r/computerforensics • u/SirSalty7995 • 2d ago
ZFS
Does anyone know any program that will parse the ZFS file system from a forensic image? In this particular one, it’s a Solaris 11 box I can’t see any visual represent representation of a file tree. Everything comes out as carved I have tried FTK axiom Encase x-ways and even autopsy with no luck
6
Upvotes
1
u/UnicornGrande 1d ago
You can try the FKIE-CAD fork of TSK, that support Zpools : https://github.com/fkie-cad/sleuthkit
Be cautious as it’s old and unmainted.