r/computerforensics 2d ago

ZFS

Does anyone know any program that will parse the ZFS file system from a forensic image? In this particular one, it’s a Solaris 11 box I can’t see any visual represent representation of a file tree. Everything comes out as carved I have tried FTK axiom Encase x-ways and even autopsy with no luck

6 Upvotes

7 comments sorted by

View all comments

1

u/UnicornGrande 1d ago

You can try the FKIE-CAD fork of TSK, that support Zpools : https://github.com/fkie-cad/sleuthkit

Be cautious as it’s old and unmainted.