Add new block range evidence types
@dfjxs is already working on this.
Since Jun 30, 2022.
- Dominant language
- Python
- Stars
- 795
- Forks
- 172
- PR merge metrics
- No merged PRs in 30d
Description
We should add new evidence types (e.g. RawDiskBlocks) for disk block ranges so that we can have jobs further parallelize processing. Jobs would just need to know the size of the disk and could then split a disk into block ranges and create a Task for each of those. Then the JobFinalize Task could be used to combine the outputs from each of the Tasks. This would speed up strings and possibly bulk_extractor processing.
The new evidence would probably have the original disk as the parent so that it can use the same pre-processors and then the new child evidence type could have a preprocessor that just loopback mounts the disk at the offset of the start of the block range (not sure what the best way to handle the end of the block range though).
We do have to be careful because it could miss things that cross block range boundaries, but apparently bulk_extractor can also process block ranges and has some method for overlapping the block ranges so it is less likely to miss things. We should take a look at what they do with that to see if it would be applicable here.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.