RE: [sleuthkit-users] Mounting a dd image under windows

[Altheide, C. B. (IARC) <Alt...@nv...>]

> -----Original Message-----
> From: youcef bichbiche [mailto:ybi...@ya...] 
> Sent: Wednesday, June 15, 2005 3:46 PM
> To: Altheide, Cory B. (IARC); 'ro...@mo...'; 
> sle...@li...
> Subject: RE: [sleuthkit-users] Mounting a dd image under windows
> 
> There is always a limit of how you express your
> frustration.

You don't know me very well. ;)

> Surely accusing my contribution, which was purely
> meant to be a help and a pointer, 

A pointer in the *wrong direction* isn't helpful, no matter the intentions.

If someone stops you on the street and says "Do you know the way to XYZ
street?" do you say "oh, I've been to a 123 street before, I'll tell him how
to get there!" or do you respond "Sorry, I don't know"?

...

> Now to clarify my posting:
> 
> I used mounted images under Linux, that's why I
> thought the fact I can use it under Linux you can do
> so under Cygwin. I didn't try it under cygwin, and
> that was my mistake, I shouldn't assume it will work.

Moreover, one should never state untested assertion as fact.  That'd be fine
if this was the "making stuff up" list, but it's not - it's a list for users
of *forensic utilities*.  Far too often the "forensic community" fails to
perform the most basic tasks required of it.

1) Test
2) Verify
3) Assert

You don't have to be right - just don't be *wrong*.

> I cannot deny something I've done, have seen, and have
> touched. To inquire how it's possible to do it, the
> person in charge "not my friend in the local pub" told
> me this:
> 
> - Use the enhanced loopback driver developed by NASA
> Computer Crimes Division: 
> ftp://ftp.hq.nasa.gov/pub/ig/ccd/enhanced_loopback/

"linux-2.4.28-enhanced_loop.tar.gz"

The enhanced *LINUX* loopback driver.  Which works great.

In Linux.

Which Cygwin is not.

-- Cory