Re: Forensics tools for HammerFS

On Mon, Aug 10, 2009 at 8:13 PM, Matthew Dillondil...@apollo.backplane.com wrote:    'hammer -f device show' will dump the media structures. Thanks for the reply Matt :-) How do I specify the device ? I did dfly-bkpsrv# disklabel /dev/ad4s1 | grep HAMMER h: 955801585 20971520HAMMER

Re: Forensics tools for HammerFS

: =A0 =A0undo -i filename will locate any retained history for a file or : =A0 =A0prior incarnation of a file, if it exists. : : :If the file exists or if the history exists? :It seems if I delete a file its history also vanishes. Is the HAMMER filesystem mounted normally or is it mounted

Re: Forensics tools for HammerFS

:HI, : :Are there any current Forensic tools that will work with a hammerfs :disk image amde by dd? :I guess sleuthkit and autopsy wont work. :And what is the best way to undelete a file from hammerfs for which no :snapshots are configured? : :Thanks : :--Siju 'hammer -f device show' will

Forensics tools for HammerFS

HI, Are there any current Forensic tools that will work with a hammerfs disk image amde by dd? I guess sleuthkit and autopsy wont work. And what is the best way to undelete a file from hammerfs for which no snapshots are configured? Thanks --Siju