[sleuthkit-developers] stop-gap capabilities...

[t f <dor...@ho...>]

hello, brian.

first, i wish to commend you on your excellent work with the sleuthkit.

i have a few questions:

1)  what's the status of integrating utf8 support for both FAT and NTFS 
filesystems?

2)  what's the status of the io subsystem patch?  that sounded very 
promising, but i haven't seen much chatter about it in the past few weeks on 
the list.


(This last one is more a request for the group to ponder...I really do want 
to hear something back, so don't ponder indefinitely.)

3)  don't you suppose it's better to offer OS-specific (LKM-based) 
filesystem access as a stop-gap measure than to leave the capability out 
completely?  The code seems to be structured in a fairly modular way to 
allow you to "drop in" fileystem drivers...Why not give folks the option of 
pointing your code at the existing (be they OSX and/or *nix) hfs+ and ufs2 
drivers??  It gives them more flexibility, and allows them to use sleuthkit 
for those cases NOW, while you coordinate coding of your own cross-platform 
drivers.

IMO, folks will not shy away from a case because sleuthkit doesn't support 
the filesystem...They'll just use something else.  I understand that you're 
not directly profiting from use of your product to conduct examinations, but 
there is definitely a lot of potential here...

thanks for hearing me out.

-dorkus

_________________________________________________________________
Check out MSN PC Safety & Security to help ensure your PC is protected and 
safe. http://specials.msn.com/msn/security.asp