[sleuthkit-users] Very newbie questions on TST on Macosx

[Philippe de R. <phi...@ww...>]

Hello,

I have just installed TST to learn more about the Macosx file system.

When I do df -h, I get the following:

Filesystem                Size   Used  Avail Capacity  Mounted on
/dev/disk0s3               74G    12G    62G    16%    /
devfs                      97K    97K     0B   100%    /dev
fdesc                     1.0K   1.0K     0B   100%    /dev
<volfs>                   512K   512K     0B   100%    /.vol
...

What are devfs, fdesc and <volfs>?

Can I analyze /dev/disk0s3 with mmls? When I do mmls /dev/dsik0s3, I  
get a message saying that the disk is read-only. Should I sudo mmls / 
dev/dsik0s3?

Many thanks.

Philippe