Read raw images through the shared raw_image module - #206
Merged
Merged
Conversation
-t raw used to run the vendored reader as a subprocess, extract every file of every volume into a temporary zip, and read that zip. It now uses scripts/raw_image.py, the module the other LEAPP cores carry byte for byte: the image is opened in place, its volumes are walked once for their names, and only the files an artifact's pattern selects leave the image. That removes the temporary copy, which for a computer acquisition could run to a hundred gigabytes, and it works in a frozen build, where the subprocess route could not since sys.executable is the tool itself. FileSeekerIva keeps unwrapping the Berla export and now reads the image inside it through FileSeekerRaw, or the extracted file set through FileSeekerZip, with Vehicle.json staged as a member either way. qnxprobe is re-vendored at 1.26 for its volumes() call. The seeker tests that pinned the old staging directory and the volumes.json warnings are replaced by the shared raw image tests and an iVa test that builds both shapes of export from the NTFS fixture. admin/scripts/check_vendored.py is the shared manifest checker and fetches each upstream file at its recorded commit in CI. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves VLEAPP's raw image reading onto the shared
raw_imagemodule, so all five LEAPP cores read images through one seeker.-t rawand-t ivanow usescripts/raw_image.py'sFileSeekerRaw, byte-identical to the other cores.-t ivaunwraps an image or a file set and answers the Vehicle.json request from the data folder.Live files only; deleted records are not staged. A bare partition image is not re-rooted. F2FS is not read. Encrypted volumes read as ciphertext.
🤖 Generated with Claude Code