Of course I know the SleuthKit and Autopsy however it was a long time when I used it last time so I'll be happy to take a look at it now. IMHO it's a best "last chance" tool set when everything else will fail. Especially when you trying to analyze systems based on ExtX partitions - all main tools like EnCase or FTK are quite poor in this field.
Thank you for suggestion and we'll consider to help creating modules for Autopsy as well.
Best regards,
Chris BB
↧