crazy-fast-image-scan
version 0.006
perl ./crazy_fast_image_scan.pl --image=/dev/sda
This scans the device /dev/sda.
perl ./crazy_fast_image_scan.pl --percent=0.00001 --image=cdrom.img
This scans the image using 0.00001 (0.001 %) bytes of the image.
This script scans devices or images very fast using random sampling and reports what kind of content could be found. This is useful to decide whch image or media could have stuff of interest and allows to prioritize the order of further examinations.
The script uses random sampling and is based on ideas by Simson Garfinkel in a talk http://simson.net/ref/2014/2014-02-21_RPI_Forensics_Innovation.pdf
It calculates the sectors of a given image or device, select n sector samples, seek to the sector positions and read it.
Feel free to contact me if you find errors in statistical calculations or if you have any suggestions to improve the script,
crazy fast image scan
Andreas Romeyke
Script is distributed under GPL 3.0, see LICENSE.txt for details.
Andreas Romeyke <pause@andreas-romeyke.de>
This software is Copyright (c) 2020 by Andreas Romeyke.
This is free software, licensed under:
The GNU General Public License, Version 3, June 2007
To install File::FormatIdentification::RandomSampling, copy and paste the appropriate command in to your terminal.
cpanm
cpanm File::FormatIdentification::RandomSampling
CPAN shell
perl -MCPAN -e shell install File::FormatIdentification::RandomSampling
For more information on module installation, please visit the detailed CPAN module installation guide.