[sleuthkit-users] dd of entire HD

[Paul B. <ba...@fo...>]

=20
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,

In my knowledge, Autopsy is only able to work with dd images of =
partitions.
(As it is able to mount these via the loop device)

In a case I am handling now I received the image of an entire harddisk.
* Is Autopsy capable of reading this in?
* Is there a tool that can loopback mount the partitions from within the =
hd image?
* Is there a tool that can extract the partitions from the hd image?
  (What to do about unallocated space then (Not partitioned!)? How does =
one investigate
  that using Autopsy?)

Paul Bakker

-----BEGIN PGP SIGNATURE-----
Version: PGP 7.1.1

iQA/AwUBPoLSJfjAwPuBNeIlEQLifwCfT2RFEXsrJjLJV0f8YDIDw20NEm8An25o
5a5GS3aSP0cuRn9GtLIM3lxJ
=3D7byL
-----END PGP SIGNATURE-----