RE: [sleuthkit-users] Image searching qurestion

[Eagle I. S. I. <in...@ea...>]

Splitting the file into the partitions worked. 

Thanks, Brian, and dorkus, for the help.

Niall.  

-----Original Message-----
From: Brian Carrier [mailto:ca...@sl...] 
Sent: Tuesday, March 30, 2004 12:45 AM
To: Eagle Investigative Services, Inc. 
Cc: sle...@li...
Subject: Re: [sleuthkit-users] Image searching qurestion

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Mar 29, 2004, at 10:20 PM, Eagle Investigative Services, Inc. wrote:

> I have a file, called 17g.dd, which is an image of an NTFS drive (not 
> the
> partition)
>
> When I went to add the image, Autopsy would not let me add it as an 
> ntfs file system. I could only add it as raw.

Autopsy only supports file system images.  For info on splitting the disk
into partitions, see:

http://www.sleuthkit.org/informer/sleuthkit-informer-2.html#split
http://www.sleuthkit.org/informer/sleuthkit-informer-12.html#mmls

brian
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAaQlUOK1gLsdFTIsRAo+GAJ9hi8hpLoKLkigFmh93YgTR2loZqQCfRb6G
2zkxB/ur1VqscyMjRCdOfu4=
=/iSj
-----END PGP SIGNATURE-----