[sleuthkit-users] (no subject)

[Carlton F. <c.a...@LA...>]

I was asked to create an image of a system a couple of weeks ago but 
told not to investigate it.  I used dcfldd over netcat on a crossover 
cable to image the system.  I created MD5's of the source and image, 
and both matched.

I did a physical image, not logical.

Today, I have been asked to investigate the image.  However, the 
partition table appears bad.

I am getting warnings from fdisk saying Partition 1 has different 
logical/physical endings.  Then Partition 2 has different beginnings 
and endings.  I can't figure out how to get the logical images 
extracted, and we no longer have access to the source system.

Can anyone provide any help?
--