Re: [sleuthkit-users] NTFS problems.

[Brian C. <ca...@sl...>]

On 26 Jun 2003 08:48 PDT you wrote:

> When do you get the message?
> - When trying to make a symlink to Evidence Locker.

Ok, then that is where the "not an NTFS image" error came from.
The seek error came from testing the image to verify it was
indeed the correct file system type.  Can you send me the exact
seek error message?  
 
> Do any of the "modes" work?
>     -Sorry, I don't eactly know what you mean.

The "modes" are once the image has been imported you can view
it from different "modes" such as files or data units.  But, I guess
it never got that far.

> The file system imported with no errors though correct?
>     - Sorry, I don't exactly know what you mean. I made a bit to bit copy
> with "dd".

Did you 'dd' the entire disk or the individual partitions?  Autopsy and
The Sleuth Kit both require a partition and not a disk.  In other words,
if you used Linux, did you 'dd' /dev/hda or /dev/hda1?

brian