Re: [sleuthkit-developers] Some questions

[Michael C. <mic...@ne...>]

On Wed, Jun 21, 2006 at 01:38:13PM +0200, kenshin wrote:
> Other suggestion, I think that open stdin is better that open a file.
> For example "fls < ext3fs.img" is better because you could for example
> make "bunzip2 -c ext3fs.img.bz2| fls" or other combinations. With this
> you have small images and if you have a good cpu you could scan
> images faster :)

kenshin, Its impossible for fls to use stdin since it needs to seek in the
input file which means it cant use a pipe (you could still do fls < ext3fs.img
because thats not a pipe, but not the second example). Also for normal images
you certainly couldnt do bunzip2 -c ext3fs.img.bz2| fls because the image would
take a huge length of time to decompress for a single shot of fls. If you want
to handle compressed images you better use ewf, eff or sgzip formats.

Michael.