Donate Share

The Sleuth Kit

Code

Programming Languages: C

License: Common Public License 1.0, IBM Public License

Show:

What's happening?

  • Identify in NTFS the SID of the owner of a file

    The owner SID of files needs to be identified per file. Every file has an associated security identifier which identifies the owner, groups, etc. of the file. More than one file may have the same security identifier if the files share the exact same security descriptor. Using the security identifier of the file (secid), we can lookup its security descriptor within $Secure. Security...

    2009-11-11 00:25:12 UTC by jamiebutler

  • Comment: Allow libewf/afflib location to be specified

    Fixed. --with-libewf=dir and --with-afflib=dir can be used. --without-afflib and --without-libewf should now be used instead of --disable-libewf and --disable-afflib. Sending trunk/INSTALL.txt Sending trunk/configure.ac Transmitting file data .. Committed revision 126.

    2009-11-10 21:19:12 UTC by carrier

  • Comment: Allow libewf/afflib location to be specified

    I thought that this was part of autoconf by default, but realized that it means something else. Reverted instructions. Working on different fix using AC_ARG_WITH. Sending trunk/INSTALL.txt Transmitting file data . Committed revision 125.

    2009-11-10 00:27:16 UTC by carrier

  • Comment: Allow libewf/afflib location to be specified

    Added --prefix argument description to INSTALL.txt file as a short-term fix. Sending trunk/INSTALL.txt Transmitting file data . Committed revision 124.

    2009-11-09 23:46:28 UTC by carrier

  • Comment: Add support for HFS+ flags

    Thanks. Checked into trunk (with a few name changes). Sending trunk/CHANGES.txt Sending trunk/tsk3/fs/hfs.c Sending trunk/tsk3/fs/tsk_hfs.h Transmitting file data ... Committed revision 122.

    2009-11-09 23:08:45 UTC by carrier

  • Comment: Time zone on HFS+ volume creation date

    Thanks. Applied to trunk. Sending trunk/CHANGES.txt Sending trunk/tsk3/fs/hfs.c Transmitting file data .. Committed revision 121.

    2009-11-06 21:06:11 UTC by carrier

  • Comment: blks -A not working

    Fixed in trunk. Flags were not being cleared and all files were therefore being searched. Sending trunk/CHANGES.txt Sending trunk/tools/fstools/blkls.cpp Transmitting file data .. Committed revision 120.

    2009-11-06 20:55:56 UTC by carrier

  • Comment: unable to read file's content for a file on NTFS system

    Fixed in trunk. Had to do with sanity check on reading last block of file system using the POSIX-style API. Sending trunk/CHANGES.txt Sending trunk/tsk3/fs/fs_io.c Transmitting file data .. Committed revision 119.

    2009-11-06 20:52:02 UTC by carrier

  • Allow libewf/afflib location to be specified

    Currently, configure will search in standard locations for libewf and afflib. If a user installs the libraries in their home directory though, it will not be found. Add a feature to configure to allow user to specify the location. For example, some other programs allow the user to specify '--with-LIBXYZ=/my/path'.

    2009-11-06 20:15:19 UTC by carrier

  • Comment: unable to read file's content for a file on NTFS system

    Here is a link to an image to reproduce the issue - http://rapidshare.com/files/302212622/simplefiles_ntfs.dd.html MD5: FEC9AFCB26A8DE34108AEB40854110F2 Problem file is "Bitmap Image.bmp" (inode 64). I've tried ICAT application: it read content of a problem file successfully. But POSIX-SAMPLE application unable to do the same task. But, - ICAT uses "tsk_fs_read_block" function for...

    2009-11-04 09:25:40 UTC by oncer82

Our Numbers