On Thu, Apr 2, 2009 at 12:36 PM, Gabriel <dun...@dreams.sk> wrote: > Hello, > I have to write linux application that will analyze disk/partition (ext3 > filesystem) on really low level. It has to find/analyze files on the disk by > reading disk blocks to analyze file's headers to find out file type and > then blocks related to file to get file content. The second part have to > be searching deleted files by this blocks reading (is this even possible?) > > Can i do this in python? For example can i open disk image file and read it > block by block? > Or is there even better solution? .) I tried search web but I wasn't > successful.. > > I will appreciate any help. Thank you in advice.. > > Gabriel > -- > http://mail.python.org/mailman/listinfo/python-list
I may be wrong, but I'd assume that you could just read by block size, opening the file that represents the disk in /dev (/dev/sda or similar). I don't see why you would want to do that to find out file type/headers though. You should be able to see the contents of "deleted" files that haven't been (entirely) overwritten on disk - I believe that when you delete a file, you really just delete the inode, or reference that tells the filesystem that there's a file there. Someone else who's keener on the details of these things will probably come with better information.
-- http://mail.python.org/mailman/listinfo/python-list
