nps-2009-hfsjtest1
- A test image of a journaled HFS+ system in which the data from a previous version of one of the files can only be recovered from the HFS+ journal. Although the presence of this data can be verified on the disk using a hex editor, no forensic tool that we are aware of can attribute the data to the file from which it came.image.gen0
Acquisition Date: Not Available.
_hist_filesizes.png not available for this image. |
_cdf_filesizes.png not available for this image. |
_bplot_filetypes.png not available for this image. |
image.gen1
Acquisition Date: Not Available.
_hist_filesizes.png not available for this image. |
_cdf_filesizes.png not available for this image. |
_bplot_filetypes.png not available for this image. |