For those of you interested in zero-storage carving,
libcarvpath and carvfs now provide a simple means to
patch zero-storage carving into carving tools.

http://ocfa.sourceforge.net/libcarvpath/

A patch to the sleuthkit is included with carvfs that
includes zero-storage carvpath versions of mmls,dls
and icat.

Currently ewf image files are fully supported, and raw
images partially (no multipart, no auto-digest subtrees).

Have fun,

Rob J Meijer

[ reply ]