The Sleuth Kit is a filesystem forensic tool for accessing disk volumes and extracting
digital evidence from.
http://www.sleuthkit.org/
The icat API allows to download a file from a device given its metadata number (inode). It
supports multiple filesystem types.
The icat command allows to access to otherwise unreachable files such as filesystem data
structures and deleted files which content is still partially or totally stored on the
device.
Matteo Cafasso (3):
added The Sleuth Kit package to the appliance
added icat API to retrieve deleted or inaccessible files
added icat API tests
Makefile.am | 1 +
appliance/packagelist.in | 3 ++
configure.ac | 1 +
daemon/Makefile.am | 1 +
daemon/tsk.c | 114 +++++++++++++++++++++++++++++++++++++++++++++++
generator/actions.ml | 13 ++++++
po/POTFILES | 1 +
src/MAX_PROC_NR | 2 +-
tests/tsk/Makefile.am | 26 +++++++++++
tests/tsk/test-icat.sh | 53 ++++++++++++++++++++++
10 files changed, 214 insertions(+), 1 deletion(-)
create mode 100644 daemon/tsk.c
create mode 100644 tests/tsk/Makefile.am
create mode 100755 tests/tsk/test-icat.sh
--
2.7.0