Re: [Linux-NTFS-Dev] MFT Structure
Development moved to https://sourceforge.net/projects/ntfs-3g/
Brought to you by:
antona,
cha0smaster
From: Sergio C. <ser...@gm...> - 2008-12-23 00:20:49
|
Yeah, its an excellent book, I have it for reference and it's been real help. It mentions TSK a lot, but I'm an intern, and the project they assigned to me was in Visual Basic 6 (eww). I'm currently working with the WinHex for direct manipulation, and it's API for integration with Basic,and it's really good, fast and reliable (from what I've seen in the past week). Anyway, thanks for your help! --------------------------------------- Sergio Campamá ser...@gm... On Dec 22, 2008, at 6:27 PM, Gary Funck wrote: > On 12/22/08 14:38:03, Sergio Campamá wrote: >> Hello. I am currently working at a Data Recovery Center, and my >> project has to deal with the actual files inside a NTFS Partition and > > If you haven't done so already, you might want to have a look at > The Sleuthkit (TSK) tools: > http://www.sleuthkit.org/ > Several of those tools will likely make your job easier. > Also, Brian Carrier's book, "File System Forensic Analysis" > is an excellent resource: > http://www.digital-evidence.org/fsfa/ > |