in reply to disk image forensics
Many moons ago I ended up writing a mound of code in order to recover data from a busted ext3 file system.
You can use sysopen and sysread directly on /dev/whatever -- you end up reading blocks of bytes, and picking over those either with substr or unpack. I implemented a modest cached buffering system, for obvious reasons. (Of course you can open the device read-only.)
Mind you, after a while I began to wonder if Perl really was the best language to do this in !
|
|---|
| Replies are listed 'Best First'. | |
|---|---|
|
Re^2: disk image forensics
by Anonymous Monk on Apr 25, 2009 at 08:28 UTC |