Re: [sleuthkit-users] Extracting partions from dd image

[Eagle I. S. Inc. <in...@ea...>]

>> Probably just bad memory in my case!

Not so Lisa. I had that exact experience, where I dd'd out the partition
with bs=8192 and was not able to mount it afterwards. Changing the bs to
512 worked and allowed me to mount the partition.

The argument is is kinda moot now, since there's no real reason/need to
carve out the partitions anymore, as TSK can read an entire drive image.

Niall.



> On 6/27/05, Aaron Stone <aa...@se...> wrote:
>> On Mon, Jun 27, 2005, ""Barry J. Grundy"" <bg...@im...>
>> said:
>> > In short, the blocksize is important because it sets the unit size for
>> > your "count" (or skip, etc.).
>>
>> This is something I've always wondered: if you set the blocksize to,
>> say,
>> 8192, but do not specify a skip or a count, and capture an entire
>> partition, is there a downside to setting the larger blocksize? My
>> understanding is that it can make the capture faster because you're
>> reading and buffering larger blocks. Scaling up to the size of the disk
>> cache should get faster, no?
>
> Yes, optimising the bs size will yield faster imaging times, bs=512 is
> a little slow at he best of times.
>
> The way I had remembered this / some other thread on the list was that
> an NTFS partition was DD'd and wasn't loadable, but by redoing it with
> bs=512 it was.
>
> Probably just bad memory in my case!
>
> Lisa.
>
>
> -------------------------------------------------------
> SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
> from IBM. Find simple to follow Roadmaps, straightforward articles,
> informative Webcasts and more! Get everything you need to get up to
> speed, fast. http://ads.osdn.com/?ad_idt77&alloc_id492&op=click
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>