bulk_extractor icon indicating copy to clipboard operation
bulk_extractor copied to clipboard
verified publisher icon simsong

Improve code coverage with more RAR decodes

Open simsong opened this issue 2 years ago • 4 comments

Looks like we can significantly increase coverage by having more RAR decompression examples.

simsong avatar Mar 25 '23 14:03 simsong

Hi Simsong,

I was working on this project and created datasets to see which RAR files cannot be detected by Bulk Extractor. The RAR files created in any compression mode in RAR5 via WinRAR cannot be detected by Bulk Extractor. All RAR files created in RAR4 or in any older versions via WinRAR can be detected. Hope this finding can contribute for further research.

MasterDFOR avatar Aug 08 '23 01:08 MasterDFOR

Hi. Thank you so much. It would be great to have this dataset. Where is it? Can we add it to the repo?

simsong avatar Aug 08 '23 01:08 simsong

Yes, I add add it. Where is the repo you mentioned btw? The dataset are a few dd images which contains RAR files that I created via different compression levels (fast, normal, good, etc) and compression modes (RAR4 or RAR5).

MasterDFOR avatar Aug 18 '23 00:08 MasterDFOR

How large are the files? If they are under 5MB, please attach them to this ticket.

simsong avatar Aug 18 '23 01:08 simsong