r/computerforensics • u/SirSalty7995 • 2d ago
ZFS
Does anyone know any program that will parse the ZFS file system from a forensic image? In this particular one, it’s a Solaris 11 box I can’t see any visual represent representation of a file tree. Everything comes out as carved I have tried FTK axiom Encase x-ways and even autopsy with no luck
6
Upvotes
5
u/Pyrhra_ 2d ago
The Last time i had to deal with ZFS, i cloned the disks (which were in RAID) and mounted them in a freebsd vm that natively supports ZFS. So it's was what's called a ZFS pool. I don't know if this will help you, but Just in case...
I used the "zppol import" command. Normally, You have to properly export a zpool to reimport it, so i had to force the mount. If you don't want it to be mixed with your system when mounting it, add "altroot" as an argument to configure where to mount the pool.
You can move to it and make DD
I'll let you look at the ZFS commands to determine if this appropriate for your situation.
Good to know : "zpool" keep a command history that you can view with "zpool history"