dfvfs
dfvfs copied to clipboard
Add traditional HFS support
Add (traditional) HFS support to libfshfs and make corresponding changes to dfVFS
This is more nice to have than must have by now
- [x] ~~add traditional HFS test image - https://github.com/log2timeline/dfvfs/pull/596~~
- [ ] make changes to libfshfs https://github.com/libyal/libfshfs/issues/3
- [ ] make changes to dfVFS HFS file system analyzer
Looks like libtsk does not support traditional HFS
fls -f hfs hfs.image
Invalid magic value (HFS file systems (other than wrappers HFS+/HFSX file systems) are not supported)
The documentation (a bit misleading) points it out as well, from https://wiki.sleuthkit.org/index.php?title=HFS
HFS file systems (not HFS+ or HFSX) are not supported by TSK.