Greetings, I'm playing around an idea and I'd like to ask you some questions.
I'd like to extract the MFT table from a disk image file. The idea is to employ it to build a sort of reverse lookup table which, given a cluster, could retrieve the corresponding file with the related metadata.
Such table could be used to optimize the analysis of disk snapshots in order to collect the changes which happened on the disk. As the disk snapshots contains only the new or modified clusters, I could avoid exploring the whole FS content and focus on what has really changed on disk.
Did you explore the concept anyhow? Is there a way I can use libguestfs to locate and extract the MFT table from a disk image?
Thank you. _______________________________________________ Libguestfs mailing list Libguestfs@redhat.com https://www.redhat.com/mailman/listinfo/libguestfs
