blkcat allows to extract files given their data units (clusters for NTFS, fragments for ExtX).
This API allows to recover files which icat cannot. For example icat often fails retrieving deleted files on Ext3/Ext4 filesystems. As this API works at data unit level, some garbage at the beginning or at the end of the files is expected. An example of blkcat can be found here: http://wiki.sleuthkit.org/index.php?title=FS_Analysis Matteo Cafasso (2): added blkcat API added blkcat API tests daemon/tsk.c | 27 ++++++++++++++++++++++++ generator/actions.ml | 18 ++++++++++++++++ src/MAX_PROC_NR | 2 +- tests/tsk/Makefile.am | 3 ++- tests/tsk/test-blkcat.sh | 53 ++++++++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 101 insertions(+), 2 deletions(-) create mode 100755 tests/tsk/test-blkcat.sh -- 2.7.0 _______________________________________________ Libguestfs mailing list [email protected] https://www.redhat.com/mailman/listinfo/libguestfs
