Collaborate Disseminate
Recently there has been some questions on the forums and Twitter as to how to mount forensic disk images that were captured from Mac system that implemented 4k block sizes. A few years ago, Mac systems started to use 4k blocks instead of 512 byte block… Continue reading Mount All the Things! – Mounting APFS and 4k Disk Images on macOS 10.13
Updated HFS+ Grammars:
My Synalyze It! HFS+ grammars have been updated thanks to some feedback from ‘Cugu’ who pointed out an error in the Reserved Field in the Header Record. It should have been 4×16 bytes, not just 4 bytes. Thanks ‘Cugu’! The updated grammars can be accessed in the Resources Section.
Windows & Linux Support:
Windows and Linux support for the Synalyze It! Grammars are now available by using Hexinator by the same creator as Synalyze It! This program appears to be free as of this writing. Hexinator works and feels just like Synalyze It!
An example of Hexinator with my HFS+ Catalog File Grammar.
Continue reading HFS+ Grammar Updates – Now with Windows & Linux Support!
