Adding APFS Support to The Sleuthkit Framework

Joe Sylve discusses his work at DFRWS USA 2018.

Joe: So, as [Brad said], my name is Joe Sylve, I’m the Director of Research & Development at BlackBag Technologies. I’m going to talk about some work that we’ve done to integrate APFS support into the Sleuth Kit framework.

I was going to say that this might be a little bit of an awkward talk for me, but I’m not in a Santa suit, so I’m not going to say that anymore.

Joe: But the overview here is that we’ve got pretty full support for APFS and TSK, but the awkward part is that I can’t give it to you yet. Yeah, boo. BlackBag has been very nice and agreed to allow me to release the work. It’s just going to be released “soon”, because our commercial competitors haven’t really come close yet. But I would say [crosses fingers] … six months?

Read More

Leave a Comment