Re: [Vol-dev] [patch] Support for block devices (such as iSCSI exported memory images)

Hiya guys, I had a request from echo6 to allow Volatility to run against iSCSI exported memory images (which basically show up in Linux as block devices). The attached patch changes checks from "not isfile" to "isdir", in order to include block files, regular files and symlinks. The patch also includes a secondary method for determine filesize, based on opening the file, seeking to the end, and then asking the file to tell how far the cursor is. That works fine for block devices, whereas getsize returns 0. As you can see form the patch, there's a lot of plugins that reimplement existing code and handle files directly. That also means that other existing plugins will need converting if they're to work against block devices... Mike 5:) ------------------------------------------------------------------------ _______________________________________________ Vol-dev mailing list Vol-dev(a)volatilityfoundation.org http://lists.volatilityfoundation.org/mailman/listinfo/vol-dev