sleuthkit-developers

[sleuthkit-developers] RawFs patch

[Paul B. <ba...@fo...>]

Brian,

I wrote a small patch for Sleuthkit 1.67 that makes it possible to use =
Raw fs in a generic manner (Similar to fatfs, extfs, etc)

It makes it possible to use fs_open() to open raw images... Most =
functions will return error if called on it, but this way external tools
(Like searchtools) do not need to make exceptions to use raw file =
systems... Maybe something similar should be done for swap (Perhaps it =
can also use rawfs)...

It is small and first version, but it works for me (what I need at the =
moment is only access to an FS_INFO object with the size inside and thus =
the possiblility to call fs_read_random)..

Could you integrate this patch in Sleuthkit 1.68 and expand it where =
necessary?

Paul Bakker

[sleuthkit-developers] Re: RawFs patch

[Brian C. <ca...@sl...>]

On Mar 2, 2004, at 8:38 AM, Paul Bakker wrote:

> I wrote a small patch for Sleuthkit 1.67 that makes it possible to use 
> Raw fs in a generic manner (Similar to fatfs, extfs, etc)

This is a really good idea.  I can't believe I didn't do this earlier.  
It is much better than the hacks that I had for adding support for swap 
and raw into the 'dcat' tool.   This is a real easy patch to work in 
and I'll put this and a swap one into the next release.

thanks,
brian