[Libguestfs] [PATCH 0/3] added The Sleuth Kit and icat API for downloading inaccessible files
Matteo Cafasso
noxdafox at gmail.com
Mon Mar 7 19:22:17 UTC 2016
The Sleuth Kit is a filesystem forensic tool for accessing disk volumes and extracting digital evidence from.
http://www.sleuthkit.org/
The icat API allows to download a file from a device given its metadata number (inode). It supports multiple filesystem types.
The icat command allows to access to otherwise unreachable files such as filesystem data structures and deleted files which content is still partially or totally stored on the device.
Matteo Cafasso (3):
added The Sleuth Kit package to the appliance
added icat API to retrieve deleted or inaccessible files
added icat API tests
Makefile.am | 1 +
appliance/packagelist.in | 3 ++
configure.ac | 1 +
daemon/Makefile.am | 1 +
daemon/tsk.c | 114 +++++++++++++++++++++++++++++++++++++++++++++++
generator/actions.ml | 13 ++++++
po/POTFILES | 1 +
src/MAX_PROC_NR | 2 +-
tests/tsk/Makefile.am | 26 +++++++++++
tests/tsk/test-icat.sh | 53 ++++++++++++++++++++++
10 files changed, 214 insertions(+), 1 deletion(-)
create mode 100644 daemon/tsk.c
create mode 100644 tests/tsk/Makefile.am
create mode 100755 tests/tsk/test-icat.sh
--
2.7.0
More information about the Libguestfs
mailing list