@hal_pomeranz Are you seeing much forensics with systems using btrfs?

No, not at this time. This is a good thing since there isn’t good forensic tool support right now.

Yeah, we’ve started bouncing our heads (and our tools) against it. The file systems show up as remotely mounted. Very bizarre.