Re: [sleuthkit-users] XFS image file analysis
Brought to you by:
carrier
From: RB <ao...@gm...> - 2012-12-05 04:51:23
|
On Tue, Dec 4, 2012 at 9:36 PM, Sagar Belure <sag...@gm...> wrote: > Yes. But that would require <device> as a parameter not image file. > I don't have hard disk but hard disk image. You can handle that either by using 'losetup' to set up a loopback block device at a specific offset in your image file, or use the '-o loop,offset=XYZ' option to 'mount', which does the same thing. Mounting an image "-o loop,offset=XYZ" just runs losetup in the background, and all losetup is doing in this case is creating a convenience mapping - you tell it that a block device you want to handle is at byte offset XYZ in the image and it will transparently translate all accesses to start at that address. > I'm not really sure how do operate on XFS filesystem image file. See above, unless you imaged the XFS filesystem with "xfsdump". |