Re: [sleuthkit-users] problem to image

[Michel R. <mi...@ro...>]

philippe Jarlov wrote:

> Hello,
>
> I'm coming back into this list after a year :-)
>
> And I have a question. I'm trying to imaging on Mac OS X
> to use autopsy. Autopsy is working well but
>
> - I can't image a usb drive :
> Ordinateur-de-moi:/Volumes/PHIL_USB moi$ dd if=/dev/disk2s1 
> of=/Users/moi/image_clefusb/image_clefusb.img
> dd: /dev/disk2s1: Device busy
>
> How can I change this ?

hi Philippe,

Maybe you have to unmount your usb key. As I did below :

bonite:~ root# df
Filesystem              512-blocks     Used     Avail Capacity  Mounted on
.
.
.
/dev/disk1s1                127176    86932     40244    68%    
/Volumes/NO NAME
bonite:~ root# dd if=/dev/disk1s1 of=~kato/image_clefusb.img
dd: /dev/disk1s1: Device busy
bonite:~ root# umount /Volumes/NO\ NAME/
bonite:~ root# dd if=/dev/disk1s1 of=~kato/image_clefusb.img
127456+0 records in
127456+0 records out
65257472 bytes transferred in 123.628805 secs (527850 bytes/sec)
bonite:~ root#

>
> Thank you very much, I use usualy autopsy on Linux system, and
> I'm discovering Mac OS X...hum some change...
>
> Philippe Jarlov
> France
>
Michel Roukine