You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The diskimageobject would benefit from a few fileobject fields.
filesize - would help with reporting when a disk image is incomplete, when used in conjunction with byte_runs. (E.g. a discontinuous byte_run list could show some sectors weren't captured, like from intentionally partial disk imaging or from read errors.)
hashdigest - frequently reported for disk image provenance.
The text was updated successfully, but these errors were encountered:
Instead of using filesize, mediumsize may be better: A record of the size of the original storage medium.
There may be one more round of name-picking on this. I recall there was something in the Carrier File Systems Forensic Analysis book on some nuance in storage medium size interpretation.
The
diskimageobject
would benefit from a fewfileobject
fields.filesize
- would help with reporting when a disk image is incomplete, when used in conjunction withbyte_runs
. (E.g. a discontinuousbyte_run
list could show some sectors weren't captured, like from intentionally partial disk imaging or from read errors.)hashdigest
- frequently reported for disk image provenance.The text was updated successfully, but these errors were encountered: