sleuthkit-users

Re: [sleuthkit-users] (no subject)

[Greg F. <gre...@gm...>]

http://www.dfrws.org/2008/proceedings/p76-burghardt.pdf
On Mar 20, 2012 7:25 AM, "Stefan Kelm" <sk...@bf...> wrote:

> Judson,
>
> > The reason for this (the long answer) is that HFS+ does not use a
> > mark-as-deleted system for deleting files. In HFS+, both file metadata
> and
> > the disk's entire directory structure are stored in a b-tree file, the
> > Catalog B-Tree. (Technically, in the leaf nodes of the b-tree.) When
> files
> > [...]
>
> Thanks a lot for sharing that information. Do you have a source for that
> info, or to put it differently, are there any (current) forensics books
> on HFS+?
>
> Cheers,
>
>        Stefan.
>
> --
> Stefan Kelm                   <sk...@bf...>
> BFK edv-consulting GmbH       http://www.bfk.de/
> Kriegsstrasse 100             Tel: +49-721-96201-1
> D-76133 Karlsruhe             Fax: +49-721-96201-99
>
>
> ------------------------------------------------------------------------------
> This SF email is sponsosred by:
> Try Windows Azure free for 90 days Click Here
> http://p.sf.net/sfu/sfd2d-msazure
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>

Re: [sleuthkit-users] (no subject)

[Greg G. <gre...@ya...>]

Thanks for that link, appreciated.

Greg

On Mar 20, 2012, at 04:37PDT, Greg Freemyer wrote:

> http://www.dfrws.org/2008/proceedings/p76-burghardt.pdf

Re: [sleuthkit-users] (no subject)

[L. G. 'P. <po...@lg...>]

Stefan,
In "iOS Forensic Analysis (for iPhone, iPad and iPod touch)" by Sean Morrissey (Apress, 2010) there is a chapter (page 25 and more specifically pages 33-onwards) dedicated to the HFSX filesystem, which has a lot in common with HFS+. I think it may be helpful.


--  
Luis Gómez 'Pope'
Enviado con Sparrow (http://www.sparrowmailapp.com/?sig)


El martes 20 de marzo de 2012 a las 12:09, Stefan Kelm escribió:

> Judson,
>  
> > The reason for this (the long answer) is that HFS+ does not use a
> > mark-as-deleted system for deleting files. In HFS+, both file metadata and
> > the disk's entire directory structure are stored in a b-tree file, the
> > Catalog B-Tree. (Technically, in the leaf nodes of the b-tree.) When files
> > [...]
> >  
>  
>  
> Thanks a lot for sharing that information. Do you have a source for that
> info, or to put it differently, are there any (current) forensics books
> on HFS+?
>  
> Cheers,
>  
> Stefan.
>  
> --  
> Stefan Kelm <sk...@bf... (mailto:sk...@bf...)>
> BFK edv-consulting GmbH http://www.bfk.de/
> Kriegsstrasse 100 Tel: +49-721-96201-1
> D-76133 Karlsruhe Fax: +49-721-96201-99
>  
> ------------------------------------------------------------------------------
> This SF email is sponsosred by:
> Try Windows Azure free for 90 days Click Here  
> http://p.sf.net/sfu/sfd2d-msazure
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>  
>  

Re: [sleuthkit-users] (no subject)

[Greg G. <gre...@ya...>]

Thanks for that info Luis, very much appreciated.

Greg

On Mar 20, 2012, at 05:16PDT, Luis Gómez 'Pope' wrote:

> Stefan,
> In "iOS Forensic Analysis (for iPhone, iPad and iPod touch)" by Sean Morrissey (Apress, 2010) there is a chapter (page 25 and more specifically pages 33-onwards) dedicated to the HFSX filesystem, which has a lot in common with HFS+. I think it may be helpful.
> 
> -- 
> Luis Gómez 'Pope'
> Enviado con Sparrow

[sleuthkit-users] (no subject)

[sandun c. <san...@gm...>]

Hi,

I am new to TSK and Libewf and tried to use following (latest) TSK, Libewf
and Zlib versions together to process E01 files.

sleuthkit-framework-win32-4.1.0
libewf-20130416
zlib-128

But it doesn't seem to be working. Can you please advice me on the
recommended compatible versions of these?

Please note that I built libewf myself (didn't build TSK) to use it in the
sleuthkit sharp

Thanks,
Nilanga

[sleuthkit-users] (no subject)

[Alan B. <ala...@gm...>]

New photorec carver is a great addition but only processing unallocated.
Definitely better support for carving of files in allocated such as
pagefil, shadow volumes, thumbcache,  etc. Option in photorec to choose
what files are extracted.
I too would like native support on Linux, have managed to run autopsy on
Ubuntu but photorec module only works on windows only.
Also generating reports that include bookmarked images should include a
thumbnail of the image with mac times.

Great work done on autopsy to date