Difference between pages "FTimes" and "Ext2"

From Forensics Wiki
(Difference between pages)
Jump to: navigation, search
(Fixed Infobox, added Limitations, DFRWS challange info.)
 
 
Line 1: Line 1:
{{Infobox_Software |
+
'''ext2''' or the '''second extended file system''' is a [[Linux]] filesystem designed as a replacement for ext. Note that [[ext3]] is mostly compatible with ext2.
  name = FTimes |
+
  maintainer = [[Klayton Monroe]] |
+
  os = {{Multiplatform}} |
+
  genre = [[Evidence collection]] |
+
  license = {{BSD}} |
+
  website = [http://ftimes.sourceforge.net/ ftimes.sf.net] |
+
}}
+
  
'''FTimes''', short for '''File Topography and Integrity Monitoring on an Enterprise Scale''' is a system baselining and evidence collection tool designed for incident response, evidence collection (alternate data streams, hidden files), content integrity monitoring, intrusion analysis and computer forensics.
+
The [[Sleuthkit]] and [[R-Studio]] can be used to perform recovery of data from the EXT2 filesystem. Various data carving tools like [[Foremost]] and [[Scalpel]] also support the ext2 filesystem.
  
== Limitations ==
+
== See Also ==
 
+
* [[ext3]]
FTimes does not collect all possible attributes on every supported platform.
+
  
 
== External Links ==
 
== External Links ==
  
* [http://ftimes.sourceforge.net/ The FTimes Project Homepage]
+
* [http://en.wikipedia.org/wiki/Ext2 Wikipedia article on EXT2]
* [http://unixsadm.blogspot.com/2007/11/building-ftimes-on-windows-using-visual.html Building FTimes on Windows using Visual Studio]
+
* [http://www.nongnu.org./ext2-doc/ext2.html Layout of the EXT2 Filesystem]
* [http://www.korelogic.com/Resources/Projects/dfrws_challenge_2006/ DFRWS 2006 File Carving Challenge - using FTimes]
+
* [http://fedora.linuxsir.org/doc/ext2undelete/Ext2fs-Undeletion.html Linux Ext2fs Undeletion mini-HOWTO]
 +
* [http://unixsadm.blogspot.com/2007/11/ext2-filesystem-for-linux-and-solaris.html Using ext2 on other systems]
 +
 
 +
[[Category:File Systems]]

Revision as of 03:07, 31 July 2012

ext2 or the second extended file system is a Linux filesystem designed as a replacement for ext. Note that ext3 is mostly compatible with ext2.

The Sleuthkit and R-Studio can be used to perform recovery of data from the EXT2 filesystem. Various data carving tools like Foremost and Scalpel also support the ext2 filesystem.

See Also

External Links