Re: [sleuthkit-users] Urgent

[RB <ao...@gm...>]

On Sat, Mar 15, 2014 at 12:41 PM, Emmanuelle Delouvée
<emm...@gm...> wrote:
> Hi,
> Question to the SCALPEL developer team :
>
> Scalpel runs native on Mac OS X, which uses two filesystems : AFS ( "Apple File System », a Legacy From Mac OS 9 ) and UFS ( « Unix File System », From BSD - where it’s called FFS, for « Fast File System » ).
> Obviously, Scalpel’s got to be able to scan/carve both Filesystem.
> FREEBSD, as a member of the BSD UNIX Family, uses FFS (UFS) too : so, logically, Scalpel - say, the Linux version of it - ought to be able to properly scan/carve disk partitions formatted in FFS by FREEBSD; am I correct ?

Scalpel running on a given platform has nothing to do with what
filesystems it supports.  In fact, a quick glance at the source tree
tells me it is unlikely Scalpel directly parses any filesystem
structure, instead it just looks for signatures on disk.  This means
your files will need to have been laid down contiguously with a
recognizable head/tail for it to work.

So sure - if FFS mostly just places files on the disk in contiguous
chunks, Scalpel should be able to parse it just fine.