Re: [sleuthkit-users] NTFS filesystem options ---

[Brian C. <bca...@at...>]

You'll have to either make a new image or just reference the loop back
device that losetup makes.

To make a new image, use:
	# dd if=img.dd skip=32256 count=XYZ of=img2.dd

To use the loop back device, make a symlink from the /dev/ entry to
the morgue directory and then make an entry in fsmorgue for it.

brian


On Wed, Oct 02, 2002 at 12:03:42AM -0400, Jason Mafera wrote:
> Hi,
>  
> Thanks Brian for the help with the large filesystem Perl
> support.Recompiling with the option did the trick.
>  
> Does anyone know a way to set a partition offset in the Autopsy config?
> It isn't recognizing the image file as an NTFS partition.  I had to
> mount the image with an offset of 32256 to get losetup to work.
> Again any help is appreciated.
>  
> Thanks in advance.
>  
> -Jason
>