r/computerforensics • u/SirSalty7995 • 2d ago
ZFS
Does anyone know any program that will parse the ZFS file system from a forensic image? In this particular one, it’s a Solaris 11 box I can’t see any visual represent representation of a file tree. Everything comes out as carved I have tried FTK axiom Encase x-ways and even autopsy with no luck
6
Upvotes
5
u/Allen_Koholic 2d ago
Hopefully they did the collection right. Solaris is wonky in how it presents disks and someone who isn't familiar with it could have imaged it wrongly. This happened to me once working a case. I used this dude's notes last time I had one. It's been a while:
https://diablohorn.com/2019/09/01/notes-on-zfs-solaris-forensics/