Major Updates:
- Support for split and disk images
- File system type can be detected (-f no longer required)
- New file system type names (for -f)
- Updated internal design
- New 'img_stat' tool to display details about the image file format
- New 'mmls' flag (-b) to print sizes in bytes
- New 'mmstat' tool to give details about the volume (media
management) system
- Non-printable charactors in UFS/ExtX names are replaced with '.'
- New Linux 'disk_sreset' tool to reset HPA on an ATA disk
- Renamed 'diskstat' to 'disk_stat' and 'sstrings' to 'srch_strings'
to make names less cryptic
Minor Bug Fixes:
- NTFS could go into an infinite loop if attribute list entry was
reallocated
- Last block group in ExtX fsstat output had incorrect percentage
of free blocks
- FreeBSD 5.x would produce incorrect 'icat' output for Ext2/3 and
UFS1 images because it used a 64-bit on-disk address
Approved by: maintainer timeout
- Teach about FreeBSD 6.X (and thus unbreak)
- Honor CC and CFLAGS
- Tidy up Makefile and pkg-plist (use DOCSDIR macro)
- Do not build file(1) since it's the base already (and the same version)
Approved by: maintainer timeout
The @stake Sleuth Kit (TASK) is the only open source forensic
toolkit for a complete analysis of Microsoft and UNIX file
systems. TASK enables investigators to identify and recover
evidence from images acquired during incident response or
from live systems.
WWW: http://www.atstake.com/research/tools/task/
PR: ports/55545
Submitted by: Pieter Danhieux <pieter@securax.be>
