TSK 3.0.0 and Autopsy 2.20 released

This major release of TSK contains many new library and tool features.

* Orphan files (deleted files that have a metadata structure, but do not have a parent directory that can be reached from the root directory) are now shown in the $OrphanFiles directory.
* The FAT file system MBR and File Allocation Tables are now accessible as files in the root directory.
* More deleted files are shown in each directory when using ‘fls’ (and the corresponding library API). This used to require running ‘ifind -p’ for each directory and it is now done automatically.
* New mmcat tool to output contents of a single volume.
* New mmls flags to list only specific volumes.
* Backup FAT MBRs are used, if the primary is corrupt.
* d* tools (dls, dcat, etc.) are now named blk* (blkls, blkcat, etc.)
* New ‘-b’ option in sorter to specify minimum file size.
* Added mingw support for cross compiling
* New library APIs and docs that do not require a callback design
* Minor bug fixes.

The Autopsy release contains updates to handle the new TSK features and
has some minor bug fixes.

http://www.sleuthkit.org

Leave a Comment

Latest Videos

This error message is only visible to WordPress admins

Important: No API Key Entered.

Many features are not available without adding an API Key. Please go to the YouTube Feed settings page to add an API key after following these instructions.

Latest Articles

Share to...