Question

I am wring a small forensic app which looks like this so far

import time, os,sys

def getter():
    filename = sys.argv[1]
    print "File Entered: " + filename
    os.system('file ' + filename)
    print "\n"
    pipe =  os.popen("xxd " + filename, "r")
    print pipe.read()

I input via the command line a file and it prints out the type of file and then it is supposed to create a pipe from the terminal back to the python app under the pipe name “pipe”. I then read the pipe named “pipe”

This works great on smaller text files, but it will not work on block devices even when I run this app as super user. In the end this will recover files based on the output of xxd.

any tips, thank you.

Answer 1

What happens if you just run xxd /dev/diskwhatever from the shell prompt? Does it work, and how much information does it spew out? Assuming that, as superuser, you do have read permission, the attempt to read everything at one gulp in your code’s last line would be the point where failure could be expected (since the amount of information can be really huge); the workaround would be to read a little at a time, instead of doing a single .read() call.

Edit: whether you get your pipe in the nice modern way (with subprocess) or the deprecated-but-still-working old way (with popen), makes no difference to this problem. In either case, you can get one line at a time by just looping over the pipe object, for example:

child = subprocess.Popen(whatever, stdout=subprocess.PIPE)
for line in child.stdout:
  print "One more line:", line