Re: [sleuthkit-users] Image searching qurestion

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Mar 29, 2004, at 10:20 PM, Eagle Investigative Services, Inc. wrote:

> I have a file, called 17g.dd, which is an image of an NTFS drive (not 
> the
> partition)
>
> When I went to add the image, Autopsy would not let me add it as an 
> ntfs
> file system. I could only add it as raw.

Autopsy only supports file system images.  For info on splitting the 
disk into partitions, see:

http://www.sleuthkit.org/informer/sleuthkit-informer-2.html#split
http://www.sleuthkit.org/informer/sleuthkit-informer-12.html#mmls

brian
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAaQlUOK1gLsdFTIsRAo+GAJ9hi8hpLoKLkigFmh93YgTR2loZqQCfRb6G
2zkxB/ur1VqscyMjRCdOfu4=
=/iSj
-----END PGP SIGNATURE-----