Re: [sleuthkit-users] problem to image

[philippe J. <ph....@ab...>]

Brian Carrier wrote:
> 
> On Nov 12, 2004, at 7:57 AM, philippe Jarlov wrote:
> 
>> Michel Roukine wrote:
>>
>>> hi Philippe,
>>> Maybe you have to unmount your usb key. As I did below :
> 
> 
>> Thank you very much Michel, it is working well now with this umount.
> 
> 
> Alternatively, you can use the raw device instead of unmounting it (i.e. 
> /dev/rdiskX).  Unmounting it is better though because it ensures that 
> the file system is in a clean state.

Thank you Brian.

I use the usb key for testing. Of course it's better to shutdown 
automount in real case or use a drive lock on hard drive.


> 
> Nothing special is needed as long as you have the latest versions of 
> Autopsy and TSK.  OS X used to need a special version of 'strings', but 
> no longer.
> 

Yes, it is working well, and I have de latest version. So I enjoy now to
work to on mac os x if I need :-)

Thank you Brian for your work !!

Philippe Jarlov