-
Notifications
You must be signed in to change notification settings - Fork 666
tsk_comparedir
Brian Carrier edited this page Oct 25, 2017
·
1 revision
Back to Help Documents
tsk_comparedir will compare a local directory with an image or raw device. This is useful for detecting when a rootkit is hiding a file from the local directory hierarchy. TSK will be able to see the hidden files by parsing the raw content from the raw device. This can also be used for testing.
Content is available under Attribution-Noncommercial-Share Alike 3.0