RE: [sleuthkit-users] Extracting partions from dd image

[Eagle I. S. I. <in...@ea...>]

Brian, 

I had bs=4096 to help speed things up, so I will retest with bs=512. 

Niall. 

-----Original Message-----
From: Brian Carrier [mailto:ca...@sl...] 
Sent: Wednesday, March 31, 2004 2:13 PM
To: Eagle Investigative Services, Inc. 
Cc: sle...@li...
Subject: Re: [sleuthkit-users] Extracting partions from dd image

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Mar 31, 2004, at 12:26 PM, Eagle Investigative Services, Inc. wrote:

> Brian,
>
> The process of dd'ing out the partition worked for only one image 
> file, and not for the three others.  All 4 image files were dd'd the 
> same way.

Which one worked?  The first one or one of the latter ones?

> So what I did was try starting at 63 and 62, and tried ending at one 
> more than the end point and none of these options worked.

It could be that the file system is corrupt.  The first partition of almost
every disk starts at sector 63, so that shouldn't be a problem.  
Make sure you are using the original disk image and not one of the partition
images as input.  Also make sure that the 'bs=' value for 'dd' is set to
512.

Send an 'xxd' output of the first sector of the partition image if nothing
else works:

dd if=part-img.dd count=1 | xxd


brian
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAaxhQOK1gLsdFTIsRAonLAJ9AmeJM39h41j70Tp/d3r+KEDZBXQCgiH1A
7B2rcrJZ4CFtlOkX9uD5uyI=
=Kkb7
-----END PGP SIGNATURE-----