Filesystem awareness in Klennet Carver

A file carver is supposed to be filesystem-agnostic. That is, the carving software is tailored to match file formats, not filesystems. It is not supposed to take any filesystem metadata into account, for the metadata may be missing, damaged, or incorrect.

Klennet Carver, however, has a concept of clusters. Clusters are the blocks of several consecutive sectors, used in filesystems to reduce management overhead. Klennet Carver does also require cluster sizes to be the power of two.

Working with clusters instead of sectors allows me to improve carving speed because number of possible combinations to work through decreases significantly. However, there are certain drawbacks:

  • Filesystems in which cluster sizes are not required to be a power of two cannot be analyzed properly. I can only think of one though, namely original HFS.
  • Complex configurations involving block-based RAID cannot be analyzed directly from disks if filesystem clusters are not aligned with RAID blocks (not sure how useful it can be anyway).
  • On tailpacking filesystems, tails of files most likely cannot be extracted. Tailpacking filesystems are rare in the wild, though (reiserFS maybe?).

Created Wednesday, October 11, 2017

Updated 20 May 2018