Re: [sleuthkit-developers] win32 device opening

[Brian C. <ca...@sl...>]

On Oct 29, 2008, at 9:56 AM, Christophe GRENIER wrote:

> On Wed, 29 Oct 2008, Brian Carrier wrote:
>
>> Hi Christophe,
>>
>> Thanks, but that didn't seem to change anything on my XP system  
>> when trying to open \\.\PhysicalDrive0. I still get a sharing  
>> violation.
>>
>>> So far, it works well under Vista as long as you run TestDisk
>>> using right-click "Run as Administrator".
>>
>> It works on both \\.\C: and \\.\PhysicalDrive0?
>
> Hi Brian,
>
> TestDisk opens both but by default, it won't display C: if
> PhysicalDrive0 has worked unless "testdisk /all" is used.
> Does TestDisk work on your system ?

It does, but it reports it as /dev/sda.  Is it actually using /dev/ 
sda or is it mapping to \\.\PhysicalDrive0 behind the scenes?

> Is there another program already accessing \\.\PhysicalDrive0?
> It may explain the sharing violation.

Could be.  Although, I seem to be able to open \\.\PhysicalDrive0  
from within Cygwin without error (although TSK is not getting the  
correct size of the device through Cygwin...).

thanks,
brian