Identifying Unallocated Space

[dmwharris]

Hello,
Sorry to use this space to ask a question about usage, but I've looked through documentation and I'm not understanding how to use aff-info, aff-digest, or aff-extract to identify unallocated space, slack space or space between partitions in an aff4 image. In general, I'm not finding a lot of discussion/documentation of how aff4 handles or identifies unallocated space. Any help would be greatly appreciated.

Thanks!

[blschatz]

You could use the Map object (see examples/extract.cc) and iterate over it's entries, looking for map points that represent regions of aff4:UnknownData. You might want to read the Wirespeed paper for some more background on that. https://dfrws.org/sites/default/files/session-files/2015_USA_paper-wirespeed_extending_the_aff4_container_format_for_scalable_acquisition_and_live_analysis.pdf