Skip to content

Commit

Permalink
Update README.md
Browse files Browse the repository at this point in the history
  • Loading branch information
dr-anoroc authored Apr 1, 2021
1 parent ce2cc21 commit 3df3dd6
Showing 1 changed file with 22 additions and 2 deletions.
24 changes: 22 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,18 +1,38 @@
# rawccopy

Rawccopy is a one-to-one port of [rawcopy](https://github.com/jschicht/RawCopy) to C. The command line is exactly the same as the original rawcopy and the behaviour of the two programs is virtually identical.
Rawccopy is a one-to-one port of [rawcopy](https://github.com/jschicht/RawCopy) to C. The command line is backwards compatible with the original rawcopy (with some clarifications below) and the behaviour of the two programs is virtually identical.

#### Why the trouble of rewriting the whole thing?

For some reason, rawcopy started generating false positives in virus scanners and this became very annoying. In the beginning the problem could be circumvented by locally compiling it, but in the end even that didn't work.
##### Original rawccopy

For some reason, rawcopy started generating false positives in virus scanners and this became very annoying. In the beginning the problem could be circumvented by locally compiling it, but in the end even that didn't work. That resulted in a first version, which stayed close to the original rawcopy source code, which is written in [AutoIt3](https://www.autoitscript.com/site/).

##### Current version

Some of the bugs that were reported on Github revealed fundamental flaws in the extraction logic. At first, it looked like errors made while porting the code, but in reality they also existed in the original rawcopy. That led to a complete refactoring and simplification of the extraction logic while replacing the full rawcopy processing flow by a cleaner, streamlined version. At the same time, the code was refactored and the command line processing was clarified.

#### Differences with original rawcopy

##### Overall behaviour

The command line is exactly the same as documented [here](https://github.com/jschicht/RawCopy) and the specification of the programs are almost identical. The differences are:

* rawccopy supports links, ie it is able to follow links such as `c:\Users\All Users` -> `c:\ProgramData`
* rawccopy correctly supports compressed files, where rawcopy, doesn't handle all of them correctly;

##### Some clarifications about the command line

There are some points to note about the rawccopy (and rawcopy) command line:

* When using a device or hard disk specification in the `/FileName:` parameter, ie `/FileName:HardDisk1Partition3`, `/FileName:HardDisk1Partition3`, `/FileName:HarddiskVolume1`, `/FileName:HarddiskVolumeShadowCopy1` or `/FileName:PhysicalDrive1`, rawcopy imposes these indexes to be maximum one digit long, eg `/FileName:HarddiskVolume1` is OK but not`/FileName:HarddiskVolume11`.

Windows does not limit hard disk, volume and partition indexes to one digit, therefore rawcopy's <u>behaviour is not correct</u> and rawccopy supports indexes of more than one digit.

* When using a file name specification like `/FileName:PhysicalDrive1`, rawcopy actually needs to be told in which partition to look. Contrary to what is documented [here](https://github.com/jschicht/RawCopy), it does this through the `/ImageVolume:` parameter. For rawccopy the situation is exactly the same.

* As usual in the Windows universe, all aspects of the command line are case insensitive.

#### Build instructions

Download the source code and install Microsoft Visual Studio 2019. The community version is OK. Then simply build the version you need (x64 or x86).
Expand Down

0 comments on commit 3df3dd6

Please sign in to comment.