sleuthkit-users

[sleuthkit-users] Current/future status of HFS+ support?

[Brian Smith-S. <ti...@ny...>]

Hey folks,

I recently had to perform an analysis on an OS X box using HFS+ and was
surprised to find Sleuthkit didn't support HFS+.  I grep'd through the
mail archives and found one note about it working if you uncommented the
relevant lines, and then another later post stating it's unsupported.
It is mentioned in the CHANGES file though.

2.06 won't compile with the HFS+ stuff uncommented.  2.03 would, but I
ended up with most of the filesystem utilities giving me back the
following error:

unknown filesystem type: hfs+
known types:
        ext (Ext2/Ext3)
        fat (FAT12/16/32)
        ntfs (NTFS)
        hfs (HFS+)
        ufs (UFS 1 & 2)
        raw (Raw Data)
        swap (Swap Space)

So clearly I did something wrong; that something may have been
attempting to use Sleuthkit for this purpose.  Is there any way to get
HFS+ working, and if not is there any intention to get this working in
the future?

Cheers,
Brian

Re: [sleuthkit-users] Current/future status of HFS+ support?

[Barry J. G. <bg...@im...>]

On Mon, 2006-10-30 at 09:51 -0500, Brian Smith-Sweeney wrote:

> unknown filesystem type: hfs+
> known types:
...
>         hfs (HFS+)
...

The error is telling you that "hfs+" is an incorrect argument.  It then
goes on to tell you that "hfs" is the correct argument for HFS+...
Rerun your commands with just "hfs" (drop the +) and see if that helps.

Barry
NASA OIG CCD

! WARNING !  This email including any attachments is intended only for
authorized recipients.  Recipients may only forward this information as
authorized.  This email may contain non-public information that is "Law
Enforcement Sensitive," "Sensitive but Unclassified," or otherwise
subject to the Privacy Act and/or legal and other applicable privileges
that restrict release without appropriate legal authority and clearance.
Accordingly, the use, dissemination, distribution or reproduction of
this information to or by unauthorized or unintended recipients,
including but not limited to non-NASA recipients, may be unlawful.

Re: [sleuthkit-users] Current/future status of HFS+ support?

[Brian Smith-S. <ti...@ny...>]

Barry J. Grundy wrote:
> On Mon, 2006-10-30 at 09:51 -0500, Brian Smith-Sweeney wrote:
> 
>> unknown filesystem type: hfs+
>> known types:
> ...
>>         hfs (HFS+)
> ...
> 
> The error is telling you that "hfs+" is an incorrect argument.  It then
> goes on to tell you that "hfs" is the correct argument for HFS+...
> Rerun your commands with just "hfs" (drop the +) and see if that helps.
> 
Sorry, that was a typo this morning when I was re-running the command to
recreate the error.  Previously I had typed it correctly; I just
confirmed this again:

unknown filesystem type: hfs
known types:
        ext (Ext2/Ext3)
        fat (FAT12/16/32)
        ntfs (NTFS)
        hfs (HFS+)
        ufs (UFS 1 & 2)
        raw (Raw Data)
        swap (Swap Space)

Re: [sleuthkit-users] Current/future status of HFS+ support?

[Brian C. <ca...@sl...>]

You probably did not uncomment enough code in fs_open.c (or fs_types.c) 
if you are getting that error message.  HFS+ will not compile with the 
latest versions because there have been many internal changes and 
improvements that were not made to HFS+.  Wyatt Banks has been the main 
person for HFS+, so he can better comment on what its status is.

brian

Brian Smith-Sweeney wrote:
> Barry J. Grundy wrote:
>> On Mon, 2006-10-30 at 09:51 -0500, Brian Smith-Sweeney wrote:
>>
>>> unknown filesystem type: hfs+
>>> known types:
>> ...
>>>         hfs (HFS+)
>> ...
>>
>> The error is telling you that "hfs+" is an incorrect argument.  It then
>> goes on to tell you that "hfs" is the correct argument for HFS+...
>> Rerun your commands with just "hfs" (drop the +) and see if that helps.
>>
> Sorry, that was a typo this morning when I was re-running the command to
> recreate the error.  Previously I had typed it correctly; I just
> confirmed this again:
> 
> unknown filesystem type: hfs
> known types:
>         ext (Ext2/Ext3)
>         fat (FAT12/16/32)
>         ntfs (NTFS)
>         hfs (HFS+)
>         ufs (UFS 1 & 2)
>         raw (Raw Data)
>         swap (Swap Space)
> 
> -------------------------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org