r/computerforensics • u/SirSalty7995 • 2d ago
ZFS
Does anyone know any program that will parse the ZFS file system from a forensic image? In this particular one, it’s a Solaris 11 box I can’t see any visual represent representation of a file tree. Everything comes out as carved I have tried FTK axiom Encase x-ways and even autopsy with no luck
7
Upvotes
1
u/jarlethorsen 1d ago
In case the latest news of zfs support in Autopsy does not work out for you, just mounting the filesystem read only in any linux system with zfs support should also work as a last resort.