Re: [sleuthkit-users] Basic methods for imaging OS X hard drive

[Brian C. <ca...@sl...>]

On Sep 30, 2008, at 12:29 PM, Mr. David J. Hughes wrote:

> I made the change to TSK_USE_HFS and enabled HFS. I have recompiled
> and tried to add an image of the MacBook internal drive with Autopsy.
> Autopsy does not seem to recognize any partitions.
>
> Details:
>
> I am working with SleuthKit 3.0.0.b3 and Autopsy 2.2.0b2.
> I imaged the suspect drive with dd to get a complete copy of the  
> drive.
> Suspect computer: MacBook Pro 17 inch Intel 2.16 with 120 Gb hard  
> drive.

You may want to try 3.0.0b4, which was released on friday.  It has  
some updated HFS+ code that Judson Powers and Rob Joyce at ATC-NY  
submitted. I'm hoping to have the HFS code be officially supported in  
a 3.1.0 release, but it won't  make it in for the 3.0.0 release.

http://www.sleuthkit.org/betas/

brian