[sleuthkit-users] TSK 2.04 and Autopsy 2.07 release

[Brian C. <ca...@sl...>]

New versions of TSK and Autopsy are now available (after the longest 
duration of no releases in the history of the tools).  There are several 
new features including Expert Witness (EnCase) images, AFF images, and 
ISO 9660 file systems, which were primarily developed by people other 
than myself (see below).  There are also new features that are listed below.

http://www.sleuthkit.org


TSK

Bug Fixes
o Verbose statement in img_open could cause a crash (Wyatt Banks).
o NTFS sanity check improvements (Wyatt Banks)
o Indirect blocks for Ext2 and UFS were not found (reported by Bernhard 
Reiter)
o File names in UFS and Ext may not be shown if first entry is 
unallocated (reported by John Langezaal)

Updates
o Expert Witness (EnCase) image file support using libewf (Joachim Metz 
and Robert Jan Mora).
o Advanced File Format image file support using AFFLIB (Simson Garfinkel).
o ISO 9660 file system support (Wyatt Banks, Crucial Security)
o mmls now displays the unpartitioned space at end of disk (suggested by 
Wyatt Banks).
o New img_cat tool to output the raw contents of an image file.
o Improved internal error handling for library usage.
o New internal flag FS_FLAG_DATA_RES to show resident data during a file 
walk.
o The file system byte offset is now passed to the file system code 
instead of imgtools, this allows for better library usage.


Autopsy

Bug Fixes:
o incorrect variable name fix .

Updates
o Support for Expert Witness and AFF file formats
o Support for ISO9660 file systems
o Hex view for file analysis


TSK 2.04 MD5: abb1511e2ec53c6d34d745a348c94b33
Autopsy 2.07 MD5: c7dab20ab26fd04404ccd199e1c05c7a