[sleuthkit-users] Was FAT32, now NTFS

[Mark K. M. <mar...@la...>]

Hi all,

I have a drive that was previously a FAT32 drive on a Windows ME system.
The drive was recently formatted as NTFS in Windows XP (and *very*
little activity has occurred on it since then).  I still see FAT
structures on the drive, as well as data, but I'm having a difficult
time importing it into Autopsy for examination.  Choosing NTFS as the
image filesystem doesn't seem correct, since the data I want to access
is in the residual FAT structures.  Choosing a FAT filesystem doesn't
work, because of the current NTFS format of the filesystem.  Are there
any simple methods I can use to salvage FAT structures and files through
Sleuthkit/Autopsy?

Thanks,
Mark K. Murdock, CISSP
Lantern Secure Solutions, LLC
Office: (314) 721-1600
Direct: (314) 283-4317
************************************************************************
***
This email and any files transmitted with it are confidential and
intended
solely for the use of the individual or entity to whom they are
addressed.
If you have received this email in error please notify the sender.
************************************************************************
***