RE: [sleuthkit-users] RE: Problem adding image

[Eagle I. S. <in...@ea...>]

It appears that Autopsy takes a looong time to load the image.
3 hours for my 20 Gig partition. Only to find that I had forgotten
to select NTFS on the drop down and was greeted with "error - not
an FFS system".

Some other newbie points:

I found I could only create the symbolic link to dev/hda1 when I had
navigated to the images directory within which I wished to create the
symbolic link. Maybe this is something all experts
of Unix know you should do, but I was logged in as root, so I assumed
I had God-like powers to create links and directories at will. Not so, at
least
in my case.

When I did a dmesg on my drive, it came back with the following:

hda1 hda2 <hda3 hda4 hda5>

Can anyone explain what's between the angled brackets? Hidden
partitions? I know there's only two partitions on the drive.

Thanks for all the advice so far, and any pointers on the above.

Niall.

Also, is there an archive of these messages anywhere? Maybe some of my
future
questions have already been discussed and I'd like not to waste anyone's
time.




-----Original Message-----
From: sle...@li...
[mailto:sle...@li...]On Behalf Of Sid
Porter - Silent Partner
Sent: Sunday, March 09, 2003 10:16 AM
To: sle...@li...
Subject: [sleuthkit-users] Extended Partitions [was] RE: Problem adding
image


On Sunday 09 March 2003 14:58, Sid Porter - Silent Partner wrote:
> Your disk will have primary partition /dev/hda1 and also partitions
> /dev/hda2 /dev/hda3 /dev/hda4

When I compiled this information I presented actual data from my own system
which is a notebook computer with a single IDE disk partitioned as above.

However, when I got the above labels from Fdisk, I had to delete a large
chunk
of my pre-composed info that talked about a disk having max two partitions,
primary and extended, and the extended holding logical partitions. My own
setup contradicts this, and I can't even remember installing this system its
that long ago.

What happened to the notion of extended partitions? Is this now obsolete
with
new IDE technology? Or just uncessary for linux, and still used by Windows?

Sid.


-------------------------------------------------------
This SF.net email is sponsored by: Etnus, makers of TotalView, The debugger
for complex code. Debugging C/C++ programs can leave you feeling lost and
disoriented. TotalView can help you find your way. Available on major UNIX
and Linux platforms. Try it free. www.etnus.com
_______________________________________________
sleuthkit-users mailing list
sle...@li...
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users