turbinia icon indicating copy to clipboard operation
turbinia copied to clipboard

Add new block range evidence types

Open aarontp opened this issue 3 years ago • 0 comments

We should add new evidence types (e.g. RawDiskBlocks) for disk block ranges so that we can have jobs further parallelize processing. Jobs would just need to know the size of the disk and could then split a disk into block ranges and create a Task for each of those. Then the JobFinalize Task could be used to combine the outputs from each of the Tasks. This would speed up strings and possibly bulk_extractor processing.

The new evidence would probably have the original disk as the parent so that it can use the same pre-processors and then the new child evidence type could have a preprocessor that just loopback mounts the disk at the offset of the start of the block range (not sure what the best way to handle the end of the block range though).

We do have to be careful because it could miss things that cross block range boundaries, but apparently bulk_extractor can also process block ranges and has some method for overlapping the block ranges so it is less likely to miss things. We should take a look at what they do with that to see if it would be applicable here.

aarontp avatar Jun 10 '21 21:06 aarontp