blkcat allows to extract files given their data units (clusters for NTFS, fragments for
ExtX).
This API allows to recover files which icat cannot. For example icat often fails
retrieving deleted files on Ext3/Ext4 filesystems.
As this API works at data unit level, some garbage at the beginning or at the end of the
files is expected.
An example of blkcat can be found here:
http://wiki.sleuthkit.org/index.php?title=FS_Analysis
Matteo Cafasso (2):
added blkcat API
added blkcat API tests
daemon/tsk.c | 27 ++++++++++++++++++++++++
generator/actions.ml | 18 ++++++++++++++++
src/MAX_PROC_NR | 2 +-
tests/tsk/Makefile.am | 3 ++-
tests/tsk/test-blkcat.sh | 53 ++++++++++++++++++++++++++++++++++++++++++++++++
5 files changed, 101 insertions(+), 2 deletions(-)
create mode 100755 tests/tsk/test-blkcat.sh
--
2.7.0