search

sleuthkit / scalpel

Scalpel is an open source data carving tool. It is not being actively maintained.
620 stars 101 forks source link

PreviewMode option in library does not appear to be honored #12

Open atcuno opened 9 years ago

atcuno commented 9 years ago

I was testing using scalpel as a library and looked at libscalpel_test.cpp as a base. I wanted to use the library in preview mode (just get the resulting audit.txt), but can't seem to figure it out.

I first modified line 41 of libscalpel_test.cpp to be:

options.previewMode = TRUE;

instead of FALSE, but with this set the library still carves the files out to disk after pass 1.

I then modified libscalpel_carve_input to only call digimagefile by commenting out the block around the call to carveimagefile. This made the test program segfault.

Any help would be appreciated!

bcarrier commented 9 years ago

Hey Andrew,

I don't think we did anything explicit to disable that feature as part of our changes to make the tool more library friendly and I'm not sure we used that feature. So, I don't know if the feature never worked or if we broke it accidentally. @vicodark may have a better idea about where that code lives.

brian