[sleuthkit-users] TSK, GPT, and HFSJ
Brought to you by:
carrier
|
From: Terry O. <twj...@ho...> - 2013-05-13 14:17:58
|
I have a Cellebrite physical extraction of an iPod 4Gen. I want to use TSK to gather all unallocated space (blkls), but can't figure out how to reference the partition within a GPT. MMLS returns the dummy MBR partition table, which is of no help. Using X-Ways to get the real partition offset, I entered that as -o, but that didn't work. It returned Cannot determine file system type as an error. Adding -f hfs, I get Invalid magic value (not an HFS+ file system (magic)). Researching online, I am seeing hints that TSK supports GPT disks, but no examples that I can put to use. I am using SIFT Workstation with TSK version 3.2.3 against a 8gb iPod 4g cellebrite physical extraction (.img file). Any help would be appreciated. Terry |