> On Jan 12, 2017, at 19:57, Ngie Cooper (yaneurabeya)
> wrote:
>
>
>> On Jan 12, 2017, at 18:14, Conrad Meyer wrote:
>>
>> Forgot to mention:
>>
>> Documentation:
>>
> On Jan 12, 2017, at 18:14, Conrad Meyer wrote:
>
> Forgot to mention:
>
> Documentation:
> https://www.sans.org/reading-room/whitepapers/forensics/reverse-engineering-microsoft-exfat-file-system-33274
>
> Images for testing: http://www.cfreds.nist.gov/dfr-test-images.html
Forgot to mention:
Documentation:
https://www.sans.org/reading-room/whitepapers/forensics/reverse-engineering-microsoft-exfat-file-system-33274
Images for testing: http://www.cfreds.nist.gov/dfr-test-images.html
(raw disk images, include partition tables)
On Thu, Jan 12, 2017 at 6:12 PM,
Author: cem
Date: Fri Jan 13 02:12:58 2017
New Revision: 312003
URL: https://svnweb.freebsd.org/changeset/base/312003
Log:
fstyp(8): Detect exFAT filesystems
Simply detect the exFAT filesystem name in the Volume Boot Record
(superblock).
PR: 214908
Reported by:
Added: