File systems

 A volume contains only one file system.

File systems recognised and analysed by Tyrhex are :

  • FAT 16
  • FAT 32 
  • NTFS

work in progress

  • HFS (based on some undocumented findings)

By implementing file system libraries created from scratch and based on available standards but enhanced with reverse engineering and forensic experience, Tyrhex is a perfect tool to cross-check results from expensive but still not perfect forensic tools.

Users who want to write forensics findings on real cases are advised to get documentation about file systems and file systems reverse engineering available by several ressources

tyrhex © Yves Vandermeer  2015-2017   #tyrhex