Bug#833630: scalpel: performance decreases with running time

ydirson at free.fr ydirson at free.fr
Mon Aug 8 06:48:15 UTC 2016


Another test, more closely monitored, with the same set of 100 1024-bytes patterns,
carving a 1TB SATA drive, with defines updated to avoid buffer overflows:

+--- scalpel-1.60.orig/scalpel.h
++++ scalpel-1.60/scalpel.h
+@@ -143,11 +143,10 @@ void setProgramName(char *s);
+ 
+ 
+ #define SCALPEL_BLOCK_SIZE           512
+-#define MAX_STRING_LENGTH            4096
+-#define MAX_NEEDLES                   254
++#define MAX_STRING_LENGTH            5000
+ #define NUM_SEARCH_SPEC_ELEMENTS        6
+ #define MAX_SUFFIX_LENGTH               8
+-#define MAX_FILE_TYPES                100
++#define MAX_FILE_TYPES                600
+ 
+ #define MAX_FILES_PER_SUBDIRECTORY    1000
+ 


elapsed  %done  ETA
1h       10.5%   8:28
2h       16.4%  10:12
3h       27.4%   7:59
4h       37.7%   6:32
5h       55.1%   4:03  # inflexion point
6h       62.4%   3:36
7h20     63.6%   4:14
8h       64.2%   4:30
9h       65.0%   4:50
10h      65.8%   5:09

16h25    71.6%   6:32



More information about the forensics-devel mailing list