> Try AccessData FTK Imager
I tried it. Mounting the forensic image, later I see two disk, first is EFI but I can't see the second. I am analyzing an iMAC. So Windows Did'nt recognize HFS
In Autopsy I mount the forensic image
I see the content not the thumbnail
In the hex I see only this sequence 00,01,02,03,04,05 the stop zero byte
↧