[sleuthkit-users] JNI for getting specific file allocated clusters/sectors

[Luís F. N. <lfc...@gm...>]

We wonder if it was possible to expose such feature to java developers, but
I do not known enough about sleuthkit C code to evaluate if it is too
difficult or not. Can some sleuthkit expert give some direction? We are
developing a java carving tool and this feature would be very useful,
because we can only mark the carved file range in the image, instead of
exporting the carved file contents to somewhere (much slower), as we have
already successfully done with unallocated clusters accessed through
sleuthkit java bindings after populating sqlite db. But we want to do this
lightweight carving on pagefile, hiberfil, shadow copies and other
allocated files, which file ranges are not currently accessible through
java bindings TSK api. We think this great feature could be very useful for
scalpel and other forensic applications too.

Regards,
Luis Nassif