Yes, you are correct. The patches exist for NTFS Unicode, but that
does not change the strings issue because they are separate tools.
brian
On Jun 4, 2005, at 7:21 AM, youcef bichbiche wrote:
> Hi,
> Am I right in conlcuding that TSK doesnt support
> UNICODE not just at the presentation layer i.e. is not
> capable of converting the retreived string into a
> format that preserves their state like UTF8, but also
> at the analysis layer because the underlying tools
> used dont support UNICODE.
>
> for instance the informer 8 article says that Autopsy
> will not find UNICODE strings because it uses the
> 'string' command which displays only ASCII strings. So
> running 'grep' with any regular expression is futile
> afterwrds as the damage is already done.
|
