Re: [sleuthkit-users] Basic methods for imaging OS X hard drive

[RB <ao...@gm...>]

Please use reply-to-all on this list; it does not set the respond-to
header and thus simply hitting 'reply' only reaches me.

> Do you mean that TSK 3beta will not read a OS X image?

It is unlikely, unless you have some odd filesystem setup on the Mac.

> If not, does TSK 2.52 support the HFS on an OS X image without modification?

Neither of the major versions 'turn on' support for HFS+; the code has
been there in some form since mid-2006 with the last update 10 months
ago.  This doesn't mean you won't be able to image the drive with OSS
tools, you just won't be able to analyze it without modifying
SleuthKit (sed -i 's/define TSK_USE_HFS 0/define TSK_USE_HFS 1/'
tsk3/fs/tsk_fs_i.h).