sleuthkit-users

[sleuthkit-users] Mac OS Extended (HSF+)

[<sle...@dn...>]

Yes, it looks like "Mac OS Extended" (HSF+ I think).

Can you recommend any other programs that will read deleted files off that type of file system?

The only thing I've been able to find so far is:
VirtualLab Data Recovery 3.7.9
http://www.macupdate.com/info.php/id/10031
which looks to be $99 per 1GB recovered--to much for me.

Thanks, 
Paul



-----Original Message-----
From: Brian
Sent: Sunday, January 09, 2005 11:06 AM
Cc: sle...@li...
Subject: Re: [sleuthkit-users] sleuthkit1.73 install prob MAC OS X
10.3.6



On Jan 7, 2005, at 5:38 PM, sle...@dn... wrote:

>
> First off, I'm using Sleuthkit/Autopsy browser to try to determine if 
> someone deleted files off a iMac with Mac OS 8.5/8.6 installed--is 
> this possible?

TSK/Autopsy does not support the HFS+ file system, so they will 
probably not do what you need.

> Installed on the Sleuthkit/Autopsy working hard drive is:
> Mac OS X 10.3.6 (upgraded from 10.3.2)
>
> I tried installing XCode Tools 1.1, but after install it said there 
> were errors and to try re-installing, so I installed the 
> gcc2.95.2.pkg, gcc3.1.pkg packages separately, successfully.  
> gcc3.3.pkg says, "gcc3.3 cannot be installed on this computer."

I think you should try to get XCode working if you want to compile it.  
I have never installed gcc directly, but according to Seth it may not 
include the header files that you need. So, I would try to get XCode 
working, but it may not even be what you need if you need to analyze 
HFS.

brian

Re: [sleuthkit-users] Mac OS Extended (HSF+)

[Rich T. <te...@ap...>]

You could try EnCase from Guidance Software, but at
$2,500 a pop, and having to use it on an Win PC- could
be prohibitive...

Rich


--- sle...@dn...,
UNEXPECTED_DATA_AFTER_ADDRESS@.SYNTAX-ERROR. wrote:

> 
> Yes, it looks like "Mac OS Extended" (HSF+ I think).
> 
> Can you recommend any other programs that will read
> deleted files off that type of file system?
> 
> The only thing I've been able to find so far is:
> VirtualLab Data Recovery 3.7.9
> http://www.macupdate.com/info.php/id/10031
> which looks to be $99 per 1GB recovered--to much for
> me.
> 
> Thanks, 
> Paul
> 
> 
> 
> -----Original Message-----
> From: Brian
> Sent: Sunday, January 09, 2005 11:06 AM
> Cc: sle...@li...
> Subject: Re: [sleuthkit-users] sleuthkit1.73 install
> prob MAC OS X
> 10.3.6
> 
> 
> 
> On Jan 7, 2005, at 5:38 PM, sle...@dn...
> wrote:
> 
> >
> > First off, I'm using Sleuthkit/Autopsy browser to
> try to determine if 
> > someone deleted files off a iMac with Mac OS
> 8.5/8.6 installed--is 
> > this possible?
> 
> TSK/Autopsy does not support the HFS+ file system,
> so they will 
> probably not do what you need.
> 
> > Installed on the Sleuthkit/Autopsy working hard
> drive is:
> > Mac OS X 10.3.6 (upgraded from 10.3.2)
> >
> > I tried installing XCode Tools 1.1, but after
> install it said there 
> > were errors and to try re-installing, so I
> installed the 
> > gcc2.95.2.pkg, gcc3.1.pkg packages separately,
> successfully.  
> > gcc3.3.pkg says, "gcc3.3 cannot be installed on
> this computer."
> 
> I think you should try to get XCode working if you
> want to compile it.  
> I have never installed gcc directly, but according
> to Seth it may not 
> include the header files that you need. So, I would
> try to get XCode 
> working, but it may not even be what you need if you
> need to analyze 
> HFS.
> 
> brian
> 
> 
> 
>
-------------------------------------------------------
> The SF.Net email is sponsored by: Beat the
> post-holiday blues
> Get a FREE limited edition SourceForge.net t-shirt
> from ThinkGeek.
> It's fun and FREE -- well,
> almost....http://www.thinkgeek.com/sfshirt
> _______________________________________________
> sleuthkit-users mailing list
>
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>