Re: [sleuthkit-users] Basic methods for imaging OS X hard drive
Brought to you by:
carrier
|
From: Brian C. <ca...@sl...> - 2008-09-30 22:00:31
|
On Sep 30, 2008, at 2:30 PM, RB wrote: > On Tue, Sep 30, 2008 at 10:29, Mr. David J. Hughes > <da...@ma...> wrote: >> I made the change to TSK_USE_HFS and enabled HFS. I have >> recompiled and >> tried to add an image of the MacBook internal drive with Autopsy. >> Autopsy >> does not seem to recognize any partitions. > > Autopsy is hard-coded to the filesystem types normally supported by > sleuthkit; as such, it won't support experimental filesystems. You'll > have to use the underlying binaries to perform your analysis. I'll add some code to Autopsy to support HFS if the TSK binaries have been compiled with HFS support. brian |