Re: [sleuthkit-users] NTFS problems.

[Brian C. <ca...@sl...>]

On 26 Jun 2003 07:12 PDT you wrote:
> I made an image "image.img" with dd from a hard disk wich contained a WindowsXP partition (NTFS)  and now Autopsy says:
> 
> " offset read random seek error... image.img not NTFS File System" (more or less)

Domingo, I'm going to need some more data. 

When do you get the message?  Do any of the "modes" work?  The
file system imported with no errors though correct? How big is the
file system image?  Did you copy, move, or symlink into the evidence
locker? 

The seek error comes when the tools try to read past the end of the
file system image.  The "img is not a NTFS file system" error message
though comes from a much different place and you should not get
the seek error before the NTFS magic check.  So, there are two tools
that are being run by Autopsy and giving different errors.  

thanks,
brian