Re: [sleuthkit-users] Analyzing FreeBSD Partition

[Brian C. <ca...@sl...>]

On Feb 24, 2006, at 5:06 PM, Brooks, Prentis wrote:
>
> So, I should have imaged /dev/had rather than /dev/hda1?

Yes, Barry is correct.  You should have imaged /dev/hda AND you need  
to keep in mind that the offsets in the FreeBSD disk label are  
relative to the start of the disk and not relative to the start of  
the FreeBSD partition.

brian