dfvfs icon indicating copy to clipboard operation
dfvfs copied to clipboard

Add traditional HFS support

Open joachimmetz opened this issue 3 years ago • 1 comments

Add (traditional) HFS support to libfshfs and make corresponding changes to dfVFS

This is more nice to have than must have by now

  • [x] ~~add traditional HFS test image - https://github.com/log2timeline/dfvfs/pull/596~~
  • [ ] make changes to libfshfs https://github.com/libyal/libfshfs/issues/3
  • [ ] make changes to dfVFS HFS file system analyzer

joachimmetz avatar Nov 03 '20 15:11 joachimmetz

Looks like libtsk does not support traditional HFS

fls -f hfs hfs.image
Invalid magic value (HFS file systems (other than wrappers HFS+/HFSX file systems) are not supported)

The documentation (a bit misleading) points it out as well, from https://wiki.sleuthkit.org/index.php?title=HFS

HFS file systems (not HFS+ or HFSX) are not supported by TSK.

joachimmetz avatar Jul 31 '21 13:07 joachimmetz