Menu

CarvFS zero-storage carving filesystem and sleuthkit patches

The CarvFS filesystem is a pseudo filesystem used to
represent carved fragments in image files (currently ewf files and still limmited support for raw dd files) as zero-storage files. This first carvfs release also contains a patch to the sleuthkit that holds carvpath versions of mmls,dls and icat, so using these tools in a zero-storage way becomes possible. The upcomming version of OCFA will include an updated sleuthkit wrapper module that uses these tools in order to greatly limit ocfa storage requirements.

Posted by KLPD TDE development team 2006-11-09

Log in to post a comment.