LAZARUS(1)

NAME
lazarus - create structure from unstructured data

SYNOPSIS
lazarus [ -1bBdhtT ] [ -D directory ] [ -w directory ]

DESCRIPTION
lazarus tries to revive things that have died and gone into the binary spirit world... deleted files, data in memory, swap, etc.

It takes data, examines it, and if it passes certain criteria marks it as a text or binary block and either saves it or throws it away. Saved data blocks can be examined later with additional tools or via a browser if lazarus is run with the -h (HTML) option.

The output is a set of characters (or HTML color-coded chars, see lazarus.cf) that correspond to the type of blocks that lazarus sees. In addition it creates files that contain the data in the $blocks directory. Consecutive blocks of the same character type means that it has seen a run of blocks that it strings together and stuffs in the same $blocks/* output file. The initial character of a run will always be a capital letter (if possible; some types are denoted by punctuation marks), followup letters in the same run will be lowercase. For instance, if it outputs "Cc", it means that the first block and second blocks of the data found are suspected to be C programs. A "." represents unrecognized binary blocks of data. To make the output stay in semi-manageable size, it does a logarithmic compression of the output (base 2). The first character represents one block or less of data, the 2nd from 0-2 blocks, the 3rd 0-4, the fourth 0-8, etc. Blocks are typically, but not always (and are user definable) 1024 bytes.
 Typical output might look like:
   .....T.Ttt..T.Tt.Tttt.Tttt.Ttttt.Ccc.....L..Lll....
   Llllllll....T.Mmmmmm..TMmmmm....LlllllllllllMmmmm..
   [...]

OPTIONS

-1  process byte-style, one byte at a time, rather than one block of data at a time. Not generally recommended, perhaps useful for looking at memory, etc.

-b  don't write unrecognized binary data blocks (writes by default)

-B  don't write ANY binary data blocks (writes by default)

-d  turn debug on (not recommended ;-))

-h  emit HTML code rather than ASCII text. It outputs to three files - the data file ($ARGV[0]) + .html, .menu.html, and .frame.html. You generally want to look at the $ARGV[0].frame.html file (with your browser) initially.

-D directory
    write the blocks into this directory name (hey, running out of letters here, cut me slack!)

-t  don't write unrecognized text data blocks (writes by default)

-T  don't write ANY text data blocks (writes by default)

-w directory
    use this directory to write all the HTML code. Meaningless unless used with -h!

SEE ALSO
unrm(1)

LICENSE
Distributed under the details found in the COPYRIGHT file found in the root directory of The Coroner's Toolkit.

AUTHOR(S)
dan farmer
zen@fish.com
EarthLink Network, Inc.