Re: [sleuthkit-users] Using Autopsy with a mount point rather than an image

[<sec...@hu...>]

Thanks to all. I will follow the unanimous advice of the list to point
Autopsy to the physical device (in this case /dev/hdd).

Regards.

On Sat, 07 Aug 2004 12:34:31 -0700 sec...@hu... wrote:
>Hello list,
>
>Is it possible to use autopsy with a harddrive that is mounted read
>only
>to a mount point rather than an image?
>
>I have a second hard drive that I want to examine that is currently
>too
>big to image on my forensics machine. I can mount the hard drive
>read-
>only to a mount point (e.g. /mnt/drive) but when I try to use the
>Autopsy
>gui to examine it it says that /mnt/drive is a directory and cannot
>use
>that location as the target.
>
>Is there a way around this with Autopsy? I can use the sleuthkit
>tools
>against a mounted hard drive jus the same.
>
>Thanks.
>



Concerned about your privacy? Follow this link to get
secure FREE email: http://www.hushmail.com/?l=2

Free, ultra-private instant messaging with Hush Messenger
http://www.hushmail.com/services-messenger?l=434

Promote security and make money with the Hushmail Affiliate Program: 
http://www.hushmail.com/about-affiliate?l=427