This small piece of code was used during the analysis of an 800GB VMWare image after a server crash.
notnull.c:
#include <stdio.h>
#include <stdlib.h>
int main(int argc, const char* argv[]) {
if (argc != 2) {
printf("give filenamen");
exit(1);
}
FILE *f = fopen(argv[1], "r");
const unsigned int BUFSIZE = 4096;
unsigned char buffer[BUFSIZE];
unsigned long cnt = 0;
unsigned long found = 0;
size_t r;
while (0 != (r = fread(&buffer, 1, BUFSIZE, f))) {
cnt += r;
for (int i = 0; i < r; i++) {
if (0 != *(buffer + i)) {
found++;
}
}
if (0 == (cnt % 1000000)) {
printf("cnt: %ld, found: %ldn", cnt, found);
}
}
printf("finally: cnt: %ld, found: %ldn", cnt, found);
}
Compile it using:
gcc -std=c99 -o notnull notnull.c