Re: [sleuthkit-users] Using autopsy/sleuthkit under cygwin

[Brian C. <ca...@sl...>]

On 25 Jul 2003 19:24 PDT you wrote:

> I am running on a windows 2000 workstation with cygwin installed. When I 
> try to add an image to a case file it tells me that it can't find:
> cygwin1.dll on the path, even though the path has /bin on it. The error 
> is coming from fsstat.

Autopsy removes the original path, try and remove that line in
Autopsy and see if it works.  it is line 75 in autopsyfunc.pm:
    $ENV{PATH} = "";

Remove that, restart, and try it again.  I haven't done much with 
Autopsy and CYGWIN before, but maybe others on this list can
provide assistance.


> 
> When I try to run fsstat from the command line I get the following:
> $ /cygdrive/d/sleuthkit/bin/fsstat.exe /cygdrive/a
> /cygdrive/d/sleuthkit/bin/fsstat: /cygdrive/a: read superblock: Is a 
> directory
> 

The Sleuth Kit tools need a file system image to process.  The
mounted directory does not give The Sleuth Kit the needed 
information.  You will have to make an image of the partition
(using a 'dd' port for example) and run the tools on that
image.

brian