From: Brian Carrier <carrier@sl...> - 2010-01-13 20:40:55
New releases are way overdue and there is a lot of new stuff in TSK
3.1.0. New features include:
• HFS+ support
• Supports sectors that are not 512-bytes each (adds '-b' to each of
the command line tools)
• NTFS SID data is now available
• mactime is distributed with windows executables
• Better detection of GPT partitions and DOS safety partitions
• More AFFLIB formats and better support for encrypted files
• Sigfind can process non-raw files
• Better support for indirect blocks (adds back features that were
lost in 3.0.0)
• Many bug fixes.
for full details.
TSK is available from http://sleuthkit.org/sleuthkit/download.php.
Autopsy is available from http://sleuthkit.org/autopsy/download.php.
Going forward, my goal is to have at least quarterly releases to get
bug fixes out faster.