[sleuthkit-users] dd of entire HD
Brought to you by:
carrier
From: Paul B. <ba...@fo...> - 2003-03-27 10:28:11
|
=20 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, In my knowledge, Autopsy is only able to work with dd images of = partitions. (As it is able to mount these via the loop device) In a case I am handling now I received the image of an entire harddisk. * Is Autopsy capable of reading this in? * Is there a tool that can loopback mount the partitions from within the = hd image? * Is there a tool that can extract the partitions from the hd image? (What to do about unallocated space then (Not partitioned!)? How does = one investigate that using Autopsy?) Paul Bakker -----BEGIN PGP SIGNATURE----- Version: PGP 7.1.1 iQA/AwUBPoLSJfjAwPuBNeIlEQLifwCfT2RFEXsrJjLJV0f8YDIDw20NEm8An25o 5a5GS3aSP0cuRn9GtLIM3lxJ =3D7byL -----END PGP SIGNATURE----- |