Low level hard drive reading

[Jeremiah Dodds]

On Thu, Apr 2, 2009 at 12:36 PM, Gabriel <dunmer at dreams.sk> wrote:

> Hello,
> I have to write linux application that will analyze disk/partition (ext3
> filesystem) on really low level. It has to find/analyze files on the disk by
> reading disk blocks to analyze file's headers to find out file type and
>  then blocks related to file to  get file content. The second part have to
> be searching deleted files by this blocks reading (is this even possible?)
>
> Can i do this in python? For example can i open disk image file and read it
> block by block?
> Or is there even better solution? .) I tried search web but I wasn't
> successful..
>
> I will appreciate any help. Thank you in advice..
>
> Gabriel
> --
> http://mail.python.org/mailman/listinfo/python-list


I may be wrong, but I'd assume that you could just read by block size,
opening the file that represents the disk in /dev (/dev/sda or similar). I
don't see why you would want to do that to find out file type/headers
though. You should be able to see the contents of "deleted" files that
haven't been (entirely) overwritten on disk - I believe that when you delete
a file, you really just delete the inode, or reference that tells the
filesystem that there's a file there.

Someone else who's keener on the details of these things will probably come
with better information.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/python-list/attachments/20090402/9f19798f/attachment-0001.html>