QNX file system

Autopsy Development
1

Hi everyone,

Just new on this forum, even though I’ve been using Autopsy for a while now. In my work I see a lot of QNX based automotive systems, but Autopsy currently has no support for the QNX file system.

Is there any progress on QNX support in Autopsy?

2

One workaround is to mount the qnx filesystem on linux and add the logical folder into autopsy. Im not sure if windows can mount the qnx file system.

3

I currently mount the qnx filesystem in Linux or in QNX live iso to get a logical copy. But I’d love to see QNX support in Autopsy to find deleted files.

1 Like
4

I second this request, direct QNX support would make it the only forensic tool with this capability (I’ve been looking and asking for some time now)

5

Hey, @Automotive have you tried looking in GitHub? People often create API’s, code or various things that may be able to help out, just a thought.

6

Hi @Automotive! As QNX is a Real Time Operating System (RTOS) and its Neutrino Kernel is quite similar to that of GNU/Linux. I’d recommend looking for an API add on or something to help work and make it compatible, otherwise I’m sure there are many people out there that would like a project like this, especially since QNX helps the auto industry quite a bit.
:+1:t4:

7

good night,

my theme of my thesis is to make a module in the autopsy tool to analyze in-vehicle infotainment that have QNX, can someone get me images made to vehicles that is E01?

8

Maybe this helps:

If someone gets his hand on this, we’d have a chance.

Kind Regards,

Gerd

9

Was just going to write the module but luckily I found that I was beaten to the race and found this on github

1 Like
10

I’m also having the same problem, it doesn’t read the raw image.
we have to create the shares.

are you also analyzing vehicle qnx?

11

Have you found a solution to reading the raw image? I have put together a module that will allow a user to add a QNX raw image file as an “Unallocated Space Image File” and then run the plugin and it will export all the files from the partitions and add them into Autopsy as a logical data source. I then have another plugin that will allow you to run vLeapp against the logical data source of the QNX system. The python plugin for the parse QNX6 Image can be found here Autopsy-Plugins/Parse_QNX_Image at master · markmckinnon/Autopsy-Plugins · GitHub the vLeapp plugin can be found here Autopsy-NBM-Plugins/Plugin-Modules at main · markmckinnon/Autopsy-NBM-Plugins · GitHub. If you have any questions please let me know.

Kind regards.

Mark

12

What about older system like QNX4 image? Do you have Autopsy Plugin for that?

Regards
Ken

13

I only have a plugin for QNX6. Did you try and run it to see if it would work for QNX4?