Home Science Forensic analysis of multiple device BTRFS configurations using The Sleuth Kit

Forensic analysis of multiple device BTRFS configurations using The Sleuth Kit


The analysis of file systems is a fundamental step in every forensic investigation. Long-known file systems such as FAT, NTFS, or the ext family are well supported by commercial and open source forensics tools. When it comes to more recent file systems with technologically advanced features, however, most tools fall short of being able to provide an investigator with means to perform a proper forensic analysis.

BTRFS is such a file system which has not received the attention it should have. Although introduced in 2007, marked as stable in 2014, and being the default file system in certain Linux distributions, there is virtually no research available in the area of digital forensics when it comes to BTRFS; nor are there any software tools capable of analyzing a BTRFS file system in a way required for a forensic analysis.

In this paper the authors add support for BTRFS—including support for multiple device configurations—to The Sleuth Kit, a widely used toolkit when it comes to open source file system forensics. Moreover, they provide an analysis of forensically important features of BTRFS and show how our implementation can be used to utilize these during a forensic analysis.

Load More Related Articles
Load More In Science


  1. 1antechamber

    December 30, 2021 at 11:36 pm


  2. gay dating sim

    January 14, 2022 at 2:56 pm

    gay dating rules for making the first movie https://gaypridee.com/

  3. free gay/bi-sex chat sites

    January 14, 2022 at 8:22 pm

    gay universe chat https://gay-buddies.com/

  4. gay dating southwest florida

    January 15, 2022 at 12:54 pm

    gay dudes strong bo odor dating sites https://speedgaydate.com/