Re: [sleuthkit-users] XFS image file analysis

[RB <ao...@gm...>]

On Tue, Dec 4, 2012 at 9:36 PM, Sagar Belure <sag...@gm...> wrote:
> Yes. But that would require <device> as a parameter not image file.
> I don't have hard disk but hard disk image.

You can handle that either by using 'losetup' to set up a loopback
block device at a specific offset in your image file, or use the '-o
loop,offset=XYZ' option to 'mount', which does the same thing.
Mounting an image "-o loop,offset=XYZ" just runs losetup in the
background, and all losetup is doing in this case is creating a
convenience mapping - you tell it that a block device you want to
handle is at byte offset XYZ in the image and it will transparently
translate all accesses to start at that address.

> I'm not really sure how do operate on XFS filesystem image file.

See above, unless you imaged the XFS filesystem with "xfsdump".