Re: [sleuthkit-users] TSK 4.3.0 Release

[Grundy B. J T. <Bar...@ti...>]

> -----Original Message-----
> From: RB [mailto:ao...@gm...]
> To: Brian Carrier
> Cc: sle...@li... users; sleuthkit-
> Subject: Re: [sleuthkit-users] TSK 4.3.0 Release
> 
> Thanks to all indeed for the continued work!

Agreed.
 
> While I know much of the work is predicated on what both analysts and
> developers are familiar with, I must confess my trepidation at seeing yet
> more Windows-only features creeping in.  We've already seen this happen
> with Autopsy, to the point that the tools' origin platform is now a third-class
> citizen.  With that same process now happening to the core tool, I start to
> worry that the process will complete and we who practice the art in, say,
> non-mainstream environments, will be left in the cold.

<slow_clap.gif>

I don't generally use Autopsy, but I have a very real fear of TSK's continued development following in its wake.

> How, exactly, is the libvmdk and libvhdi (both primarily developed on
> Linux) support Windows-only?  Their APIs aren't platform-sensitive, so is
> there at least a configure-time option to enable their use on other
> platforms?

I was just getting ready to test exactly this.  My first thought was perhaps Windows *guests* rather than platform support for the library features, but that makes no sense.  I'm hoping to test over the coming week as time allows.

/*******************************************
Barry J. Grundy
Assistant Special Agent in Charge
Digital Forensic Support Group
Treasury Inspector General for Tax Administration
(301) 210-8741 (desk)
(202) 527-5778 (cell)
Bar...@ti...
********************************************\