[Libguestfs] Libguestfs as filesystem forensic tool

noxdafox noxdafox at gmail.com
Wed Mar 2 21:26:08 UTC 2016

On 02/03/16 18:24, Richard W.M. Jones wrote:
> On Wed, Mar 02, 2016 at 05:59:32PM +0200, noxdafox wrote:
>> One of the patches I'm talking about would add TSK (The Sleuth Kit)
>> as a dependency within the appliance.
>> This would bring new APIs such as:
>>   'fls' more powerful 'ls' command allowing to get list of deleted
>> files or timelines at a given path.
>>   'icat' similar to ntfscat-i but it supports multiple FS.
>> Yet I'm not sure whether it's desirable as it is for a narrow use
>> case and on my Debian box TSK is a 12Mb binary.
> Yes that's a rather large dependency.
> However it's possible to use optgroups ["optional" field in
> generator/actions.ml] and subpackaging to mean that end users don't
> need to install this dependency unless they want it.
If I understood correctly, I just need to set the optional field in the 
API and then issue the command: "./configure --with-extra-packages=... " 
> Would need to see the patches before really deciding.
> Rich.

More information about the Libguestfs mailing list