Joachim Metz

make clean 4.11.1 not adhering to configure --disable-java

1

running `make clean` with 4.11.1 after running`./configure --disable-java` complains about missing `ant` looks like https://github.com/sleuthkit/sleuthkit/blob/develop/bindings/java/Makefile.am#L22 is not adhering to configure --disable-java

How to obtain a MBR disk identity/identifier via the libtsk API?

Related issue https://github.com/py4n6/pytsk/issues/79 pytsk uses tsk_fs_attrlist_get_idx to access "TSK attributes" including extended attributes. This approach works for HFS+ extended attributes but fails for ext[2-4] extended attributes. What is the expected...

``` fsstat -o 239616 fuse/qcow1 FILE SYSTEM INFORMATION -------------------------------------------- File System Type: NTFS Volume Serial Number: XXXXXXXXXXXXXXXX OEM Name: NTFS Version: Windows XP ... ``` What does "Version: Windows XP"...

fat: tools fail on FAT-16 file system without 0xAA55 in the boot record

4

Tested on FAT-16 image created with https://github.com/dfirlabs/fat-specimens and manually set bytes 511 and 512 (starting with byte 1) to a value other than 0x55, 0xaa. Not tested this with FAT-12...

istat: incorrect NTFS date and time conversion

4

Istat does not correctly convert certain date and time values on NTFS ``` istat -V The Sleuth Kit ver 4.11.0 ``` ``` istat -o 206848 fuse/qcow1 55545 MFT Entry Header...

mactime -z does not work?

7

What is the expected behavior of `mactime -z` ? ``` mactime -b bodyfile -d -h Sat Jan 05 2019 12:39:59,0,macb,r/rrwxrwxrwx,0,0,34,"\emptyfile" Sat Jan 05 2019 12:39:59,84,macb,r/rrwxrwxrwx,0,0,34,"\emptyfile ($FILE_NAME)" ``` ``` mactime -b...