[sleuthkit-users] problem analysing apple hard disk
Brought to you by:
carrier
From: Alessandro F. <at...@gm...> - 2014-08-14 09:42:55
|
Hi I'm analysing an image (EWF) extracted from an IMAC. The disk (image) has 4 partition: 2 HFS+ and 2 NTFS (BOOTCAMP). I'm using Autopsy 3.0.10 on Window 7 SP1. From the partition browser I can't access to one of the HFS+ partition. The image file is ok, infact I can mount and browse all the partition in linux (via ewfmount) without any problem. The same happens if I access the image via ftk mounter on windows. I think there is some sort of problem with Autopsy and I would like to help whith analysis and debug. I can't send to many info on the contents because is part of an ongoing investigation, but I think I can share info on disk and partition structure. Any help will be very appreciated. Thanks in advance Alessandro |