Re: [Libguestfs] [PATCH v2 0/2] Added download_blocks API

On 20/07/16 17:04, Pino Toscano wrote: Current focus is deleted/unaccessible files retrieval as I believe this is the most interesting feature for libguestfs users. A forensic workflow example would be: * start libguestfs and identify the disk partition where your data is * run filesystem_walk to get list of files which are visible within that disk partition * if the deleted file you want to recover is in that list, you'll get its inode * use download_inode to try recovering the deleted file For Ext3+ filesystems the thing is a bit more complicated. These filesystems remove the block links when the file gets deleted making its recovery more difficult. Only choice is carving out the data and download_blocks is the function which allows you to do so. What the User needs is an API capable of mapping disk blocks to files and then he/she will be able to recover them using download_blocks. Most of the APIs I am introducing are inspired from TSK ones. Here's a more detailed example on how to retrieve deleted data from disks. http://wiki.sleuthkit.org/index.php?title=FS_Analysis Afterwards, we could focus on more interesting topics such as evidence gathering and forensics analysis. Automating it is a challenging topic as most of the "evidence reconstruction" requires careful thinking as the data might have been tampered or obfuscated. Yet there are quite interesting features we can add which could support forensic analysis as well as cloud security solutions. Think about libguestfs scanning Open Stack instance disks to detect anomalies within cloud deployments. libguestfs is the perfect tool as it easily allows to abstract both the disk virtualisation technology (qcow2, vmdk etc..) and the guest Operating System. You can find an example on libguestfs-based VM scanning solution in here: https://github.com/noxdafox/vminspect If you check the "timeline" command implementation, you'll find few of the new APIs in use. This is a good question, I was thinking about a blog post to start with but a paragraph in the documentation sounds good as well. Let me know if you need help for that, I can provide some real-life example.