manipulate data according to a filesystem specification, but you're looking at reinventing many very intricate wheels.