2012/3/14 Richard W.M. Jones
<rjones@redhat.com>
I see. Libguestfs could be useful here because it can remove layers
of complexity -- such as partitions, LVs, encryption -- allowing a
file carving tool to work directly on the filesystem. Such a tool
would have to be added to the API, and the only one I'm familiar with
(PhotoRec) is highly interactive and thus not really suitable as-is
for integrating with the libguestfs API. If there is a file carving
tool which works as a library or non-interactive command line tool,
that would be better suited.
There is foremost (and scalpel, a fork) that do file carving non-interactive
VMware doesn't really have anything to do with it - the guest
operating system uses its normal method for deleting files, and those
can be recovered using ordinary tools (eg. ext2undelete,
ntfsundelete). You just need to add those tools into the libguestfs
API. See this page for a guide to adding new APIs:
http://libguestfs.org/guestfs.3.html#extending_libguestfs
Actually ext2undelete and ntfsundelete are both on the todo list, and
have been for some time.
Rich.
Ok, I'll check it out right now. Thanks