Re: [sleuthkit-users] NTFS problems.

[Brian C. <ca...@sl...>]

On 26 Jun 2003 10:21 PDT you wrote:


> >
> 
> I dd'ed /dev/hda... any solution to get /dev/hda1 from the image file?


check out:
http://www.sleuthkit.org/informer/sleuthkit-informer-2.html#split

I'm confused about what you got a seek error though.  The Sleuth
kit should have returned an error about an invalid file system before
the seek error occured.  I'll have to look into that more.  

Can you send me the output of the following:

dd if=image.img count=1 | xxd

That will put the first sector of the image you collected in a hexdump
format.  I want to find out why the sanity check did not work.  No
sensitive data is located in there.

brian