Re: [sleuthkit-users] Basic methods for imaging OS X hard drive

[Mr. D. J. H. <da...@ma...>]

I do not understand how to enable the HFS support. Can anyone give a  
little more detail. I tried the command you listed but got an error:

sed: 1: "tsk3/fs/tsk_fs_i.h": undefined label 'sk3/fs/tsk_fs_i.h


On Sep 24, 2008, at 4:42 PM, RB wrote:

> Please use reply-to-all on this list; it does not set the respond-to
> header and thus simply hitting 'reply' only reaches me.
>
>> Do you mean that TSK 3beta will not read a OS X image?
>
> It is unlikely, unless you have some odd filesystem setup on the Mac.
>
>> If not, does TSK 2.52 support the HFS on an OS X image without  
>> modification?
>
> Neither of the major versions 'turn on' support for HFS+; the code has
> been there in some form since mid-2006 with the last update 10 months
> ago.  This doesn't mean you won't be able to image the drive with OSS
> tools, you just won't be able to analyze it without modifying
> SleuthKit (sed -i 's/define TSK_USE_HFS 0/define TSK_USE_HFS 1/'
> tsk3/fs/tsk_fs_i.h).
>
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's  
> challenge
> Build the coolest Linux based applications with Moblin SDK & win  
> great prizes
> Grand prize is a trip for two to an Open Source event anywhere in  
> the world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org