2

I'm developing a software that extracts files from a Linux raw image (dd). I use SluethKit to get the partitions & files, however i can't find any files inside /sys & /proc folders.

I know the sysfs & procfs do not contain regular files (as they are loaded to the kernel), but i need to "extract" them somehow...

Any idea how can it be done for forensics (withou mount)?

Improve this question

1 Answer 1

Reset to default
5

You can't. Those are virtual filesystems that don't correspond to anything on disk. They're just file-based interfaces to inside the kernel, and only ever exist on-the-fly in RAM.

Improve this answer
4
  • You mean that all the data in those file systems is only created on startup? :0
    – Reginiano
    Commented Apr 4, 2019 at 19:30
  • @Reginiano Yes, exactly.
    – Joseph Sible-Reinstate Monica
    Commented Apr 4, 2019 at 21:18
  • Wow, fascinating!
    – Reginiano
    Commented Apr 4, 2019 at 21:32
  • 3
    Not even at startup, actually. The data in those filesystem is generated on access. That's how it can reflect the status of the system in real time.
    – user82155
    Commented Apr 5, 2019 at 2:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .