[sleuthkit-developers] HFS+ Support for SleuthKit.

[Wyatt B. <wb...@cr...>]

Support for HFS+ file systems is a feature that is being developed.  There
is a version that the code ships with version 2.03 at present.  To use it
just uncomment hfs.o, hfs_dent.o and hfs_journal.o from the Makefile in
src/fstools.

The support for HFS+ is working but is undergoing some changes at present to
allow faster, more efficient searching for inodes, among other changes.

This code is not officially in the mainstream release of The Sleuth Kit at
present.  When the final changes are made to these files then can begin the
process of verifying the integrity and accuracy of the code contained
therein.

I hope this was helpful. :-)

Wyatt Banks
Crucial Security
14900 Conference Center Drive
Chantilly, VA 20151
www.crucialsecurity.com

-----Original Message-----
From: sle...@li...
[mailto:sle...@li...] On Behalf Of
sle...@li...
Sent: Sunday, November 13, 2005 11:39 PM
To: sle...@li...
Subject: sleuthkit-developers digest, Vol 1 #71 - 1 msg

Send sleuthkit-developers mailing list submissions to
	sle...@li...

To subscribe or unsubscribe via the World Wide Web, visit
	https://lists.sourceforge.net/lists/listinfo/sleuthkit-developers
or, via email, send a message with subject or body 'help' to
	sle...@li...

You can reach the person managing the list at
	sle...@li...

When replying, please edit your Subject line so it is more specific
than "Re: Contents of sleuthkit-developers digest..."


Today's Topics:

   1. sleuthkit and HFS+ file systems (Scott Turnbull)

--__--__--

Message: 1
To: sle...@li...
From: Scott Turnbull <sco...@ao...>
Date: Mon, 14 Nov 2005 04:21:24 +0000
Subject: [sleuthkit-developers] sleuthkit and HFS+ file systems


--Apple-Mail-1--983938232
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
	charset=US-ASCII;
	format=flowed

Are there any plans to add support for Apple HFS+ file systems?

Currently the only semi-usable tool I've come across is hfsdebug, which 
is neither very
comprehensive nor open source.  There appears to be adequate 
documentation out-there;
I'm thinking specifically about ADC Technical Note TN1150.

By the way, File System Forensic Analysis is a terrific resource.

Scott Turnbull

--Apple-Mail-1--983938232
Content-Transfer-Encoding: 7bit
Content-Type: text/enriched;
	charset=US-ASCII

Are there any plans to add support for Apple HFS+ file systems?


Currently the only semi-usable tool I've come across is
<italic>hfsdebug</italic>, which is neither very

comprehensive nor open source.  There appears to be adequate
documentation out-there;

I'm thinking specifically about ADC Technical Note TN1150.


By the way, <italic>File System Forensic Analysis</italic> is a
terrific resource.


Scott Turnbull

--Apple-Mail-1--983938232--



--__--__--

_______________________________________________
sleuthkit-developers mailing list
sle...@li...
https://lists.sourceforge.net/lists/listinfo/sleuthkit-developers


End of sleuthkit-developers Digest