Re: [sleuthkit-users] NTFS problems.

[Domingo C. <do...@es...>]

>
>
> On 26 Jun 2003 07:12 PDT you wrote:
> > I made an image "image.img" with dd from a hard disk wich contained a
WindowsXP partition (NTFS)  and now Autopsy says:
> >
> > " offset read random seek error... image.img not NTFS File System" (more
or less)
>
> Domingo, I'm going to need some more data.
>
> When do you get the message?  Do any of the "modes" work?  The
> file system imported with no errors though correct? How big is the
> file system image?  Did you copy, move, or symlink into the evidence
> locker?
>
> The seek error comes when the tools try to read past the end of the
> file system image.  The "img is not a NTFS file system" error message
> though comes from a much different place and you should not get
> the seek error before the NTFS magic check.  So, there are two tools
> that are being run by Autopsy and giving different errors.
>
> thanks,
> brian
>

When do you get the message?
- When trying to make a symlink to Evidence Locker.

Do any of the "modes" work?
    -Sorry, I don't eactly know what you mean.

The file system imported with no errors though correct?
    - Sorry, I don't exactly know what you mean. I made a bit to bit copy
with "dd".

How big is the file system image?
    - 20 Gbytes.

Did you copy, move, or symlink into the evidence locker?
    - Already answered. I tried to symlink...

Thanks Brian.