ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.

Difference between pages "FTimes" and "Ext2"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(Fixed Infobox, added Limitations, DFRWS challange info.)
 
 
Line 1: Line 1:
{{Infobox_Software |
+
'''ext2''' or the '''second extended file system''' is a [[Linux]] filesystem designed as a replacement for ext. Note that [[ext3]] is mostly compatible with ext2.
  name = FTimes |
+
  maintainer = [[Klayton Monroe]] |
+
  os = {{Multiplatform}} |
+
  genre = [[Evidence collection]] |
+
  license = {{BSD}} |
+
  website = [http://ftimes.sourceforge.net/ ftimes.sf.net] |
+
}}
+
  
'''FTimes''', short for '''File Topography and Integrity Monitoring on an Enterprise Scale''' is a system baselining and evidence collection tool designed for incident response, evidence collection (alternate data streams, hidden files), content integrity monitoring, intrusion analysis and computer forensics.
+
The [[Sleuthkit]] and [[R-Studio]] can be used to perform recovery of data from the EXT2 filesystem. Various data carving tools like [[Foremost]] and [[Scalpel]] also support the ext2 filesystem.
  
== Limitations ==
+
== See Also ==
 
+
* [[ext3]]
FTimes does not collect all possible attributes on every supported platform.
+
  
 
== External Links ==
 
== External Links ==
  
* [http://ftimes.sourceforge.net/ The FTimes Project Homepage]
+
* [http://en.wikipedia.org/wiki/Ext2 Wikipedia article on EXT2]
* [http://unixsadm.blogspot.com/2007/11/building-ftimes-on-windows-using-visual.html Building FTimes on Windows using Visual Studio]
+
* [http://www.nongnu.org./ext2-doc/ext2.html Layout of the EXT2 Filesystem]
* [http://www.korelogic.com/Resources/Projects/dfrws_challenge_2006/ DFRWS 2006 File Carving Challenge - using FTimes]
+
* [http://fedora.linuxsir.org/doc/ext2undelete/Ext2fs-Undeletion.html Linux Ext2fs Undeletion mini-HOWTO]
 +
* [http://unixsadm.blogspot.com/2007/11/ext2-filesystem-for-linux-and-solaris.html Using ext2 on other systems]
 +
 
 +
[[Category:File Systems]]

Revision as of 08:07, 31 July 2012

ext2 or the second extended file system is a Linux filesystem designed as a replacement for ext. Note that ext3 is mostly compatible with ext2.

The Sleuthkit and R-Studio can be used to perform recovery of data from the EXT2 filesystem. Various data carving tools like Foremost and Scalpel also support the ext2 filesystem.

See Also

External Links