Re: [sleuthkit-users] Using Autopsy with a mount point rather than an image

[<sec...@hu...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

If the hard drive in question had multiple partitions, then yes. In this
case it was a basic Windows install. I use a hard disk enclosure that
I can insert a hard drive into and mount/image/etc.

So it was as simple as 'mount -t fat /dev/hdc /mnt/image'.

It would no doubt been different if there were multiple partitions on
the HD.


On Tue, 10 Aug 2004 11:37:06 -0700 Angus Marshall <an...@n-...>
wrote:
>On Tuesday 10 August 2004 18:36, sec...@hu... wrote:
>> Thanks to all. I will follow the unanimous advice of the list
>to point
>> Autopsy to the physical device (in this case /dev/hdd).
>
>Not wishing to appear picky - but shouldn't this be the PARTITION
>on the
>device ? (e.g. /dev/hdd1 ) Unless Autopsy & Sleuthkit have changed
>a lot
>since I last used them (last night) ;-)
>
>
>
>-------------------------------------------------------
>SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank
>Media
>100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33
>Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift.
>http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285
>_______________________________________________
>sleuthkit-users mailing list
>https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>http://www.sleuthkit.org
-----BEGIN PGP SIGNATURE-----
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 2.4

wkYEARECAAYFAkEZiKcACgkQRBFe1uc9INr/0gCcCIDMZS2un+zZ0ilyMvi2z4le/j8A
n1Um8H/ns0Gz0q77hcRKOOKx6W/O
=nRS5
-----END PGP SIGNATURE-----




Concerned about your privacy? Follow this link to get
secure FREE email: http://www.hushmail.com/?l=2

Free, ultra-private instant messaging with Hush Messenger
http://www.hushmail.com/services-messenger?l=434

Promote security and make money with the Hushmail Affiliate Program: 
http://www.hushmail.com/about-affiliate?l=427