Re: [Libguestfs] Libguestfs question
Sorry Richard, I'll explain.
As the wikipedia page says[1], "*File carving* is the process of
reassembling computer files from fragments in the absence of filesystem
metadata <https://en.wikipedia.org/wiki/Filesystem#Metadata>;. The carving
process makes use of knowledge of common file structures, information
contained in files, and
heuristics<https://en.wikipedia.org/wiki/Heuristics#Computer_science&g...
how filesystems
fragment <https://en.wikipedia.org/wiki/File_system_fragmentation> data.
Fusing these three sources of information, a file carving system
infers<https://en.wikipedia.org/wiki/Infer>which fragments belong
together."
I'm also interested in finding deleted files: I don't know how vmware
handles filesystem inodes, and if I can recover deleted files.
2012/3/14 Richard W.M. Jones <rjones(a)redhat.com>
[Please keep replies on the mailing list]
On Wed, Mar 14, 2012 at 12:08:52PM +0100, Davide Barbato wrote:
> I would ask you a question: there are any possibilities to do a file
> carving on those image? I know, you lib is an "userspace" utility,
> and you take only a logical "screenshot" of the files, but I think
> maybe you can share with me some your considerations about that (I
> think you made yourself the same question).
I'm afraid I don't understand the question. What is a 'file carving'?
A snapshot?
Rich.
--
Richard Jones, Virtualization Group, Red Hat
http://people.redhat.com/~rjones
virt-df lists disk usage of guests without needing to install any
software inside the virtual machine. Supports Linux and Windows.
http://et.redhat.com/~rjones/virt-df/
Attachments:
- attachment.html (text/html — 2.4 KB)