Top Ad unit 728 × 90

Latest News


Daily Blog #574: Forensic Lunch 12/21/18 Alissa Torres, Dr. Joe Sylve

Hello Reader,
        Today we had another Forensic Lunch! This week we had:

What a great show! You can watch the video here:

Daily Blog #574: Forensic Lunch 12/21/18 Alissa Torres, Dr. Joe Sylve Reviewed by David Cowen on December 21, 2018 Rating: 5

1 comment:

  1. David a couple of corrections:

    * libfsapfs (and therefore pyfsapfs, dfVFS and plaso) does support encryption also see readme: and the plaso release notes:
    * the testing I did with sleuthkit-APFS was on the first test images I could find (, no particular thorough testing (on the contrary) as Matthew might be implying (not sure from his comment)
    * In contrast what Joe says, an APFS container does not contain an unlimited amount of volumes, the current format maximum is 100 and there are restrictions to what size the container must be. This was also highlighted by the paper "Decoding the APFS file system"

    Regarding APFS having no journal, (as Joe explained in technical terms) the file system is the journal. A thing Joe did not highlight in the conversation about recovery and snapshots, APFS decouples low-level block storage and file-system level storage, this can make recovery more challenging.


All Rights Reserved by Hacking Exposed Computer Forensics Blog © 2014 - 2020
Powered By Blogger, Designed by Sweetheme

Contact Form


Email *

Message *

Powered by Blogger.