Designed and implemented the following C++ libraries and modules for the cutting edge forensic tool Adroit Photo Forensics (APF), as well as for 3rd party forensic/recovery tools.
1. Filesystem parsers for FAT12/16/32, HFS/HFS+, NTFS, EXT2/3/4, YAFFS/2, VxFS, and exFAT.
2. Embedded parsers for ZIP, RAR and 7-ZIP. Also designed the architecture that identify, parse and store the results in a format easily understood by the forensic tool.
3. Decoders for partition tables like MBR, EBR, GPT, APM, HPLVM. This improved the file system identification process for partitioned disk images or drives.
4. Readers and Writers for Raw disk images as well as forensic disk images formated with Encase and Advanced Forensic Format which are used by law enforcement agencies.
5. Write block access to storage devices (flash drive, HDD etc) in raw mode using Windows C++ and MacOSX Objective-C calls. This helped in making APF part of the Evidence Acquisition process.
6. JNI modules interface between the C++ engine and the Java front end.
Multi-threaded version of the carving engine, using boost thread library, which will be used in future versions of APF. Improved the speed of processing by 50% in most cases.
Reverse engineered proprietary mobile NAND file systems of Motorola, Nokia, Blackberry, and LG for inclusion in a premier third party forensic tool.
Helped in the design of libsmraw, open source project. (https://code.google.com/p/libsmraw/)
Assisted in designing the architecture for future data recovery products, that can scale to recover and analyze large video files.
Added Unicode support to APF. This involved identifying key points in the code, specifically in file system and embedded parsers, where various encoded strings needed to be converted and stored in a common unicode format.
Sped up the debugging process, using PID logs and disassembly code, from days to hours. Used various tools like gdb, valgrind, vld etc to identify and fix hard to find bugs and memory leaks.
