[sleuthkit-users] Question about TASK
Brought to you by:
carrier
From: Skip D. - T. S. <sk...@cy...> - 2002-09-17 19:35:03
|
During some security reading that I am fond of doing avery now and again, I found in phrack# 59 this article http://www.phrack.com/show.php?p=59&a=6 which talks about using the bad block inode to hide data that conventional tools such as TCT and TASK cannot locate. I was wondering if this had been fixed or even read by the maintainers of TASK... I was also wondering if there was planned support for some of the new filesystems that are available on linux, such as ext3, xfs, jfs, etc (or veritas support for that matter).. I'm also curious about computer forensics in general, as I have worked on compromised boxes before and would like to move from being a sysadmin to being into computer security... are there any decent resources out there on computer forensics? Thanks! Skip Duckwall |