Re: [sleuthkit-users] Basic methods for imaging OS X hard drive

[Brian C. <ca...@sl...>]

On Sep 30, 2008, at 2:30 PM, RB wrote:

> On Tue, Sep 30, 2008 at 10:29, Mr. David J. Hughes  
> <da...@ma...> wrote:
>> I made the change to TSK_USE_HFS and enabled HFS. I have  
>> recompiled and
>> tried to add an image of the MacBook internal drive with Autopsy.  
>> Autopsy
>> does not seem to recognize any partitions.
>
> Autopsy is hard-coded to the filesystem types normally supported by
> sleuthkit; as such, it won't support experimental filesystems.  You'll
> have to use the underlying binaries to perform your analysis.

I'll add some code to Autopsy to support HFS if the TSK binaries have  
been compiled with HFS support.

brian