Re: Re: [sleuthkit-users] avoiding creating a dd image

[Angus M. <an...@ng...>]

Actually, if you're just using sleuthkit - you don't need symlinks. You can=
 just run the tools directly on the device entry under /dev.

The symlink is useful if you use Autopsy as your interface, but Autopsy wil=
l do the linking for you.

I have to say though, that it doesn't sound like you know quite enough abou=
t the O/S you're working on top of. The device entries and the concept of s=
ymbolic links are fairly basic concepts in any *nix-like OS.

> Message date : Jun 17 2004, 01:31 PM
> From : "Matthew M. Shannon" <msh...@ag...>
> To : "amouri eddy" <edi...@ya...>
> Copy to : "Angus Marshall" <an...@n-...>, sle...@li...ur=
ceforge.net
> Subject : Re: [sleuthkit-users] avoiding creating a dd image
>=20
> ln -s /dev/hdaX(sdaX) /home/path/to/file/file.img=20
>=20
> Of course that could be sdb or hdb... or any other combination..
>=20
> For Example:
>=20
> ln -s /dev/hda1 /home/test/hda1-test.img
>=20
> Good luck!
>=20
> M Shannon
>=20
> On Thu, 2004-06-17 at 05:37, amouri eddy wrote:
> > Thanks for the answer ...
> > But ..symlink command does not exist in linux.=20
> > And how to link for example partition 2 (or 1, or 3)
> > to=20
> > a file ?
> > About the legal reasons, they don't matter in my
> > case...
> >=20
> > --- Angus Marshall <an...@n-...> a =C3=A9crit : > On
> > Thursday 17 June 2004 09:56, amouri eddy wrote:
> > > > Hello,
> > > >
> > > > For analysing a system (booting with a live linux
> > > CD), it is possible to
> > > > mount the disks. But the sleuth kit requires
> > > images, so images of the disks
> > > > must be created. Is it possible to find a way to
> > > directly analyse the disk
> > > > (creating images may takes a long long time and
> > > one need another hd) ?
> > > >
> > > > Thanks
> > >=20
> > > You can symlink the disk device entry (e.g.
> > > /dev/sda1) instead of imaging but=20
> >=20
> > >=20
> > > This SF.Net email is sponsored by The 2004
> > > JavaOne(SM) Conference
> > > Learn from the experts at JavaOne(SM), Sun's
> > > Worldwide Java Developer
> > > Conference, June 28 - July 1 at the Moscone Center
> > > in San Francisco, CA
> > > REGISTER AND SAVE! http://java.sun.com/javaone/sf
> > > Priority Code NWMGYKND
> > > _______________________________________________
> > > sleuthkit-users mailing list
> > >
> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > > http://www.sleuthkit.org
> > > =20
> >=20
> >=20
> > =09
> >=20
> > =09
> > =09=09
> > Yahoo! Mail : votre e-mail personnel et gratuit qui vous suit partout !=
=20
> > Cr=C3=A9ez votre Yahoo! Mail sur http://fr.benefits.yahoo.com/
> >=20
> > Dialoguez en direct avec vos amis gr=C3=A2ce =C3  Yahoo! Messenger !T=
=C3=A9l=C3=A9chargez Yahoo! Messenger sur http://fr.messenger.yahoo.com
> >=20
> >=20
> > -------------------------------------------------------
> > This SF.Net email is sponsored by The 2004 JavaOne(SM) Conference
> > Learn from the experts at JavaOne(SM), Sun's Worldwide Java Developer
> > Conference, June 28 - July 1 at the Moscone Center in San Francisco, CA
> > REGISTER AND SAVE! http://java.sun.com/javaone/sf Priority Code NWMGYKN=
D
> > _______________________________________________
> > sleuthkit-users mailing list
> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > http://www.sleuthkit.org
>=20
>=20

--=20

Whatever you Wanadoo:
http://www.wanadoo.co.uk/time/

This email has been checked for most known viruses - find out more at: http=
://www.wanadoo.co.uk/help/id/7098.htm