Re: [sleuthkit-users] problem analysing apple hard disk

[Brian C. <ca...@sl...>]

So the image has four partitions, but one of them isn't showing any files?  


On Aug 14, 2014, at 5:42 AM, Alessandro Farina <at...@gm...> wrote:

> Hi
> I'm analysing an image (EWF) extracted from an IMAC.
> The disk (image) has 4 partition: 2 HFS+ and 2 NTFS (BOOTCAMP).
> I'm using Autopsy 3.0.10 on Window 7 SP1.
> From the partition browser I can't access to one of the HFS+ partition.
> The image file is ok, infact I can mount and browse all the partition in 
> linux (via ewfmount) without any problem. The same happens if I access 
> the image via ftk mounter on windows.
> I think there is some sort of problem with Autopsy and I would like to 
> help whith analysis and debug.
> I can't send to many info on the contents because is part of an ongoing 
> investigation, but I think I can share info on disk and partition structure.
> Any help will be very appreciated.
> 
> Thanks in advance
> Alessandro
> 
> ------------------------------------------------------------------------------
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org