Sorry Richard, I'll explain. As the wikipedia page says[1], "File carving is the process of reassembling computer files from fragments in the absence of <a href="https://en.wikipedia.org/wiki/Filesystem#Metadata" title="Filesystem" class="mw-redirect">filesystem metadata</a>. The carving process makes use of knowledge of common file structures, information contained in files, and <a href="https://en.wikipedia.org/wiki/Heuristics#Computer_science" title="Heuristics" class="mw-redirect">heuristics</a> regarding how filesystems <a href="https://en.wikipedia.org/wiki/File_system_fragmentation" title="File system fragmentation">fragment</a> data. Fusing these three sources of information, a file carving system <a href="https://en.wikipedia.org/wiki/Infer" title="Infer" class="mw-redirect">infers</a> which fragments belong together." I'm also interested in finding deleted files: I don't know how vmware handles filesystem inodes, and if I can recover deleted files. <div class="gmail_quote">2012/3/14 Richard W.M. Jones <<a href="mailto:rjones@redhat.com">rjones@redhat.com</a>> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">[Please keep replies on the mailing list] <div class="im"> On Wed, Mar 14, 2012 at 12:08:52PM +0100, Davide Barbato wrote: > I would ask you a question: there are any possibilities to do a file > carving on those image? I know, you lib is an "userspace" utility, > and you take only a logical "screenshot" of the files, but I think > maybe you can share with me some your considerations about that (I > think you made yourself the same question). </div>I'm afraid I don't understand the question. What is a 'file carving'? A snapshot? Rich. -- Richard Jones, Virtualization Group, Red Hat <a href="http://people.redhat.com/%7Erjones%0Avirt-df" target="_blank">http://people.redhat.com/~rjones virt-df</a> lists disk usage of guests without needing to install any software inside the virtual machine. Supports Linux and Windows. <a href="http://et.redhat.com/%7Erjones/virt-df/" target="_blank">http://et.redhat.com/~rjones/virt-df/</a> </blockquote></div>