#DFIR Activating Hivemind - Anybody got pointers to info on forensic exam/acquisition of EXT4 ? We've got Encase 6.18, FTK3 and Open Source.
@BryanTheSnail DFF claims to support EXT4 but I've not tried it. Sleuthkit works at the fs and blk level but not higher.
Mar 31, 2011 · 10:27 PM UTC