NAME
lazarus - create structure from unstructured data
SYNOPSIS
lazarus [ -1bBdhHtT ] [ -D directory ] [ -H directory ] [ -w directory
]
DESCRIPTION
lazarus tries to revive things that have died and gone into the binary
spirit world... deleted files, data in memory, swap, etc.
Lazarus reads and examines data, and if the data passes certain
criteria marks it as a known or unknown block of information and saves
it in a data directory. Saved data blocks can be examined later with
additional tools or via a browser if lazarus is run with the -h (HTML)
option.
The output is a set of characters (or HTML color-coded chars, see
lazarus.cf) that correspond to the type of blocks that lazarus sees.
In addition it creates files that contain the data in the $blocks
directory (this value is modified with the -B flag or by changing the
default values in lazaruz.cf, the lazarus configuration file.
Consecutive blocks of the same character type means that it has seen a
run of blocks that it strings together and stuffs in the same $blocks/*
output file. The initial character of a run will always be a capital
letter (if possible; some types are denoted by punctuation marks),
followup letters in the same run will be lowercase. For instance, if
it outputs "Cc", it means that the first block and second blocks of the
data found are suspected to be C programs. A "." represents
unrecognized binary blocks of data.
To make the output stay in semi-manageable size, it does a logarithmic
compression of the output (base 2). The first character represents one
block or less of data, the 2nd from 0-2 blocks, the 3rd 0-4, the fourth
0-8, etc. Blocks are typically, but not always (and are user
definable) 1024 bytes.
Typical output might look like:
.....T.Ttt..T.Tt.Tttt.Tttt.Ttttt.Ccc.....L..Lll....
Llllllll....T.Mmmmmm..TMmmmm....LlllllllllllMmmmm..
[...]
The colors (corresponding to the netscape color scheme) and characters
for recognized text and files are kept in the lazarus.cf file, and are:
type value color meaning
t 777777 gray unresolved text
f ff0000 bright red (alarm) sniffer stuff
m 0066ff blue mail
q 6633ff pale blue mailq files
s 6699ff purply emacs/lisp
p cc6666 greenish program file
c 336666 green C code
h ff99ff light purple HTML
w cc3333 reddish password file
l cc9900 light brown log file
Binary files are represented by:
type value color meaning
o bbbbbb light grey null block
r 000000 black removed’d block
x 000000 black binary exe
e d9d9i9 gold ELF
i 238e68 greenish JPG/GIF
a d19275 black cpio/tar/etc
z 336633 greenish compressed
! 000000 black audio
OPTIONS
-1 process byte-style, one byte at a time, rather than one block
of data at a time. Not generally recommended, perhaps useful
for looking at memory, etc.
-b don’t write unrecognized binary data blocks (writes by default)
-B don’t write ANY binary data blocks (writes by default)
-d turn debug on (not recommended ;-))
-h emit HTML code rather than ASCII text. It outputs to three
files - the data file ($ARGV[0]) + .html, .menu.html, and
.frame.html. You generally want to look at the
$ARGV[0].frame.html file (with your browser) initially.
-H directory
save the HTML frames code in this directory. Only useful with
-h flag.
-D directory
write the data blocks into this directory name (hey, running
out of letters here, cut me slack!)
-t don’t write unrecognized text data blocks (writes by default)
-T don’t write ANY text data blocks (writes by default)
-w directory
use this directory to write all the HTML code. Meaningless
unless used with -h!
SEE ALSO
unrm(1) lazarus.cf
LICENSE
Distributed under the details found in the COPYRIGHT file found in the
root directory of The Coroner’s Toolkit.
AUTHOR(S)
dan farmer
zen@fish.com
EarthLink