Re: [sleuthkit-users] Split Image Question

[Linux T. <lin...@ya...>]

You should have user specify order.  If you do not you
end up trying to guess, and if guess wrong, user
blames you.  Therefor I think only safe solution is to
have user point to a directory containing all images
in a sequential numbering or manually add in order
they need to (would be long, but so what, it'd be
accurate, and that is only important).

-lt

--- Brian Carrier <ca...@sl...> wrote:

> As I was adding the new split image features to
> Autopsy, I realized 
> that I do not fully  understand how people use split
> images.  Is their 
> purpose so that you can acquire the image in 650MB
> or 2GB chunks for 
> burning to disk and then import those images into
> TSK/Autopsy?
> 
> My issue is about the Autopsy interface.  Splitting
> a 60 GB disk into 
> 650 MB chunks requires almost 100 chunks and I do
> not want to have 200 
> field boxes where you fill in each file (and I'm
> assuming that you do 
> not want to fill in 200 file names for a 120 GB
> disk). On the other 
> hand, I do not want to require a naming convention
> where the extension 
> is numbered based on its order in the full image
> (TSK v2 requires you 
> to enter the file names of the split images in their
> respective order) 
> because different tools may have different
> conventions.
> 
> So, my question for those who have asked for split
> image support is 
> what should the interface be?  What is a typical
> number of chunks that 
> may occur?   Are there occasions when you need to
> use split images and 
> cannot merge them into one for the analysis (using
> FAT32 seems to be 
> such a case)?  What extensions do you typically have
> for the split 
> images?  Do you typically have the MD5 for the full
> image or for each 
> individual partition?  Anyone who has asked for
> split image support ... 
> please speak up :)
> 
> thanks,
> brian
> 
> 
> 
>
-------------------------------------------------------
> This SF.Net email is sponsored by: IntelliVIEW --
> Interactive Reporting
> Tool for open source databases. Create drag-&-drop
> reports. Save time
> by over 75%! Publish reports on the web. Export to
> DOC, XLS, RTF, etc.
> Download a FREE copy at
> http://www.intelliview.com/go/osdn_nl
> _______________________________________________
> sleuthkit-users mailing list
>
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
> 



		
__________________________________ 
Do you Yahoo!? 
Yahoo! Mail - Helps protect you from nasty viruses. 
http://promotions.yahoo.com/new_mail