CarvFS is a user space FUSE filesystem aimed at computer forensic tools that process disk and/or memory dump images or other large data files. The filesystem allows CarvPath-aware tools to use CarvPath annotations as a way to designate partitions, files, alternate streams, processes etc. within a disk or memory image as a string, making them available trough the filesystem as a pseudo file that can be handed to other tools. This removes the need to copy the information out of the disk image and reduces storage requirements.
|Operating Systems||Linux BSD|
Release Notes: The usage of CarvFS in the open computer forensics architecture (OCFA) led to the discovery of a multitude of bugs that mostly have minor impact when using CarvFS on a single tool basis but that became important when scaled up. This release fixes the bugs that were found during OCFA/CarvFS integration. Further, as a result of the integration of LibCarvPath and CarvFS into OCFA, the CarvFS version numbers have been changed as a convenience to OCFA packaging. The changes between 1.0.0 and 2.3.0 are thus not as big as the version number may lead you to believe.
Release Notes: This release adds a new CarvFS module for mounting raw local block devices intended for triage tools and applications.
Release Notes: Auto flattening was introduced. Nested file carvpaths now resolve to symbolic links that point to the shortest non-nested flattened notation of this carvpath. The new CarvPath API is now used. CarvFS was made to explicitly run as a single threaded FUSE process to avoid bugs resulting from lack of thread safety in the CarvPath library and any image file type module that may be loaded. The build system was moved from autotools to cmake.