RE: [sleuthkit-users] Analyzing FreeBSD Partition

[Brooks, P. <pre...@tw...>]

Thanks Brian and Barry,

after imaging /dev/hda, I was successful in gaining access to the =
filesystem.  I appreciate everyone who provided me these tips regarding =
how BSD managed the devices.


-----Original Message-----
From:	Brian Carrier [mailto:ca...@sl...]
Sent:	Mon 2/27/2006 9:36 PM
To:	Brooks, Prentis
Cc:	bg...@im...; sle...@li...
Subject:	Re: [sleuthkit-users] Analyzing FreeBSD Partition


On Feb 24, 2006, at 5:06 PM, Brooks, Prentis wrote:
>
> So, I should have imaged /dev/had rather than /dev/hda1?

Yes, Barry is correct.  You should have imaged /dev/hda AND you need =20
to keep in mind that the offsets in the FreeBSD disk label are =20
relative to the start of the disk and not relative to the start of =20
the FreeBSD partition.

brian