Thread: [sleuthkit-users] TSK - APFS and Snapshots

Brought to you by: carrier

sleuthkit-users

[sleuthkit-users] TSK - APFS and Snapshots

From: Michael G. <mgo...@gm...> - 2019-03-14 18:03:24

I know that BlackLight incorporates TSK in its framework, and BlackLight is able to process APFS Snapshots in either Windows or macOS versions of BlackLight. Does TSK now parse APFS and APFS snapshots in either macOS or Windows versions?

Re: [sleuthkit-users] TSK - APFS and Snapshots

From: John L. <slo...@gm...> - 2019-03-14 18:25:15

If you compile this version of TSK you can achieve support for APFS:

https://github.com/blackbagtech/sleuthkit-APFS

AFAIK, the APFS support has not been merged with the TSK main development branch.

From: Michael Godfrey
Sent: Thursday, March 14, 2019 11:04
To: sle...@li...
Subject: [sleuthkit-users] TSK - APFS and Snapshots

I know that BlackLight incorporates TSK in its framework, and BlackLight is able to process APFS Snapshots in either Windows or macOS versions of BlackLight. Does TSK now parse APFS and APFS snapshots in either macOS or Windows versions?

_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org