Sleuth Kit Informer

http://www.sleuthkit.org/informer Brian Carrier carrier at sleuthkit dot org Issue #23 May 17, 2006 Contents Introduction What's New? Call For Papers Expert Witness and AFF Support An Introduction To The libewf Expert Witness Library Introduction In the 23 rd issue of the Informer, we look at some of the new features in version 2.04 of The Sleuth Kit. Specifically, we focus on new image file formats. The first article is about how to use TSK with the formats and the second is about the library that was developed by Joachim Metz and Robert-Jan Mora to support the Expert Witness Format. What's New? New versions of The Sl...

http://www.sleuthkit.org/informer Brian Carrier carrier at sleuthkit dot org Issue #22 March 15, 2006 Contents Introduction What's New? Call For Papers Current disk_stat Limitations TSK Libraries Introduction In the 22nd issue of The Sleuth Kit Informer, we address some of the features and limitations of the disk_stat tool in The Sleuth Kit and we address the design of the TSK libraries. The latter article is oriented towards developers who are interested in using TSK as part of their projects. What's New? There have not been any new releases of TSK or Autopsy since the last issue of the Informer, but a new version of ...

http://www.sleuthkit.org/informer http://sleuthkit.sourceforge.net/informer Brian Carrier carrier at sleuthkit dot org Issue #21 November 15, 2005 Contents Introduction What's New? Call For Papers New Sleuth Kit Licenses FAT and ils Changes Introduction This issue of The Sleuth Kit Informer is long over due. Many asked if the Informer was no longer being published, but the truth is that there were too many other things going on. This issue is about changes that occured in the most recent releases of The Sleuth Kit and Autopsy. The first article is about new license changes and the second is about how the ils to...

http://www.sleuthkit.org/informer http://sleuthkit.sourceforge.net/informer Brian Carrier carrier at sleuthkit dot org Issue #20 May 15, 2005 Contents Introduction What's New? Call For Papers Removing Host Protected Areas (HPA) in Linux Automatic Type Detection Introduction This issue of The Sleuth Kit Informer is about new tools and features that were added to version 2.00 of The Sleuth Kit (TSK). The first article describes how to remove Host Protected Areas (HPA) from ATA disks using the disk_sreset tool and the second article describes the new automatic type detection features for file and volume systems. W...

http://www.sleuthkit.org/informer http://sleuthkit.sourceforge.net/informer Brian Carrier carrier at sleuthkit dot org Issue #19 March 15, 2005 Contents Introduction What's New? Call For Papers New Image File Support Hooking IO Calls for Multi-Format Image Support (By: Michael Cohen) Introduction This issue of the Informer is unique because it has articles that describe two different approaches to the same problem. The first main article describes the new image file features in The Sleuth Kit version 2, which supports disk and split image files. The second article is by Michael Cohen and it describes how PyFlag...

http://www.sleuthkit.org/informer http://sleuthkit.sourceforge.net/informer Brian Carrier carrier at sleuthkit dot org Issue #18 January 15, 2005 Contents Introduction What's New? Call For Papers Description of the FAT fsstat Output Introduction This 18th issue of The Informer provides a detailed description of the fsstat tool in The Sleuth Kit (TSK). The purpose of this article and future ones like it is to better document some of the TSK tools, especially those that provide large amounts of information. This article is about fsstat and the FAT file system and future articles will describe other tools and file...

http://www.sleuthkit.org/informer http://sleuthkit.sourceforge.net/informer Brian Carrier carrier at sleuthkit dot org Issue #17 November 15, 2004 Contents Introduction What's New? Call For Papers Detecting Host Protected Areas (HPA) in Linux Finding Binary Signatures Introduction This issue of The Sleuth Kit Informer is about new tools. The 1.73 release of The Sleuth Kit (TSK) included many new tools (as listed in What's New). In this issue, we look at the new 'diskstat' tool for detecting Host Protected Areas (HPA) and the 'sigfind' tool for finding binary signatures. What's New? Versi...

http://www.sleuthkit.org/informer http://sleuthkit.sourceforge.net/informer Brian Carrier carrier at sleuthkit dot org Issue #16 September 15, 2004 Contents Introduction What's New? Call For Papers Searchtools, Indexed Searching in Forensic Images (By: Paul Bakker) sstrings and Unicode Searching NTFS Orphan Files Introduction In this issue of The Sleuth Kit Informer, we have two articles on keyword searching and one on deleted file recovery in NTFS. All three articles are based on new features that have been integrated into recent versions of TSK and Autopsy or that are planned to be integrated into version 2. ...

http://www.sleuthkit.org/informer http://sleuthkit.sourceforge.net/informer Brian Carrier carrier at sleuthkit dot org Issue #15 July 15, 2004 Contents Introduction What's New? Call For Papers Partition Recovery With TestDisk (Christophe Grenier) File Name Searching In Autopsy Introduction This issue of The Sleuth Kit Informer includes an article from Christophe Grenier on using the TestDisk program. TestDisk is an open source tool that can be used recover partitions and file systems when the partition table is missing or corrupt. This issue also has a short article on the new file name searching feature of Aut...

http://www.sleuthkit.org/informer http://sleuthkit.sourceforge.net/informer Brian Carrier carrier at sleuthkit dot org Issue #14 May 15, 2004 Contents Introduction What's New? Call For Papers TSK FAT File Recovery Introduction In this 14 th article of The Sleuth Kit Informer, I have an article on FAT file recovery in The Sleuth Kit. This new functionality will be included in the 1.70 release of TSK, which will be released in late May. The purpose of this article is to describe how it is being implemented and what its limitations are. What's New? Version 2.00 of Autopsy was released on March 19, 2004. This v...