[sleuthkit-users] Current/future status of HFS+ support?

[Brian Smith-S. <ti...@ny...>]

Hey folks,

I recently had to perform an analysis on an OS X box using HFS+ and was
surprised to find Sleuthkit didn't support HFS+.  I grep'd through the
mail archives and found one note about it working if you uncommented the
relevant lines, and then another later post stating it's unsupported.
It is mentioned in the CHANGES file though.

2.06 won't compile with the HFS+ stuff uncommented.  2.03 would, but I
ended up with most of the filesystem utilities giving me back the
following error:

unknown filesystem type: hfs+
known types:
        ext (Ext2/Ext3)
        fat (FAT12/16/32)
        ntfs (NTFS)
        hfs (HFS+)
        ufs (UFS 1 & 2)
        raw (Raw Data)
        swap (Swap Space)

So clearly I did something wrong; that something may have been
attempting to use Sleuthkit for this purpose.  Is there any way to get
HFS+ working, and if not is there any intention to get this working in
the future?

Cheers,
Brian