First Last Prev Next    No search results available      Search page      Enter new bug
Bug#: 70643
Alias:
Product:
Component:
Status: RESOLVED
Resolution: FIXED
Assigned To: Forensics Herd <forensics@gentoo.org>
Hardware:
OS:
Version:
Priority:
Severity:
Reporter: Daniel Evers <dermojo@gmx.net>
Add CC:
CC:
Remove selected CCs
URL:
Summary:
Status Whiteboard:
Keywords:

Filename Description Type Creator Created Size Actions
disktype-7.ebuild ebuild for version 7 text/plain Daniel Evers 2004-11-10 01:49 0000 557 bytes Details
Create a New Attachment (proposed patch, testcase, etc.) View All

Bug 70643 depends on: Show dependency tree
Show dependency graph
Bug 70643 blocks:
Votes: 0    Show votes for this bug    Vote for this bug

Additional Comments: (this is where you put emerge --info)







View Bug Activity   |   Format For Printing   |   XML   |   Clone This Bug


Description:   Opened: 2004-11-10 01:47 0000
"The purpose of disktype is to detect the content format of a disk or disk
image. It knows about common file systems, partition tables, and boot codes."

We use it at our university for forensics. It's very usefull and I was
wondering if it was in portage ... sadly it's not. So I wrote a very
minimalistic ebuild (just do make + copy the files).

------- Comment #1 From Daniel Evers 2004-11-10 01:49:33 0000 -------
Created an attachment (id=43646) [edit]
ebuild for version 7

I placed it in app-forensics/

------- Comment #2 From solar 2004-11-22 15:00:17 0000 -------
Daniel, what does disktpe do that 'file' does not?

------- Comment #3 From Daniel Evers 2004-11-22 23:55:29 0000 -------
Right, the man page for "file" tells me it knows about file system types.
But I don't think it supports partition types, boot codes and as much file system types as disktype does (see disktype.sf.net for a list of supported formats).

I think "file" is very good for files, but "disktype" is the best I know for partitions and stuff.

Hope that helps :)

------- Comment #4 From solar 2004-11-23 08:15:02 0000 -------
I can add this to the tree if somebody else comments here as this being a
valuable 
addition to the tree.  Community support for the tool is next step as we need
make
sure it's more than 1 person that will use and that wants to see this tool in
the 
tree.

------- Comment #5 From solar 2004-11-24 09:39:54 0000 -------
I've tested this. It does indeed seem like a very usefull util for the toolbox. 
I'm not sure about under app-forensics/disktype however.

------- Comment #6 From solar 2004-11-24 17:10:17 0000 -------
few notes..

livecd src # dd if=/dev/loop0 of=dev_loop_0
livecd src # disktype dev_loop_0dis

--- dev_loop_0
Regular file, size 69.38 MiB (72753152 bytes)
Linux squashfs, version 2.0, little-endian
  Compressed size 69.38 MiB (72749467 bytes)
  Block size 5.352 KiB (5480 bytes)

livecd src # file dev_loop_0 
dev_loop_0: data

I wish this thing had more docs (manpage would be nice)

disktype hangs with -> disktype /dev/psaux||/dev/random
while file gets it right.

livecd src # file /dev/psaux 
/dev/psaux: character special (10/1)

------- Comment #7 From Daniel Evers 2004-11-25 02:33:20 0000 -------
app-forensics was just an idea because I used it for forensics :)
ATM I can't think of any other kind of usage...

I don't know how disktype works, but maybe it tries to read the while file at once or to the end, so it gets stuck with special devices (they have kind of infinite data, images and discs are finite).

>I wish this thing had more docs (manpage would be nice)
disktype? --> http://disktype.sourceforge.net/doc/

------- Comment #8 From solar 2004-12-12 12:50:55 0000 -------
Reassigning bug to bug-wranglers. disktype is a handy util but I don't think I
want to add any new ebuilds myself at this time. Reason being that I'm looking
for less to maintain right now.

------- Comment #9 From Daniel Black 2004-12-18 16:24:51 0000 -------
added to sys-apps/disktype

Thanks for the ebuild.

------- Comment #10 From Daniel Black 2004-12-18 16:28:13 0000 -------
Ned fyi - I added this - sys-apps/disktype.

First Last Prev Next    No search results available      Search page      Enter new bug