Re: [sleuthkit-users] TSK 3.1.2 is available

[Simson G. <si...@ac...>]

Brian,

Is there an instrumentation layer in SleuthKit that would allow us to get some hard statistics out of this? I was thinking of adding such a layer to AFFLIB but never got around to it. Basically, I want to count the number of reads to each sector...

--Simson


On May 23, 2010, at 9:53 AM, Максим Суханов wrote:

> Hi!
> 
> Sure.
> 
> http://anti-forensics.ru/tsk3/fat_big.dd.rar
> http://anti-forensics.ru/tsk3/fat_big.dd.rar.md5sum
> 
> This archive contains 10,1 GB FAT with several subdirectories inside.
> Try to list them using various versions of TSK (2.52 works fine, 3.1.2
> has issues).
> 
> ---
> Suhanov Maxim
> 
> 2010/5/23, Simson Garfinkel <si...@ac...>:
>> Hi Максим,
>> 
>> It would be useful if you could document this performance on a disk image
>> that is publicly available so that we can try to replicate the results. Do
>> you have such an image?
>> 
>> Simson
>> 
>> On May 22, 2010, at 11:06 PM, Максим Суханов wrote:
>> 
>>> Hi!
>>> 
>>> This version still has performance problems with fls on FAT.
>>> 
>>> When listing the contents of a root directory (D:\) everything is ok.
>>> 
>>> When listing the contents of a first subdirectory (D:\sub1) everything is
>>> ok.
>>> 
>>> When listing the contents of a second subdirectory (D:\sub1\sub2) it
>>> scans the whole disk.
>>> 
>>> ---
>>> Suhanov Maxim
>>> 
>>> 2010/5/23, Brian Carrier <ca...@sl...>:
>>>> TSK 3.1.2 is available for download. This is a bug fix release.  It
>>>> contains
>>>> bug fixes for the FAT performance problems and some reading errors.
>>>> 
>>>> http://www.sleuthkit.org/
>>>> 
>>>> I'm working on some new features for a 3.2 release. They will be
>>>> announced
>>>> at the "Sleuth Kit and Open Source Forensics Conference" on June 9!
>>>> 
>>>> thanks,
>>>> brian
>>>> 
>>>> 
>>>> ------------------------------------------------------------------------------
>>>> 
>>>> _______________________________________________
>>>> sleuthkit-users mailing list
>>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>>> http://www.sleuthkit.org
>>>> 
>>> 
>>> ------------------------------------------------------------------------------
>>> 
>>> _______________________________________________
>>> sleuthkit-users mailing list
>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>> http://www.sleuthkit.org
>> 
>>