CarvFS on a Mac

CarvFS is a user space file system on top of LibCarvPath and FUSE that makes arbitrary parts of a file system accessible as files. Its main intended use is zero-storage or in-place file carving. I'm frequently using this tool to dissect large structured files and file system images. CarvFS compiles out of the box on Linux; installation on a Mac required a couple of tweaks and patches to sources and CMake files. With the kind help of Rob from the KLPD I eventually succeeded. I'm releasing my set of patches in the hope that it will help others.

You should be able to install this on your Mac with the help of MacPorts and my set of port files.

Download the archive and unzip it into your home. Then run portindex to incorporate the meta-data into your MacPorts installation. Next install the three packages:

sudo port install libcarvpath carvfs carvfs-modewf

MacPorts may install additional packages like sqlite3 or libewf to fulfill any prerequisites. Add the library directory of your MacPort installation (usually /opt/local/lib) to DYLD_FALLBACK_LIBRARY_PATH:

export DYLD_FALLBACK_LIBRARY_PATH=/opt/local/lib

Finally, you can create a mount point and mount an EWF image:

> mkdir ~/mnt
> carvfs ~/mnt ewf auto myimage.E??
/Users/myname/mnt/2a99939f3a463faab0233bc6303194c8
> ls -l ~/mnt/2a99939f3a463faab0233bc6303194c8/
total 156301496
d--x--x--x 3 root wheel 0 1 Jan 1970 CarvFS/
-r--r--r-- 1 root wheel 80026361856 1 Jan 1970 CarvFS.crv
-rw-rw-rw- 1 root wheel 1134 1 Jan 1970 README

This was my first attempt at writing a port file. Also, CMake was giving me a hard time. While everything is working fine for me now, I realize that the ports and patches may not yet ready for inclusion into the MacPorts repository at this time. I greatly appreciate your comments and fixes.

Archives

Imprint

This blog is a project of:
Andreas Schuster
Im Äuelchen 45
D-53177 Bonn
impressum@forensikblog.de

Copyright © 2005-2012 by
Andreas Schuster
All rights reserved.
Powered by Movable Type 5.12