[sleuthkit-users] Using Autopsy with a mount point rather than an image

[<sec...@hu...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello list,

Is it possible to use autopsy with a harddrive that is mounted read only
to a mount point rather than an image?

I have a second hard drive that I want to examine that is currently too
big to image on my forensics machine. I can mount the hard drive read-
only to a mount point (e.g. /mnt/drive) but when I try to use the Autopsy
gui to examine it it says that /mnt/drive is a directory and cannot use
that location as the target.

Is there a way around this with Autopsy? I can use the sleuthkit tools
against a mounted hard drive jus the same.

Thanks.
-----BEGIN PGP SIGNATURE-----
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 2.4

wkYEARECAAYFAkEVLscACgkQRBFe1uc9INqveACcC9fP0dacgifm0nVHumey1WN9i80A
niyvbCH4lydhuB7RVjBKCv2VH55u
=BW9B
-----END PGP SIGNATURE-----




Concerned about your privacy? Follow this link to get
secure FREE email: http://www.hushmail.com/?l=2

Free, ultra-private instant messaging with Hush Messenger
http://www.hushmail.com/services-messenger?l=434

Promote security and make money with the Hushmail Affiliate Program: 
http://www.hushmail.com/about-affiliate?l=427