[sleuthkit-users] RE: Problem adding image

[Eagle I. S. <in...@ea...>]

Brian.

With regard to your message below. I logged in as root and
started Autopsy.

My Settings are as follows:

Case Name: Thismachine
Host: WIN2000

I tried to create the following symbolic link as you suggested
and entered it as you outlines below and also as the directory
appeared in the autopsy screen (i.e with the two "//" before
Thismachine/)

i.e.

ln -s /dev/hda1 /home/niallc/Desktop/Locker/Thismachine/WIN2000/images

and

ln -s /dev/hda1 /home/niallc/Desktop/Locker//Thismachine/WIN2000/images

I entered both exactly as typed above. In both cases when I hit refresh
there was no sign of my link/image.

/dev/hda1 is definitely the name of my Win2k partition.

What am I missing, or doing wrong?

Thanks in advance,

Niall.




-----Original Message-----
From: Brian Carrier [mailto:bca...@at...]
Sent: Friday, February 14, 2003 12:44 PM
To: Eagle Investigative Services
Cc: sle...@li...
Subject: Re: [sleuthkit-users] Autopsy beginner question


On Fri, Feb 14, 2003 at 09:17:19AM -0500, Eagle Investigative Services
wrote:
> When I specified the Evidence Locker I specified it as the "base"
> directory
> that was in the Autopsy folder. Is this correct? I wasn't sure where
> to put it.

The Evidence Locker is where all of your case data will be saved.
So, no it should not be the installation folder.  It will work, but
it is not recommended.  You could use something like
/usr/local/forensics/locker.

>
> Also, I have  dual boot machine, Linux and Win2K. My plan is to work
> with TASK/Autopsy to examine the Win2K partition.
>
> For example, I will do something in Win2K then delete it, and then
> switch to Linux to find it. Is this going to be possible?

Yes.  Make a case and host in Autopsy and make a symlink from
/dev/hda1 (or whichever partition it is)  to the 'images' directory.

	% ln -s /dev/hda1 /usr/local/forensics/locker/case1/host1/images

Autopsy must be running as root so that it has read permissions on the
device.

brian