Re: [sleuthkit-users] dd of entire HD

[Brian C. <ca...@ce...>]

The last issue of the Sleuth Kit Informer had an article on splitting
the disk into partitions using 'dd' and 'fdisk'.

	http://sleuthkit.sourceforge.net/informer/sleuthkit-informer-2.html

brian


On Thu, Mar 27, 2003 at 11:28:21AM +0100, Paul Bakker wrote:
>  
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Hello,
> 
> In my knowledge, Autopsy is only able to work with dd images of partitions.
> (As it is able to mount these via the loop device)
> 
> In a case I am handling now I received the image of an entire harddisk.
> * Is Autopsy capable of reading this in?
> * Is there a tool that can loopback mount the partitions from within the hd image?
> * Is there a tool that can extract the partitions from the hd image?
>   (What to do about unallocated space then (Not partitioned!)? How does one investigate
>   that using Autopsy?)
> 
> Paul Bakker
> 
> -----BEGIN PGP SIGNATURE-----
> Version: PGP 7.1.1
> 
> iQA/AwUBPoLSJfjAwPuBNeIlEQLifwCfT2RFEXsrJjLJV0f8YDIDw20NEm8An25o
> 5a5GS3aSP0cuRn9GtLIM3lxJ
> =7byL
> -----END PGP SIGNATURE-----
>