Re: [sleuthkit-users] problem analysing apple hard disk

[Alessandro F. <at...@gm...>]

Yes.
If I select the partition in the partitions tree, nothing is show in the
detail window.


2014-08-21 4:09 GMT+02:00 Brian Carrier <ca...@sl...>:

> So the image has four partitions, but one of them isn't showing any files?
>
>
> On Aug 14, 2014, at 5:42 AM, Alessandro Farina <at...@gm...> wrote:
>
> > Hi
> > I'm analysing an image (EWF) extracted from an IMAC.
> > The disk (image) has 4 partition: 2 HFS+ and 2 NTFS (BOOTCAMP).
> > I'm using Autopsy 3.0.10 on Window 7 SP1.
> > From the partition browser I can't access to one of the HFS+ partition.
> > The image file is ok, infact I can mount and browse all the partition in
> > linux (via ewfmount) without any problem. The same happens if I access
> > the image via ftk mounter on windows.
> > I think there is some sort of problem with Autopsy and I would like to
> > help whith analysis and debug.
> > I can't send to many info on the contents because is part of an ongoing
> > investigation, but I think I can share info on disk and partition
> structure.
> > Any help will be very appreciated.
> >
> > Thanks in advance
> > Alessandro
> >
> >
> ------------------------------------------------------------------------------
> > _______________________________________________
> > sleuthkit-users mailing list
> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > http://www.sleuthkit.org
>
>