Re: [sleuthkit-users] TSK Unicode support

[Brian C. <ca...@sl...>]

Yes, you are correct.   The patches exist for NTFS Unicode, but that 
does not change the strings issue because they are separate tools.

brian

On Jun 4, 2005, at 7:21 AM, youcef bichbiche wrote:

> Hi,
> Am I right in conlcuding that TSK doesnt support
> UNICODE not just at the presentation layer i.e. is not
> capable of converting the retreived string into a
> format that preserves their state like UTF8, but also
> at the analysis layer because the underlying tools
> used dont support UNICODE.
>
> for instance the informer 8 article says that Autopsy
> will not find UNICODE strings because it uses the
> 'string' command which displays only ASCII strings. So
> running 'grep' with any regular expression is futile
> afterwrds as the damage is already done.