Re: [sleuthkit-users] Image searching qurestion

[Enda C. <en...@co...>]

Quoting: "Brian Carrier"
> On Mar 29, 2004, at 10:20 PM, Eagle Investigative Services, Inc. wrote:
>
> > I have a file, called 17g.dd, which is an image of an NTFS drive (not
> > the
> > partition)
> >
> > When I went to add the image, Autopsy would not let me add it as an
> > ntfs
> > file system. I could only add it as raw.
>
> Autopsy only supports file system images.  For info on splitting the
> disk into partitions, see:

What happens Brian if you are working with a corrupt filesystem from a
system crash, and the parition is not mountable? is it possible to analyse
fragments / chunks of a damaged partition using the filesystem rules?

This is fairly common with NTFS where a key part of the fs gets corrupted
during a crash, but presumably there is a large portion of the filesystem
that is "ok" and still written with the filesystem rules.

 -Enda