One thought on “Using File Attributes to Fill Volumes and Bypass OS X Server Limits

  1. Mari DeGrazia says:


    Great post! Just curious, how do current forensics tools interpret this? I remember in the meeting you may have mentioned that most tools are interpreting the information as being in free space/unallocated space? If so – this means that a possible an image may be “hidden” in one of the attributes, but may look to an examiner like its in unallocated space?


Comments are closed.