Re: [sleuthkit-users] problem to image

[philippe J. <ph....@ab...>]

Michel Roukine wrote:

> 
> 
> hi Philippe,
> 
> Maybe you have to unmount your usb key. As I did below :
> 
> bonite:~ root# df
> Filesystem              512-blocks     Used     Avail Capacity  Mounted on
> .
> .
> .
> /dev/disk1s1                127176    86932     40244    68%    
> /Volumes/NO NAME
> bonite:~ root# dd if=/dev/disk1s1 of=~kato/image_clefusb.img
> dd: /dev/disk1s1: Device busy
> bonite:~ root# umount /Volumes/NO\ NAME/
> bonite:~ root# dd if=/dev/disk1s1 of=~kato/image_clefusb.img
> 127456+0 records in
> 127456+0 records out
> 65257472 bytes transferred in 123.628805 secs (527850 bytes/sec)
> bonite:~ root#

Thank you very much Michel, it is working well now with this umount.

Could you tell me what kind of options I must use to use this .img with 
autopsy now, or is there a documentation on how to use autopsy with Mac 
OS X ?

Philippe (and I hope that's all ;-)