lvm/lvm2 volumes

[MariasStory]

Hi,
Congratulations on the progress with the cool tool. I just Love it.
Can you please improve the lvm/lvm2 volumes parsing?
FTKimager is able to read it, but IPED does not recognize the separate volumes.

[lfcnassif]

Hi. Unfortunately this needs to be implemented at the sleuthkit level. See:
sleuthkit/sleuthkit#1148
sleuthkit/sleuthkit#1191

As a workaround, you can create an AD1 volume per partition (may include unallocated) using FTKImager and IPED will process the AD1 directly without sleuthkit.

[MariasStory]

Hi @lfcnassif, you've done a good job in paying attention to this problem.
It seems that relying on sleuthkit is somewhat problematic. The Sleuthkit development is not so agile, and the issues are not being addressed.
I suggest automating some kind of workaround, not only for this case, but also for similar issues.

[lfcnassif]

Work in progress in TSK here:
sleuthkit/sleuthkit#2751

[lfcnassif]

Depends on #1340

[lfcnassif]

Closed by 35e423a

[lfcnassif]

Reopening, Sleuthkit-4.12.0 windows build is not linking to libvslvm automatically, we'll have to adjust their build...