TSK 3.0.0 and Autopsy 2.20 released

This major release of TSK contains many new library and tool features.

* Orphan files (deleted files that have a metadata structure, but do not have a parent directory that can be reached from the root directory) are now shown in the $OrphanFiles directory.
* The FAT file system MBR and File Allocation Tables are now accessible as files in the root directory.
* More deleted files are shown in each directory when using ‘fls’ (and the corresponding library API). This used to require running ‘ifind -p’ for each directory and it is now done automatically.
* New mmcat tool to output contents of a single volume.
* New mmls flags to list only specific volumes.
* Backup FAT MBRs are used, if the primary is corrupt.
* d* tools (dls, dcat, etc.) are now named blk* (blkls, blkcat, etc.)
* New ‘-b’ option in sorter to specify minimum file size.
* Added mingw support for cross compiling
* New library APIs and docs that do not require a callback design
* Minor bug fixes.

The Autopsy release contains updates to handle the new TSK features and
has some minor bug fixes.

http://www.sleuthkit.org

Leave a Comment

Latest Videos

Digital Forensics News Round Up, March 27 2024 #dfir #digitalforensics

Forensic Focus 27th March 2024 6:06 pm

Digital Forensics News Round-Up, March 21 2024 #digitalforensics #dfir

Forensic Focus 21st March 2024 6:15 pm

This error message is only visible to WordPress admins

Important: No API Key Entered.

Many features are not available without adding an API Key. Please go to the YouTube Feeds settings page to add an API key after following these instructions.

Latest Articles