[sleuthkit-users] RE: Problem adding image
Brought to you by:
carrier
From: Eagle I. S. <in...@ea...> - 2003-03-07 14:04:00
|
Brian. With regard to your message below. I logged in as root and started Autopsy. My Settings are as follows: Case Name: Thismachine Host: WIN2000 I tried to create the following symbolic link as you suggested and entered it as you outlines below and also as the directory appeared in the autopsy screen (i.e with the two "//" before Thismachine/) i.e. ln -s /dev/hda1 /home/niallc/Desktop/Locker/Thismachine/WIN2000/images and ln -s /dev/hda1 /home/niallc/Desktop/Locker//Thismachine/WIN2000/images I entered both exactly as typed above. In both cases when I hit refresh there was no sign of my link/image. /dev/hda1 is definitely the name of my Win2k partition. What am I missing, or doing wrong? Thanks in advance, Niall. -----Original Message----- From: Brian Carrier [mailto:bca...@at...] Sent: Friday, February 14, 2003 12:44 PM To: Eagle Investigative Services Cc: sle...@li... Subject: Re: [sleuthkit-users] Autopsy beginner question On Fri, Feb 14, 2003 at 09:17:19AM -0500, Eagle Investigative Services wrote: > When I specified the Evidence Locker I specified it as the "base" > directory > that was in the Autopsy folder. Is this correct? I wasn't sure where > to put it. The Evidence Locker is where all of your case data will be saved. So, no it should not be the installation folder. It will work, but it is not recommended. You could use something like /usr/local/forensics/locker. > > Also, I have dual boot machine, Linux and Win2K. My plan is to work > with TASK/Autopsy to examine the Win2K partition. > > For example, I will do something in Win2K then delete it, and then > switch to Linux to find it. Is this going to be possible? Yes. Make a case and host in Autopsy and make a symlink from /dev/hda1 (or whichever partition it is) to the 'images' directory. % ln -s /dev/hda1 /usr/local/forensics/locker/case1/host1/images Autopsy must be running as root so that it has read permissions on the device. brian |