Re: [sleuthkit-users] [Autopsy] reading sectors

[Brian C. <ca...@sl...>]

Hi Filip,

Autopsy doesn't have this feature at this point. Indirectly, you can view this data because TSK/Autopsy creates virtual files for everything.  So, you can use $Boot in NTFS or $MBR in FAT to view the first sectors.  There isn't a mode though to view an arbitrary sector like Autopsy 2 has.  As was mentioned in a previous posting, the initial focus of features was on higher analytics and not as much about things that hex editors can also do. 

brian


On Jul 4, 2013, at 9:02 AM, Filip Nowak <fil...@gm...> wrote:

> hello everyone,
> 
> just quick question. I have acquired disk with several partitions, checked MBR - autopsy automatically extracted all information about starting sectors and size. How can I find hex page (first secotor)  for each partition? I tried manually, with success for first two partitions (where numbers are low..):
> 
> no. starting sector - length
> vol1. 0-2048 (page 65)
> vol2. 2048-204800 (page 6465)
> vol3 842065920-841859072 (page?)
> ...
> 
> 
> Am I doing anything wrong, or is there an answer?
> 
> I would be grateful for any comments, suggestions
> 
> filip
> ------------------------------------------------------------------------------
> This SF.net email is sponsored by Windows:
> 
> Build for Windows Store.
> 
> http://p.sf.net/sfu/windows-dev2dev_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org