[sleuthkit-users] Error Adding Disk Image To Host in Autopsy - TSK 2.00, Autopsy 2.04
Brought to you by:
carrier
|
From: Bradley B <br...@de...> - 2005-04-04 10:35:40
|
Hello, I created a case in Autopsy and added a host. I then attempted to =
add
a Disk Image (eg. dd if=3D/dev/had, not /dev/hda1) as now is possible in
Autopsy. It is a disk image of a machine running DOS with a FAT16 =
partition.
The output of mmls is as follows:
$ /usr/local/sleuthkit/bin/mmls -r "/usr/local/images/c.img"
DOS Partition Table
Sector: 0
Units are in 512-byte sectors
Slot Start End Length Description
00: ----- 0000000000 0000000000 0000000001 Primary Table (#0)
01: ----- 0000000001 0000000062 0000000062 Unallocated
02: 00:00 0000000063 0000100799 0000100737 DOS FAT16 (0x06)
In Autopsy I get the message:
Testing partitions
Linking image(s) into evidence locker
Image file added with ID img1
Missing Volume System Type
The output of the command using fsstat is:
$ '/usr/local/sleuthkit/bin/fsstat' -o 63 -i raw -f fat16
"/usr/local/images/c.
img"
FILE SYSTEM INFORMATION
--------------------------------------------
File System Type: FAT16
OEM Name: MSDOS5.0
Volume ID: 0x2e471cd7
Volume Label (Boot Sector): MSDOS622
Volume Label (Root Directory):
File System Type Label: FAT16
Sectors before file system: 63
File System Layout (in sectors)
Total Range: 0 - 100736
* Reserved: 0 - 0
** Boot Sector: 0
* FAT 0: 1 - 99
* FAT 1: 100 - 198
* Data Area: 199 - 100736
** Root Directory: 199 - 230
** Cluster Area: 231 - 100734
** Non-clustered: 100735 - 100736
METADATA INFORMATION
--------------------------------------------
Range: 2 - 1608066
Root Directory: 2
CONTENT INFORMATION
--------------------------------------------
Sector Size: 512
Cluster Size: 2048
Total Cluster Range: 2 - 25127
FAT CONTENTS (in sectors)
--------------------------------------------
231-310 (80) -> EOF
311-386 (76) -> EOF
387-518 (132) -> EOF
... More data follows -END
When restarting Autopsy I cannot access the image, it does not seem to =
show
up in the image chooser.
- Bradley Bitzkowski
|