robklpd

Pop	52.65
Vit	2.19

CarvFS is a user space FUSE filesystem aimed at computer forensic tools that process disk and/or memory dump images or other large data files. The filesystem allows CarvPath-aware tools to use CarvPath annotations as a way to designate partitions, files, alternate streams, processes etc. within a disk or memory image as a string, making them available trough the filesystem as a pseudo file that can be handed to other tools. This removes the need to copy the information out of the disk image and reduces storage requirements.

Pop	65.73
Vit	1.79

CarvPath (libcarvpath) is a library aimed at computer forensic tools that process disk and/or memory dump images or other large data files. The library allows the creation and manipulation of CarvPath annotations, which are a way to annotate partitions, files, alternate streams, processes etc. within a disk or memory image as a string. Entities within a CarvPath notation can be fragmented and/or nested, and allow for the expression of 'sparse' fragments within an entity. The CarvPath annotations resemble a path string in a filesystem, and thus present a basis for the interaction between computer forensics tools and the CarvPath-based user space file-system, CarvFs.

Pop	13.86
Vit	1.00

LibCarvPathRepository is a library that provides the low level functionality for creating and using a (single, large, growing, sparse) file as an archive of (forensic) media images and other files. LibCarvPathRepository is to be used in conjunction with CarvFS. The CarvFS "raw" module is growing archive aware, making it possible to add (forensic) media images to a mounted raw archive. The LibCarvPathRepository library provides the low level multi-process safe API for appending an entity to the growing archive. Blocks of NULL data are automatically converted to sparse content to keep down the disk usage of the archive. After the image has been added to the archive, the library provides the carvpath of the newly entered image within the archive, making it possible to hand this carvpath to other carvfs aware tools.