-
Thanks for you answer
1) timeline I was having the text timeline but not the graphic one. I added the perl modules of apache (lib-dbiperl and libapache2-mod-perl2) and it's good now.
2)no read permission - not all the nodes but some. Some (lots) of the inodes are incomplete (with a trailing dash like "43529-128-" ), that's when I have the no read permission message.
3) ntfs : disk image...
2009-12-14 19:19:45 UTC by magic_jobs
-
Hi, thanks for writing to us. In order to better check this behavior I would like to ask you to check if the "No read permission" message is generated on every file present in the evidence or just on files having dimensions equal to zero. As for the timeline it is not clear if the behavior is linked solely to the graphics or involved the table. As for your suggestions, I would like to ask you...
2009-12-14 09:01:54 UTC by torlandi
-
When I browse through files, for instance, on a keyword search and I want to view the file, I click on the magnifier "Show file content".
Then I get the pop-up, with "File content: xxxx".
Under the line of buttons, there is a "No readf permission" message.
The content window is empty.
If I click on Ascii or another button, I get "file recovery not possible" message.
My config is fresh...
2009-12-09 10:07:15 UTC by magic_jobs
-
I'm using PTK for forensic analysis and when I analyzing large disks(around 100Giga bytes) it becomes very slow(take number of hours) and sometimes it doesn't load at all.on the other hand time line functionality does not working. What do you think as the issue in the system. I'm running PTK under Ubuntu 9.04. Please assist me regarding this issue.
2009-11-09 05:29:57 UTC by yasanthah
-
PTK Appliance is a highly professional, multiuser and easy to use solution for complex Digital Investigations. The system, completely configured and safe, uses the software PTK, the last DFLabs project already employed by thousands of forensic examiners worldwide. Together with F-Response, a software allowing access to the remote device as if phisically linked to the computer, the PTK appliance...
2009-09-04 08:22:58 UTC by torlandi
-
"... and also to change the perl reference to path into XAMPP installation.", I want to say the path to perl in first line of PTK's script (i.e. to change from #!/usr/bin/perl -w to #!/opt/lampp/bin/perl -w)
Just for clarify the previous message.
Danilo.
2009-09-02 02:04:45 UTC by wolffram
-
Hi all! I'm posting after ages in order to share with the community my findings when I tried out to install new XAMPP 1.7.2 for Linux in order to install later PTK 1.0.5 on Helix3Pro installed as virtual machine (VirtualBox). After XAMPP was installed, the perl modules compiled, I got an PTK that didn't work. After several tests, I realized that the issue was on XAMPP and so I deleted the...
2009-09-02 01:59:56 UTC by wolffram
-
Hi Ken, I need to know the information you got at step 2 when
you added the image. At that step, PTK should enumerate each partition
stored in the evidence image and you have to select each of them.
Thanks,
Thomas.
2009-08-21 08:57:46 UTC by torlandi
-
Hi Thomas, thanks for the reply. I'm using the SANS Sift workstation, which has Sleuthkit version 3.0.1. Perhaps I'm just not understanding something in the process, but I haven't found a way in PTK to pick just one particular partition to look at.
Thanks,
Ken.
2009-08-19 16:48:37 UTC by kenpryor
-
In order for the images to be analyzed, PTK requires that the images be accessible locally; in case you wish to analyze dd images present inside a nas you have to first mount the archive and afterwards you can analyze it with PTK.
Thanks.
2009-08-19 12:31:11 UTC by torlandi
