Re: [sleuthkit-users] Doubt on file formats

[Brian C. <ca...@sl...>]

If you 'dd' the floppy, you should import it into Autopsy as a volume 
(there is typically no partition table on floppies).  Autopsy should 
then detect it as FAT12.

brian


On Apr 7, 2005, at 7:29 AM, Pradeep M wrote:

>                I am new to Linux and I have been assigned a task of
> recovering data from a floppy. I am also new to Autopsy. Actually when
>  I went through the Honeynet site I saw similar exercises. In one of
> the scans they had a challenge of recovering files from a floppy. They
> gave some image.zip
> (http://www.honeynet.org/scans/scan24/image.zip)  which contains a
> image and we have to recover deleted files from it. What I did was I
> used the same image and recovered deleted files by using auotpsy. My
> problem is I dont understand the file format of the image.
>               When I created files in a floppy and deleted it, I am
> not able to recover it using autopsy. Autopsy could not recognise the
> file format. Can anyone help to solve this problem?