Received from Brian Carrier:
New versions of TSK and Autopsy are now available (after the longest
duration of no releases in the history of the tools). There are several
new features including Expert Witness (EnCase) images, AFF images, and ISO
9660 file systems, which were primarily developed by people other than
myself (see below). There are also new features that are listed below.
Bug Fixes
o Verbose statement in img_open could cause a crash (Wyatt Banks).
o NTFS sanity check improvements (Wyatt Banks)
o Indirect blocks for Ext2 and UFS were not found (reported by Bernhard
Reiter) o File names in UFS and Ext may not be shown if first entry is
unallocated (reported by John Langezaal)
Updates
o Expert Witness (EnCase) image file support using libewf (Joachim Metz
and Robert Jan Mora). o Advanced File Format image file support using
AFFLIB (Simson Garfinkel). o ISO 9660 file system support (Wyatt Banks,
Crucial Security) o mmls now displays the unpartitioned space at end of
disk (suggested by Wyatt Banks). o New img_cat tool to output the raw
contents of an image file. o Improved internal error handling for library
usage. o New internal flag FS_FLAG_DATA_RES to show resident data during a
file walk. o The file system byte offset is now passed to the file system
code instead of imgtools, this allows for better library usage.
Autopsy
Bug Fixes:
o incorrect variable name fix .
Updates
o Support for Expert Witness and AFF file formats
o Support for ISO9660 file systems
o Hex view for file analysis
TSK 2.04 MD5: abb1511e2ec53c6d34d745a348c94b33
Autopsy 2.07 MD5: c7dab20ab26fd04404ccd199e1c05c7a
