[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Support alternative output image formats?
From: |
Christian Franke |
Subject: |
Support alternative output image formats? |
Date: |
Fri, 22 Mar 2024 17:06:03 +0100 |
User-agent: |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 SeaMonkey/2.53.16 |
Are there any plans to support other output formats than raw images?
I recently did some tests with AFF format
(https://github.com/sshock/AFFLIBv3) to provide it for Cygwin as an
enhancement to sleuthkit.
AFF is a segmented format which supports compression, encryption and
signing. Using it instead of raw images could significantly reduce the
size of output images if the disk contents is compressible. AFF
Development packages are available in all major distributions. The
format is also supported by forensic tools like sleuthkit.
To check whether this also works with the seek+write patterns of
ddrescue, I tested with the attached quick proof-of-concept patch. It
only supports basic ddrescue operation without special options. The
extra code I also added to fake random read errors is not included.
It should be straightforward to optionally add alternative output
formats by introducing an abstract output layer with
open/close/seek/write/allocate/flush member functions.
OT: Recently I had a very interesting real word testcase for ddrescue:
A 4TB Seagate ST4000NM0265 with massive seek problems could be
completely recovered by running ddrescue (Cygwin) for about two weeks
24x7, except for one single sector. Required changing ddrescue
parameters several times and reduction of disk's own ERC time (with
smartctl).
--
Regards,
Christian
ddrescue-1.29-pre1-test-afflib.patch
Description: Text document
- Support alternative output image formats?,
Christian Franke <=