Forensic analysis of multiple device BTRFS configurations using The Sleuth Kit

In this paper we add support for BTRFS-including support for multiple device configurations-to The Sleuth Kit, a widely used toolkit when it comes to open source file system forensics. Moreover, we provide an analysis of forensically important features of BTRFS and show how our implementation can be used to utilize these during a forensic analysis.