[Libguestfs] Libguestfs question

[Davide Barbato]

Sorry Richard, I'll explain.
As the wikipedia page says[1], "*File carving* is the process of
reassembling computer files from fragments in the absence of filesystem
metadata <https://en.wikipedia.org/wiki/Filesystem#Metadata>. The carving
process makes use of knowledge of common file structures, information
contained in files, and
heuristics<https://en.wikipedia.org/wiki/Heuristics#Computer_science>regarding
how filesystems
fragment <https://en.wikipedia.org/wiki/File_system_fragmentation> data.
Fusing these three sources of information, a file carving system
infers<https://en.wikipedia.org/wiki/Infer>which fragments belong
together."

I'm also interested in finding deleted files: I don't know how vmware
handles filesystem inodes, and if I can recover deleted files.


2012/3/14 Richard W.M. Jones <rjones at redhat.com>

> [Please keep replies on the mailing list]
>
> On Wed, Mar 14, 2012 at 12:08:52PM +0100, Davide Barbato wrote:
> > I would ask you a question: there are any possibilities to do a file
> > carving on those image? I know, you lib is an "userspace" utility,
> > and you take only a logical "screenshot" of the files, but I think
> > maybe you can share with me some your considerations about that (I
> > think you made yourself the same question).
>
> I'm afraid I don't understand the question.  What is a 'file carving'?
> A snapshot?
>
> Rich.
>
>
> --
> Richard Jones, Virtualization Group, Red Hat
> http://people.redhat.com/~rjones
> virt-df lists disk usage of guests without needing to install any
> software inside the virtual machine.  Supports Linux and Windows.
> http://et.redhat.com/~rjones/virt-df/
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/libguestfs/attachments/20120314/ecc80524/attachment.htm>