Re: [sleuthkit-users] NTFS problems.

[Domingo C. <do...@es...>]

----- Original Message -----
From: "Brian Carrier" <ca...@sl...>
To: "Domingo Cardona" <do...@es...>;
<sle...@li...>
Sent: Thursday, June 26, 2003 6:58 PM
Subject: Re: [sleuthkit-users] NTFS problems.


>
>
> On 26 Jun 2003 08:48 PDT you wrote:
>
> > When do you get the message?
> > - When trying to make a symlink to Evidence Locker.
>
> Ok, then that is where the "not an NTFS image" error came from.
> The seek error came from testing the image to verify it was
> indeed the correct file system type.  Can you send me the exact
> seek error message?
>
> > Do any of the "modes" work?
> >     -Sorry, I don't eactly know what you mean.
>
> The "modes" are once the image has been imported you can view
> it from different "modes" such as files or data units.  But, I guess
> it never got that far.
>
> > The file system imported with no errors though correct?
> >     - Sorry, I don't exactly know what you mean. I made a bit to bit
copy
> > with "dd".
>
> Did you 'dd' the entire disk or the individual partitions?  Autopsy and
> The Sleuth Kit both require a partition and not a disk.  In other words,
> if you used Linux, did you 'dd' /dev/hda or /dev/hda1?
>
> brian
>

I dd'ed /dev/hda... any solution to get /dev/hda1 from the image file?

Domingo.