Re: [sleuthkit-users] Extracting partions from dd image

[Lisa M. <34....@gm...>]

On 6/28/05, Eagle Investigative Services, Inc. <in...@ea...> w=
rote:
> >> Probably just bad memory in my case!
>=20
> Not so Lisa. I had that exact experience, where I dd'd out the partition
> with bs=3D8192 and was not able to mount it afterwards. Changing the bs t=
o
> 512 worked and allowed me to mount the partition.
>=20
> The argument is is kinda moot now, since there's no real reason/need to
> carve out the partitions anymore, as TSK can read an entire drive image.
>=20

Yeah, thats the scenario I was looking for, and personally I just
don't get it why changing bs down to 512 would make a blind bit of
difference in that scenario...

Lisa.