Re: [sleuthkit-users] problem to image

[Brian C. <ca...@sl...>]

On Nov 12, 2004, at 7:57 AM, philippe Jarlov wrote:

> Michel Roukine wrote:
>
>> hi Philippe,
>> Maybe you have to unmount your usb key. As I did below :

> Thank you very much Michel, it is working well now with this umount.

Alternatively, you can use the raw device instead of unmounting it 
(i.e. /dev/rdiskX).  Unmounting it is better though because it ensures 
that the file system is in a clean state.

> Could you tell me what kind of options I must use to use this .img 
> with autopsy now, or is there a documentation on how to use autopsy 
> with Mac OS X ?

Nothing special is needed as long as you have the latest versions of 
Autopsy and TSK.  OS X used to need a special version of 'strings', but 
no longer.

brian