RE: [sleuthkit-users] Extracting partions from dd image

[Eagle I. S. I. <in...@ea...>]

Brian, 

Setting the bs to 512 did the trick. Thanks

Niall.  

-----Original Message-----
From: sle...@li...
[mailto:sle...@li...] On Behalf Of Eagle
Investigative Services, Inc. 
Sent: Wednesday, March 31, 2004 2:20 PM
To: 'Brian Carrier'
Cc: sle...@li...
Subject: RE: [sleuthkit-users] Extracting partions from dd image

Brian, 

I had bs=4096 to help speed things up, so I will retest with bs=512. 

Niall. 

-----Original Message-----
From: Brian Carrier [mailto:ca...@sl...]
Sent: Wednesday, March 31, 2004 2:13 PM
To: Eagle Investigative Services, Inc. 
Cc: sle...@li...
Subject: Re: [sleuthkit-users] Extracting partions from dd image

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Mar 31, 2004, at 12:26 PM, Eagle Investigative Services, Inc. wrote:

> Brian,
>
> The process of dd'ing out the partition worked for only one image 
> file, and not for the three others.  All 4 image files were dd'd the 
> same way.

Which one worked?  The first one or one of the latter ones?

> So what I did was try starting at 63 and 62, and tried ending at one 
> more than the end point and none of these options worked.

It could be that the file system is corrupt.  The first partition of almost
every disk starts at sector 63, so that shouldn't be a problem.  
Make sure you are using the original disk image and not one of the partition
images as input.  Also make sure that the 'bs=' value for 'dd' is set to
512.

Send an 'xxd' output of the first sector of the partition image if nothing
else works:

dd if=part-img.dd count=1 | xxd


brian
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAaxhQOK1gLsdFTIsRAonLAJ9AmeJM39h41j70Tp/d3r+KEDZBXQCgiH1A
7B2rcrJZ4CFtlOkX9uD5uyI=
=Kkb7
-----END PGP SIGNATURE-----




-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial
presented by Daniel Robbins, President and CEO of GenToo technologies. Learn
everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org