RE: [sleuthkit-users] NTFS problems.

[Brian C. <ca...@sl...>]

On 18 Aug 2003 12:54 PDT you wrote:

> I revisited this thread after having tried unsuccessfully to add
> a NTFS image host to Sleuthkit.
> 
> The resulting image file, which Autopsy uses, MUST have a ".dd"
> extension. Without that, it won't recognize the file system as
> being NTFS. At least, that was my finding.
> 
> In my case, I simply renamed the file to image.dd and it symlinked just
> fine.

It shouldn't behave that way.  I just added a file called fat-test.img 
and it was fine:

Linking /users/bcarrier/fat-test.img to /users/bcarrier/ev_lock/debug/test/images/fat-test.img

Image: /users/bcarrier/fat-test.img added to config file as images/fat-test.img 


There are two things that I can suggest.  I have noticed that when
I upgraded my Perl to 5.8 that the output of some of the 
commands was not being displayed in Autopsy.  For example, the
file listing would be empty.  I changed back to 5.6 and it works fine.
I need to investigate this further, but that could be the problem if
you are using 5.8.  The other is that the original file name had
characters that Autopsy did not like (not  just the extension).  
Autopsy allows words, numbers, _, -, ., and /.  What file name did
you have that did not work?

brian