in reply to disk image forensics

Many moons ago I ended up writing a mound of code in order to recover data from a busted ext3 file system.

You can use sysopen and sysread directly on /dev/whatever -- you end up reading blocks of bytes, and picking over those either with substr or unpack. I implemented a modest cached buffering system, for obvious reasons. (Of course you can open the device read-only.)

Mind you, after a while I began to wonder if Perl really was the best language to do this in !

Replies are listed 'Best First'.
Re^2: disk image forensics
by Anonymous Monk on Apr 25, 2009 at 08:28 UTC