Re: [sleuthkit-users] Photorec carver

[Brian C. <ca...@sl...>]

On Feb 17, 2015, at 3:01 PM, Nanni Bassetti <dig...@gm...> wrote:

> It could be useful to run Photorec only on the unallocated space

It does.  

> and the a special module for deleting the duplicated files by hash comparison.
> Deleted files and carved files compared and the carved files duplicated deleted...

Hmm, that could be interesting, but a bit challenging with the Autopsy pipelines.  Files aren't hashed until they are added to the central database and scheduled for analysis.  Hash calc is the first step in the pipeline.  

We could do the calculation in the PhotoRec module, it's just another I/O round trip and a database query, so the question is if carving generates so many duplicate hits that it is worth this effort.  

Thoughts?



> 
> I made this procedure in KS http://articles.forensicfocus.com/2013/04/23/ks-an-open-source-bash-script-for-indexing-data/ 
> I hope this could be a nice advice ;)
> 
> -- 
> Dr. Nanni Bassetti
> http://www.nannibassetti.com
> CAINE project manager - http://www.caine-live.net
> ------------------------------------------------------------------------------
> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
> with Interactivity, Sharing, Native Excel Exports, App Integration & more
> Get technology previously reserved for billion-dollar corporations, FREE
> http://pubads.g.doubleclick.net/gampad/clk?id=190641631&iu=/4140/ostg.clktrk_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org