Low level hard drive reading
jeremiah.dodds at gmail.com
Thu Apr 2 14:16:21 CEST 2009
On Thu, Apr 2, 2009 at 12:36 PM, Gabriel <dunmer at dreams.sk> wrote:
> I have to write linux application that will analyze disk/partition (ext3
> filesystem) on really low level. It has to find/analyze files on the disk by
> reading disk blocks to analyze file's headers to find out file type and
> then blocks related to file to get file content. The second part have to
> be searching deleted files by this blocks reading (is this even possible?)
> Can i do this in python? For example can i open disk image file and read it
> block by block?
> Or is there even better solution? .) I tried search web but I wasn't
> I will appreciate any help. Thank you in advice..
I may be wrong, but I'd assume that you could just read by block size,
opening the file that represents the disk in /dev (/dev/sda or similar). I
don't see why you would want to do that to find out file type/headers
though. You should be able to see the contents of "deleted" files that
haven't been (entirely) overwritten on disk - I believe that when you delete
a file, you really just delete the inode, or reference that tells the
filesystem that there's a file there.
Someone else who's keener on the details of these things will probably come
with better information.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Python-list