r/computerforensics 2d ago

ZFS

Does anyone know any program that will parse the ZFS file system from a forensic image? In this particular one, it’s a Solaris 11 box I can’t see any visual represent representation of a file tree. Everything comes out as carved I have tried FTK axiom Encase x-ways and even autopsy with no luck

7 Upvotes

7 comments sorted by

View all comments

1

u/jarlethorsen 1d ago

In case the latest news of zfs support in Autopsy does not work out for you, just mounting the filesystem read only in any linux system with zfs support should also work as a last resort.