Re: [sleuthkit-developers] Other FS

[Márcio C. <ma...@di...>]

On Fri, 2 Apr 2004 09:43:32 -0500, Brian Carrier <ca...@sl...> escreveu:
>
> Great. If you send me the link, I'll add it to the links page.
 
Oh, sorry, for now it's in portuguese. But, it's nothing big...
  
> I know of people who have talked about implementing Reiser, but nothing
> has been done as far as I know.  There is someone working on JFS.  I
> don't think I've heard of anyone doing XFS.  I don't have plans to add
> these in the near future.  I'm actually more inclined to add HFS+
> before any of the Linux-based ones.
 
Mmmm, HFS+ is a good one!
 
I saw that SMART should read Reiser, XFS, and others (http://www.securitywizardry.com/fortoolkits.htm):

"SMART can acquire digital evidence from a wide variety of workstations, servers and digital devices. SMART authenticates the data it acquires using any or all of the CRC32, MD5SUM and SHA1 algorithms. SMART also provides for the compression of data using standard Gzip or BZ2 compression, as well as a seekable compression format. SMART "understands" many file systems, including VFAT, NTFS, ext2, ext3, Reiser, HFS, HFS+, XFS, JFS, ISO9660, BeFS and many more. SMART can recover deleted files from these file systems and interpret file system meta-data such as date and time stamps, file attributes, etc. SMART enables complex searches to be conducted quickly and easily. Full GREP syntax, intelligent rules based options and fully automated recovery are possible without scripting or programming." 
I got a SMART demo once, but had no time to test it... :-/ And, it's commercial... :-(
 
Abraços,
 
Márcio.